{ "Event": { "published": true, "date": "2026-03-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-31", "timestamp": 1775001781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9daa9b72-e8ce-4fcb-8af7-c368c2010cbe", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f327e8cd-2cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (ClearWater)", "timestamp": 1774935123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935123, "uuid": "2f1eb1c4-2acd-45e9-9ef3-0df1ccfcdeba", "comment": "Malware payload (ClearWater)", "value": "cf4840ae85d7acba4974d6dd55893d6c", "object_relation": "md5", "Tag": [ { "name": "clearwater", "colour": "#E8595B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935123, "uuid": "30120907-7511-4af6-84b6-058159e5359f", "comment": "Malware payload (ClearWater)", "value": "00202340108c101d59bbfb3daa4bbd6b4436c167e3c9734c07bfbdcb1402f746", "object_relation": "sha256", "Tag": [ { "name": "clearwater", "colour": "#E8595B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935123, "uuid": "8e6ad6d0-6c73-4a2a-93f6-c8c2780376c8", "comment": "Malware payload (ClearWater)", "value": "82357963420e55a3e99cfe20bd5bea6ddfa32a54", "object_relation": "sha1", "Tag": [ { "name": "clearwater", "colour": "#E8595B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935123, "uuid": "6081e0fe-d2a3-4ed7-93b0-fa8cda392db4", "comment": "Malware payload (ClearWater)", "value": "91d37ac2a7ead2d240b7590631dfd352a6c31a5a7bfc1fd456e95feb4f421006cf9a084d155ef01a5aa45df15678ff62", "object_relation": "sha3-384", "Tag": [ { "name": "clearwater", "colour": "#E8595B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935123, "uuid": "12549007-dff8-41c4-b3d2-7adb7f827e67", "value": "T1BD2512AB36A055F4E1675078CA52D78AF3B27452073097CF12A487BA1F277E1AC3E325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935123, "uuid": "046fb352-14c6-4ab5-b065-f7fafb8b799b", "value": "22e7125b95acf497b07e79559bdc556c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935123, "uuid": "e0db1be5-00ea-41cb-8710-ba77c7772a20", "value": "24576:bqKAJ2nZBV6vryrLYJtQubXWFl+0vdc3ax0LT:bqr8fV6vQ8JeuDW+0m3ax0LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774935123, "uuid": "8df781f9-0b17-4a38-8895-fbecb0f41f38", "value": 1007049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774935123, "uuid": "03962200-8d01-4365-9982-17b97f2c21c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935123, "uuid": "bf9c2cf7-106e-4e2f-b079-0ef6500cc110", "value": "zeksmi_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af468043-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979677, "uuid": "caf64576-8ebe-48b0-bde2-27ecd4d86570", "comment": "Malware payload", "value": "533bb5662dde5d4354bdc20b7faf5dd1", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979677, "uuid": "dec6dcd5-36c5-46a4-b1f8-a64553bff0c7", "comment": "Malware payload", "value": "002cdfa7506103b65a88c72dc30e6bcb44eb1986630cfd9e8790006233ffdac1", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979677, "uuid": "5a839f9c-6e7a-44cb-bbe9-b205727a3fa7", "comment": "Malware payload", "value": "82f97aaedff7413761dd829c23f54a905e3bbad2", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979677, "uuid": "ab997526-619b-4f2c-822d-af6a8ff93d51", "comment": "Malware payload", "value": "ca6813624cb3ee9d254ffcdea9c0b2a20abc21ad71a7cd84f0f83eb1f66f9f81861e5fe340b29335dcdb32c6e119d576", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979677, "uuid": "7632d8ab-9789-4703-bfc9-495a8bfa1928", "value": "T18186D81E48D46EE0FA86E29EDF35F3BE41F3B87A344AE549E1756952043F226C4182C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979677, "uuid": "888a412a-0014-4fc1-a44f-263c513c626b", "value": "384:ZwBmVzwJo0WVGRn9f/bkERi0RVYjdPDGn1VtUwG21FVcKPDm6riD6KnD/upyIVpw:ZUYzwJo0GGL3b+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979677, "uuid": "7fbc4bb0-1b31-4c54-90be-8c8249023106", "value": 7867724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979677, "uuid": "b3682e94-948c-441c-8df9-d3a29691996e", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979677, "uuid": "7111473d-d41a-4bfe-af3c-15da41ca3d65", "value": "2SLazMAR30_hvvvvvvvvvvvvvvvvv.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c93a621-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979646, "uuid": "6d62ae3a-462d-448d-b8f9-1908f81c9632", "comment": "Malware payload", "value": "6baee225ae9452f0650b0f9f4437ae24", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979646, "uuid": "5c055bac-18ba-49a1-bd77-9ad0dd4a47d6", "comment": "Malware payload", "value": "010ce592bcabf0d4e786b20d46bbd25893734a176e1f5322a5f28c4f94d4c6e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979646, "uuid": "aee39a56-cc8a-4822-bed8-576f21473fae", "comment": "Malware payload", "value": "aa60fb0d38a17af9ece9e94e6541a7bac15d2ed3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979646, "uuid": "95ccfd2e-c2bb-4b01-9488-88976b7fd167", "comment": "Malware payload", "value": "fda149109ce940221533a6a7201cf3608731c909c2888199d172a0893475b57337e966d732f3c957c5ada7082d8a604b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979646, "uuid": "823ffdeb-e4b4-4acf-bbbe-fe6877d7806f", "value": "T1DAF63363C66EB8C2DC72E37829F6DB0AA12FD55417616B4F0F3AE6986D690D1430B30D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979646, "uuid": "e977ef54-928c-484d-9ac1-ea8cb797ad19", "value": "393216:JXRcBVFq2sqklve8n2Df8kY3ucN6Os2Ly+ugmgnhdJ5zLF0hPl/E+:7c9q5lGfDf8Nuc82BugmghdJvWl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979646, "uuid": "d2f5b903-75f3-459e-aa81-e85a57318f2f", "value": 16662401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979646, "uuid": "0556d148-7497-4b01-925d-fad8f7dd0ee8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979646, "uuid": "4367ebdd-acd1-43e9-91e4-c02f0f1890fd", "value": "1Mar23ST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f66e4de-2d48-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774992401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992401, "uuid": "94307ae9-a8c2-4bcf-a49a-458d473df84d", "comment": "Malware payload (NetSupport)", "value": "123a1b6770606b2dd2bce6b143387106", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992401, "uuid": "590f0b97-c00f-43ba-bc35-7cd438c0eff8", "comment": "Malware payload (NetSupport)", "value": "0133a8a0bc4521eb39f24563c0866fe93eb0501507a920abbae5692f60c89220", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992401, "uuid": "53c080ff-0cfe-4672-8c52-8d82e7540e46", "comment": "Malware payload (NetSupport)", "value": "f27e28d854ad1d4cdd494a660614aef744e1eceb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992401, "uuid": "753a79b6-9885-4157-867b-7ed3e49eceed", "comment": "Malware payload (NetSupport)", "value": "750b128f72da9557b376dc29a08c8291487cb38a73e45f7817354121321b2109b94198306f18ecea42a5f27d07ddbccf", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992401, "uuid": "823a3c80-32a5-4538-869f-d1ad02ec373d", "value": "T1D5A2E1F8D98A8B1BD5CF2F728DCE628AE6697405F4F2205E845D3CD36C80C16339569D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992401, "uuid": "01c9e684-b1d3-4288-a16c-b3c3e61a92e9", "value": "384:ZZzxjQ0tp5ZX5kAX7sa17SlnGAMvlsmdx4Gi91GuLnvZEYdUPGIuvDvkr:Z7jhtXfj7sa17SlGAMv6mIv1txaGIurM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774992401, "uuid": "80986621-c85e-4f1a-8e9a-92325760b41c", "value": 23127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774992401, "uuid": "3da894a4-f001-4fa5-934d-0d8600079437", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992401, "uuid": "ba46f030-6b45-4a2e-9b44-3630b1be458b", "value": "MoliyaviyTahlilUZ.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9ede41-2d32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774982923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982923, "uuid": "a0a87049-9bcf-4ef4-ad5b-d696f55aa3f8", "comment": "Malware payload", "value": "82501356c64c6d30283c50951285d38a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982923, "uuid": "69c47b1a-bbbe-4a0c-9303-05819ad16eea", "comment": "Malware payload", "value": "01586069bbf6cc4d983bb965ea7d36cf8f539f8446b194427be824cc3f68513f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982923, "uuid": "5dc05c41-5684-407a-b44b-15c0d70bf6d5", "comment": "Malware payload", "value": "9eac4f01bda0a8c8ae2823bf3ed7ca9bd4d313ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982923, "uuid": "e6d57f68-2306-4cc6-8135-b086df59dea8", "comment": "Malware payload", "value": "fd1f4d5fa716f35ed9f0952947560b6d3c8b5348ba2ec0f8fdfc68a00dfc6668dea39f7890eb7f72f637b261a0bdae94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982923, "uuid": "303b0987-f575-4352-841b-818a53e0d7e8", "value": "T12D664957EC9514E9C1EE95308A639213BB71BC881B2123D72B90F6246F77BE0BDB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982923, "uuid": "f64c4566-a3e1-4e1d-aa01-edea3c74a89b", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982923, "uuid": "1bfdf628-a765-4d4d-a7cf-fd7a195598d6", "value": "49152:rGDnTqOX4ViITR0yTrHdZKt5Y2H36GbZUvqnzo2WzSSqim2slV2VjDwIQKQK1Ksq:rGTXIGbzamGmilLQumvBh8huTOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774982923, "uuid": "0560b981-4f65-4a9b-8e09-265bfa402898", "value": 6847488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774982923, "uuid": "365e2fb3-d50a-4db4-a2fb-c6da84b6a2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982923, "uuid": "7a597580-6de2-4681-8ffa-b26736c16064", "value": "rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0793a5f2-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959210, "uuid": "3d017b78-cd2a-474d-89a0-9ade2cef3bc7", "comment": "Malware payload (Mirai)", "value": "41af93a0fa236ae436fb94952175dcf8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959210, "uuid": "831c67a9-f4ea-4c52-9176-4916f85563e6", "comment": "Malware payload (Mirai)", "value": "0253355d66c4f314ddb4b5a15b7b1dc205f2c9fd7852319fe5b84b54f98ef93b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959210, "uuid": "ed1b811b-0ba7-4022-b9dc-c6bd25d2a7da", "comment": "Malware payload (Mirai)", "value": "f0421777e1ce768f1d1b5d8ddf21fedcdd9b8d2d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959210, "uuid": "c4c6f0d2-043d-418f-a8e7-baada9723008", "comment": "Malware payload (Mirai)", "value": "30afdb115e57515a0d4896a1d82f20ddbef7d5798fbd635297bcdc831a2dbd24ce75842b66c153878ccb15e1594a0b9d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959210, "uuid": "fa0b2aea-47bd-494c-8cae-11929876e9bb", "value": "T1CD639D39E41DA590C4564178A8E98E342F53F08883B31EFB6EEB42B2144BD74F915FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959210, "uuid": "7a5f6afb-f15c-4cf1-8646-8e1d858d8160", "value": "1536:FaoOwtR/WdRh6LQZfuwW7RG/JXn7/qC0C9B:FYDdRh6LQJuwfJX7/qC02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959210, "uuid": "5134e797-3497-4819-a0a5-3b89195661a8", "value": 67728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959210, "uuid": "85896113-f2bd-4c2a-94f5-7e0cde7a9bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959210, "uuid": "9927c949-a1bc-4ec5-a85d-96cc8a99a179", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b2a70e-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979691, "uuid": "8ecb499e-9460-4ddf-b6d9-b5cfc1935af9", "comment": "Malware payload", "value": "def6f8062367490a92ad6650522da0cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979691, "uuid": "2d89f1d2-a607-414e-8905-e5327748f777", "comment": "Malware payload", "value": "026f71d40fa2e3c530283c1a70925d14eeee18d98f95506dd88cb698ccca6859", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979691, "uuid": "fa83678b-6e50-421e-9a9b-e2db617beceb", "comment": "Malware payload", "value": "fc9c379ab1b33bd4d184486af053dab8ea6bdb3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979691, "uuid": "5c59aacd-d2fe-40fd-b3dd-be925019b49b", "comment": "Malware payload", "value": "27fdf2f28f0541bc4cd1908dfecc7efbc4dfad8106d2197a6b9516ca1aedbf3085ddf344eced77d26c2acdd41b42f023", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979691, "uuid": "9ca04dd6-324d-40b7-903a-91a748392246", "value": "T145D4BF03277681A0D16ACAFEBA72CB32E6353C5CD520B537EEA05E163F74750AAB5701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979691, "uuid": "b2d3f10c-144f-44ca-9699-6b7472fc7c55", "value": "9d63601b75db6820cb6e18c76c455c6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979691, "uuid": "63f37244-c9d5-4a6e-93fe-569f3e47fdb1", "value": "12288:NiPXsVoSGbbmvbMtbYmBp21P+8gKpQX24I55i7P1GhMo7I:NgXsVoSGnsbM6mBp21P+8gKpQ2t5k7PS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979691, "uuid": "d91e331f-fdbb-4f22-8843-b1efa0d56bce", "value": 621864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979691, "uuid": "76e3b89d-e3b3-4b95-8a2c-479a1da2adb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979691, "uuid": "036e9c75-eadd-4cad-9a0a-2aeab2ef8867", "value": "mod_2LazMAR30_shellcode.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56358599-2cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1774960200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960200, "uuid": "926b802f-c56f-478e-a3f9-f44168c16095", "comment": "Malware payload (PureCrypter)", "value": "465854517b1e404c4e1343abb8c02e55", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960200, "uuid": "cb4dec8b-f97d-455d-8c80-d867aea373cb", "comment": "Malware payload (PureCrypter)", "value": "0299d636802f5d8ce29683c1f5da0fa62b43f5cc905be187c3998b85c8749b42", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960200, "uuid": "d2681bb2-9416-45f0-b500-6a3929602d60", "comment": "Malware payload (PureCrypter)", "value": "c5dd757eff677115edc100a5db3e52064894c015", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960200, "uuid": "ad5819fd-3f67-41a8-9b3d-a1fc47ddc32e", "comment": "Malware payload (PureCrypter)", "value": "18ff449f6f7b511f7742a6838c3108aa324926c4aa542b28f6629b4f3666f5678268e27af25cd54aeb7783a5cf89ab9d", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960200, "uuid": "13603de1-6796-4bdc-99f3-8892cd20e695", "value": "T1DB1733366DE213A1DD3C6830DA4FB4748A7DE81C291061416F5D3BBD47AE03E62CB7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960200, "uuid": "4b92d484-5b3f-44ac-b4af-1d7dba223d00", "value": "393216:G+DpjRGxBk5wG4xdHCiS7r706rylaOKFeoJnOoMf9PVTOPzcZ98cj:G+eBk56nHAv0zadFeoJOoyPVTOoZ9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960200, "uuid": "36d91aa2-9bb1-4a54-92b4-eed5fd6c15ef", "value": 19902464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960200, "uuid": "a2ec754a-2c20-44c0-9cfd-e89cb3b2ded6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960200, "uuid": "c72c2be2-dc46-4e7c-ac1c-788a4880b365", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38405b82-2cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1774935669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935669, "uuid": "14a2a2a8-962b-4230-b2e2-bfa61cc2618a", "comment": "Malware payload (Kimsuky)", "value": "a3363e0c22c0356fdbcdc37f502bbcde", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935669, "uuid": "8f025678-985a-4306-b0fe-26fde59884cd", "comment": "Malware payload (Kimsuky)", "value": "02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935669, "uuid": "bb8fae6b-bf42-48c6-a693-c1bd69eb60a8", "comment": "Malware payload (Kimsuky)", "value": "23f9756d593354111beba4b2ff2ebf5bd8154bee", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935669, "uuid": "e42255b3-759a-438e-b35a-bf9e709f5b9b", "comment": "Malware payload (Kimsuky)", "value": "5b4567c2dd0ed385ee4f3a716f0103f67ba5802bec0763067bb2f0857dde76b23a846869a5125e559a950fffbf700885", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935669, "uuid": "113413a1-5c1a-42c0-b187-62109f7d09ba", "value": "T1E2B1E20177E90148F6F32F14AABE2560486BBE9A9E32CE5D06240C8D0A71B549CB6F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935669, "uuid": "cf00298e-d460-4177-acd0-a87b524107d1", "value": "96:FmuK4rHJWNj9paIWh061SOONyWUOO9Xes6G/nbzHJhAHrqWSWzHJ5I+E:FhK4zJCfuh0DOONyWUOO8b0brJSL5rJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774935669, "uuid": "d703260a-7cf2-41e9-a8f1-fecc49607fb8", "value": 5136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774935669, "uuid": "c0ea2e71-8a9c-45b0-afe8-4d8204792521", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935669, "uuid": "88f1636a-c68b-452f-9e3b-47239008da38", "value": "firefox.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01fb5c4-2cb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774929911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929911, "uuid": "11e48907-f1c7-4346-8e43-d1aebf82b045", "comment": "Malware payload", "value": "cc744cba33cf300c7823b7d4774a407b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929911, "uuid": "aef785ab-3658-4ba6-a3b9-e5f0d9c7fa0a", "comment": "Malware payload", "value": "035ca113035ac928f69d90d573c73dba2c589ae4478e0cb8e98e4f14a21a8631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929911, "uuid": "5086d06c-989a-4057-8a63-40c610d045a8", "comment": "Malware payload", "value": "824e553d7d9fa1cfce98e1b22ce6c03648811861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929911, "uuid": "3919598f-b4ff-482f-bd35-8d3ec06fff45", "comment": "Malware payload", "value": "c1444185e94b20c0537bd1c2d0f7d110198159d151856da0a2b25951820b5d8c7d5f5db86d11c5f2a6831d0e2773bf74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929911, "uuid": "540a33fb-9a98-4af1-aad9-85512a5872ed", "value": "T14E723B8BBB914CE9E554C23AC673451592B6F44207B367CB23A1363D0E2EFC06D3AA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929911, "uuid": "6f183043-ae67-463b-b50c-eda9002e42e8", "value": "7d801c4a80af12542c12b76b0754c00e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929911, "uuid": "ab38d148-8527-43b6-8352-bec3a6dfe431", "value": "384:7anZg0UjSEPiQiSjCBNYDpM2vydbTy23Jrz:mZUK+pM2adbu23J/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774929911, "uuid": "9ac70756-4a28-4f01-8037-d8742fa301c7", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774929911, "uuid": "8fff12fa-9795-4018-8613-383a830f0cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929911, "uuid": "fccec241-0244-422c-b383-cf34ef557a6a", "value": "fhgn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ca8eac-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979658, "uuid": "b3edb1a3-3579-4ef7-aab5-6f577dfa2479", "comment": "Malware payload", "value": "195308b6b35ffd58ba0a2b55335eb5f7", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979658, "uuid": "82c0272f-5799-4a7f-9fd6-757ece435324", "comment": "Malware payload", "value": "042a61a0504567fca0c39f1e60995bcfaab1b0c08d8787614e55eddd177b83cf", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979658, "uuid": "b043718d-0401-477b-b7bb-eef2ac7b8278", "comment": "Malware payload", "value": "ce49b7c920197f28593e934d8962da8cf20703e6", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979658, "uuid": "71bdae00-535c-49fd-8d4c-7a747f8bdfbe", "comment": "Malware payload", "value": "5d0cce00774103e6bbbbf897262b054c9f88f9442ef08c93a7cd580fa5cce58dc1b08e05037f3ef18609e9ac96786a2c", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979658, "uuid": "533eb9ce-6178-4ffe-8d98-4abd890bb9ee", "value": "T1325548277D4861E0DC81D84ACB23B17630617869BE8743B5534E7F9FBE71368B81728A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979658, "uuid": "9cd28481-2e16-4f19-b20c-2e57e4743440", "value": "384:ehzBHkr0XzUTztNVGRvsdkbG0wZP9aYnWdTYOjFsjZLuVsL76y7mQvbDkF:ehzBHkroozVGQkbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979658, "uuid": "b2daea77-7fa3-430d-a4fa-4320391c870f", "value": 1306997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979658, "uuid": "bf17e452-0d94-443a-b693-39c6c1762068", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979658, "uuid": "c3b6f959-c2ed-4197-921b-e05b509887a4", "value": "1MAR30_UK-Viooooooooo-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df1cd8f-2cda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774945047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945047, "uuid": "72c7bb83-fd65-4d65-85cb-49f719898b26", "comment": "Malware payload", "value": "380c2d86ee9f00ce0a769447aabc5294", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945047, "uuid": "174aff83-6ec9-46c7-8c9f-f5b4e7f2565b", "comment": "Malware payload", "value": "0570155b3f5194e7d9cf9e9ed1e2dfd00d45488b1434e0b64212d5274f2790df", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945047, "uuid": "46dcefef-d441-4fb4-97a1-aa08de63929d", "comment": "Malware payload", "value": "18d4369ca03e8198e83ddeb060bbd042618ccdb5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945047, "uuid": "b2773d63-95af-4be1-80a2-d3e00c3c3d84", "comment": "Malware payload", "value": "74c0502b2c373da0134e0e14d3f04fb5b7ff9b4a8474f4df828d8faab1112d2dfbb5e4645a36893c1788f5c9b20f962c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945047, "uuid": "38cf97b8-d0c2-4b94-b97e-527eab017952", "value": "T16D41C3BDB461859E623E0A77EDF9A504D0880E5BCECC578805D8C59D3FFCB2B7118AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945047, "uuid": "067c8204-0fb0-40ce-afaf-5361ae744ff9", "value": "24:hYhkezYpFgLfPq0dV0uQ3sK2i9m8UHYLH2m8U9xvm8U9CeYjaQBrllz:ID+aqsKV//y/4/WqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774945047, "uuid": "d761f0c3-1974-424b-b17c-6b1fc2863099", "value": 1880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774945047, "uuid": "87a137dc-2279-4cfa-a53b-cef3ba13cc05", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945047, "uuid": "3cefab74-ff53-4dd0-942f-4eabe602dd65", "value": "xy_b\u00fcntet\u0151\u00fcgy_iratai.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d31293a-2cd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774942120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942120, "uuid": "9e8fed1f-7b55-432b-b80d-21445c297e5a", "comment": "Malware payload", "value": "efd0e9b2f26da00f2663c00f8e63e0c4", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942120, "uuid": "42b75188-f7e8-45ae-9d54-d4de4d9cbf04", "comment": "Malware payload", "value": "0593c9b5b6761375b1cc014ad62ea90e5c3e6ed7e3cf0ed15203e1092978d7cf", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942120, "uuid": "99533370-a1b0-4ca6-b66c-698fa0f8125c", "comment": "Malware payload", "value": "1b1231647fca604800e2b819925192927c4c681a", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942120, "uuid": "e5257f90-0f0d-45c3-8c6e-1b6197d22001", "comment": "Malware payload", "value": "4390b05a34b35bec596b2cc7f672c596d8e1356018ce594d142f917a24d27cf049bd83781cb9c3f472a3945387fe1619", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942120, "uuid": "d4b1ae64-b9cd-45b3-a259-d01b4a9f8dc1", "value": "T1BF5129041DFB01CCF27797315BECB9F74826E851992E36B81281C6445B36980E862EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942120, "uuid": "d212cbd2-a881-4ffb-945a-8781bde77246", "value": "48:8B5aCLGUrg5M0R8/rQXlfK2oY5XOdLPZFBDaIuhzP3jdJDrObVvDA+5MM3q7BRa/:8B5Fyogy0RvKXd3BuIuhzPTdJGxOCqlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774942120, "uuid": "23e12fc6-dfd8-4c4c-b64e-bc3aa7d0dcf1", "value": 2992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774942120, "uuid": "3c9b3480-e997-4844-a0d1-e9c9ce66164d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942120, "uuid": "ae937167-b609-4bac-af9b-897332c44ca2", "value": "0593c9b5b6761375b1cc014ad62ea90e5c3e6ed7e3cf0ed15203e1092978d7cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ef9cfe-2caa-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774924773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774924773, "uuid": "27fb2af8-d97c-4ad2-b55d-a4d8199a8684", "comment": "Malware payload (ValleyRAT)", "value": "d6be644b879e81a99fcfd922ae6b8aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774924773, "uuid": "b5c18d60-f977-42d8-8685-fae26642b10d", "comment": "Malware payload (ValleyRAT)", "value": "062411e2c171f14687bb9fb47ee01e1bf0576e8634ad426b1b4c242c0a264077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774924773, "uuid": "d977fa68-e300-44c2-b2ea-4e58c88f6c55", "comment": "Malware payload (ValleyRAT)", "value": "01796e245d1dcf249b26a0f68ad33971e13d7275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774924773, "uuid": "18bf4c7e-3faa-4472-8c0a-378994998a08", "comment": "Malware payload (ValleyRAT)", "value": "385015176f486169735485b1b82ef432b02d6f2c279044b29c2132da2cf4516eeca59c351d379018af435a805c420594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774924773, "uuid": "81a11989-d219-445a-a483-f6a437e43e36", "value": "T147178C0A61A440A4D1AAC174C957C6B6E6B03C4993B0D7DB22907EEA7F337F1793E391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774924773, "uuid": "d2ca8705-7fdc-4c06-a791-d92d0cdee6c2", "value": "30a343445171762121d6b7e4b9a124f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774924773, "uuid": "c5893227-a940-47bb-9f29-5e791b594288", "value": "393216:qeO5ICnK+O/ggR5jZVN9L30m2pv8D2gDj0uYg20huUr:zOjg8uYg2GHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774924773, "uuid": "884f505b-de95-4f75-9051-16d0370027be", "value": 20226048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774924773, "uuid": "993467e0-ec5c-458c-907a-3eb76830a1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774924773, "uuid": "d0b069c2-b946-4ed7-9366-f122ea7b97b6", "value": "Files.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb698137-2d04-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774963404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963404, "uuid": "36166f2c-5db1-4448-84e5-5d808157caab", "comment": "Malware payload (Vidar)", "value": "ca2c271ba4866a42623802be7b8d9908", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gratisexpert-com", "colour": "#14DE21", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963404, "uuid": "56fa650e-c964-4d27-8ab1-aab48bcb59d5", "comment": "Malware payload (Vidar)", "value": "063e5ad5cf1aa3e286c036a06a96bc8b93a65195ecaa5cd62d2bdc6975493dab", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gratisexpert-com", "colour": "#14DE21", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963404, "uuid": "a0c50cc8-57e0-4b05-a951-a6ae0f5a5e30", "comment": "Malware payload (Vidar)", "value": "07e676c10a11d35a722455abcaac1c0ad874d97c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gratisexpert-com", "colour": "#14DE21", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963404, "uuid": "7394e2c2-2419-4da7-a1be-f717611e1518", "comment": "Malware payload (Vidar)", "value": "c2d61a7b1a274e26ca102cd71c2648ce54fcece3c686af5a0b0e782bd0e2eaf11bcd27f39264575e3ee7bb7439ea6581", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gratisexpert-com", "colour": "#14DE21", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963404, "uuid": "e685f492-d716-4212-9cc7-fcab01067919", "value": "T127A57B0B7CE105BAC46A633289F252927A76FC590B3223D72A90B37C3FB66D05D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963404, "uuid": "86156f54-2823-4b03-8a5b-dd48cf3b00c9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963404, "uuid": "d2cb6c0d-0eac-4d05-a4c9-873ca363709f", "value": "24576:XNWebE4uRVj2DqJN8H0FmYuFwRhWRzR1TOQsnLtGEDXT4K:X4ew4u+sGHjPqhWR7TOQa5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963404, "uuid": "de9e1053-6f2c-458b-a63c-109b8ba872df", "value": 2072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963404, "uuid": "0c91f5db-d1a8-42c6-9ebe-8a1afd5ace02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963404, "uuid": "04846c27-fdb3-4c3a-8cbe-b0fa3f5eca61", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21f7bf1-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979655, "uuid": "a6745bda-e970-44ff-a66f-08990b7b95e3", "comment": "Malware payload", "value": "4077459b2ed520928714308fbf5ac348", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979655, "uuid": "798d1596-66d6-488b-8702-0319ae0b7616", "comment": "Malware payload", "value": "070f1c9e5c94c99f381122d5ae6f20610645273cb83aafb482e9d15a82acfda9", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979655, "uuid": "1786680b-839a-4847-8e9f-314f2353b05b", "comment": "Malware payload", "value": "a3ed51eed89774d9958db115f67825bbd978940a", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979655, "uuid": "7c63338d-9d3e-4fb6-a066-940beef4a96b", "comment": "Malware payload", "value": "efb78c755a1a1d1bcee2bec59fc9aef8910106c201fd211834d7fd33e11fcfeac060341cdfccfccc7ad0d4dee352fa8e", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979655, "uuid": "4fa270ce-f075-44b7-9b39-4c0144d6930c", "value": "T13826B2D2E70D7006AD53F568B09BE68722A1948EBE707F56D1A2FCF64A61242DF0334D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979655, "uuid": "eb2e8292-cb11-4dae-9575-b1f3c65b4305", "value": "768:5H+9zwWBV/vdFGOlbnf4k23IBND4Wj/tfTYU8yQMUZRe8yYfi3AfCwvfl4NVR34n:5IzwWBV/fhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979655, "uuid": "975badbb-f763-4f8c-8454-987eed4fc9d1", "value": 4501898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979655, "uuid": "32c136e5-d975-4a5f-b5be-ec168a77e34f", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979655, "uuid": "4d46cbf3-2d79-4a96-83ad-193494f6cf5b", "value": "1MAR30_Hvvvvvvvvvvvv-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c0df96-2cf9-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774958592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958592, "uuid": "be4a81b0-74a5-4649-a03e-ab70a8fb03fa", "comment": "Malware payload (AdaptixC2)", "value": "9982fc296f41d48d7969be88650e3889", "object_relation": "md5", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "dropped-from-AdaptixC2", "colour": "#B95E8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958592, "uuid": "7c7dcf23-6990-42cc-b35c-0ca3c6d2c337", "comment": "Malware payload (AdaptixC2)", "value": "076bd8e03fc577eed02aab9a0b2849956286f94972f5a2334dc27e7e5df64fcd", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "dropped-from-AdaptixC2", "colour": "#B95E8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958592, "uuid": "aa45fb16-394d-4607-889d-a71282b9566e", "comment": "Malware payload (AdaptixC2)", "value": "ac3eabbe4829f78769ea6505863330f7e57bc89d", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "dropped-from-AdaptixC2", "colour": "#B95E8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958592, "uuid": "9e4c38e1-bbf9-4335-bdf4-0853eb68a062", "comment": "Malware payload (AdaptixC2)", "value": "5e80d1e007c4f623530d3daedf503779ea5ceb7bff61ef994c3111b080d2be431a55097982e1875a50d78d7ce3e7421a", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "dropped-from-AdaptixC2", "colour": "#B95E8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958592, "uuid": "a2bf8456-47b3-464f-b099-1a0cf9354a21", "value": "T1404533C2CB7B7409D008357A22F742C2268875114726D92B7EEE92F8B5972775C63B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958592, "uuid": "c85a9822-8081-45ab-b424-1c7b06b7043b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958592, "uuid": "6c6b3028-89a4-4eeb-b9e2-7629b03ecdbe", "value": "24576:eP8IyEKEw10N8qHdADdxyuUEBlqkVT9RKUJbW4xcVFvi1Av9E+:kFKEC0NSHyuVbVT9RKU84u9nV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958592, "uuid": "b41f0f2c-7176-4f85-96a0-c32fe7da5668", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958592, "uuid": "94384db4-b540-42af-808c-02c80e944abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958592, "uuid": "f2e28f34-ebb8-4bf5-bdc3-ee24baca9499", "value": "net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e77df23-2cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774934391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934391, "uuid": "735f6616-4c83-4289-9aed-a855b96bbfd1", "comment": "Malware payload (Mirai)", "value": "974b82588d175fd38379e0e15ea04912", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934391, "uuid": "c1cf3978-2d9e-4e25-99c3-dd5dc866e480", "comment": "Malware payload (Mirai)", "value": "076cfb8aa47dde85c4adbacc5a7ffdae4424adcf8c4cdd8cff6567e6a92e0f04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934391, "uuid": "7b83cfab-3a5f-4298-a83f-8fcc958ad2a2", "comment": "Malware payload (Mirai)", "value": "5d51a1209ecd7cd487e6f43795bed7aad23177ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934391, "uuid": "500d4d51-9fb1-4de0-a82c-6893f1584f29", "comment": "Malware payload (Mirai)", "value": "565d751c408f3dc1ed0292ec2cb623f3ae4fde75df61cd307d6cac554b150b7df5c6f07b48c2e3d6006088ded9653a9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934391, "uuid": "e3ee8683-34aa-47a7-a37b-be13b72a53b9", "value": "T127342A02D5514B67C1C21BBABB9A429D37336F64D3DB3312AA14AFB02F86B9D1E3D111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934391, "uuid": "6be0f61c-a8cf-48ba-bb29-eabd8019656d", "value": "6144:h0mqTIUwX0+w2a4Mstfta/4NvULDsnDMmmRnyAIZ5L4vyRe5:h0qNXtw2a41JtagJbDMmmRnyAILL4vyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774934391, "uuid": "0ef01604-8d92-416e-9efd-fcc3b9d5cd94", "value": 245147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774934391, "uuid": "bf303efd-52fe-4e4c-b25d-1e81e8413b41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934391, "uuid": "3f5c0b25-52a5-4cfd-b2f1-727cf23bd967", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb7f154-2cf7-11f1-a769-42010a9c0008", "comment": "Malware payload (Fuery)", "timestamp": 1774957827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957827, "uuid": "0f6c415a-9140-417c-a981-a2545d154182", "comment": "Malware payload (Fuery)", "value": "831e63d6ca18fc820e7815fe0b5bd50c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957827, "uuid": "8d52d931-6043-4bec-8880-331648359d0e", "comment": "Malware payload (Fuery)", "value": "07e391dab301cf7dc7705d58131bb55508e8865f394df644c6a4a14da45060b4", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957827, "uuid": "44053955-6510-4cb7-908e-4a2e9514615e", "comment": "Malware payload (Fuery)", "value": "bdfecbc14df8d60a8f0af607fbc8baa3a516d3e1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957827, "uuid": "66648301-51b3-4dd7-a420-96ad1eca2bc7", "comment": "Malware payload (Fuery)", "value": "f4f0d082555445357554181417aaee2db5375a56630c45b570383ad53bf39bea1b58bf0a5dd74071df92879a0164597c", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957827, "uuid": "2107e1cc-41bc-46fd-8d22-88a991250aa2", "value": "T10535F1452259D902D0A72BF01D71D37847B96E99A812C307CFF6BDEBBC3A78168092D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957827, "uuid": "a2578f67-715f-4887-b7c9-a9e6d0b0d248", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957827, "uuid": "eb142463-3def-4d25-ac01-713332cc1172", "value": "24576:2/nOAS97p9KDB4Rm7+rO5PH73Bff2laD26:mFS97p9KGESOBH2lM26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774957827, "uuid": "b31ac3e8-ff8e-4608-87c4-523548258d28", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774957827, "uuid": "d4fdba02-6356-4a73-91d8-e8ffa3d532cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957827, "uuid": "54d2d2b1-5537-4d2c-9960-3625aae588dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab78bc26-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979671, "uuid": "b66935d0-444f-4cd0-8e67-ff43fb815414", "comment": "Malware payload", "value": "08ce81e784f6d8f5ef7661586a37a240", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979671, "uuid": "35f49f87-daf1-4b1b-b3e9-ccd6638c3cce", "comment": "Malware payload", "value": "07e539e3fe0ada48596c9db11facf5179a6feb8819ac962166aca02a3b5be3f8", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979671, "uuid": "2b04f12f-1440-42fb-9326-d8c0b68d4007", "comment": "Malware payload", "value": "a11a6fadaad946a44b8360676f3ace7cfd1c079c", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979671, "uuid": "242a658d-a096-42c9-a23d-5ec1ad3baf1f", "comment": "Malware payload", "value": "04d37a878a9080af723a7ad8879ebffbd3037709366a3a2e44b7d1dd5abc1faf46e15998838ea224f838ce0f46854175", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979671, "uuid": "85133ffe-3b28-4f58-b577-7197c5cc8a6c", "value": "T1622601811CD536DCC11B5561FC9EAE99C0A16D0BDF91A90ECE94A8AC0BC153DEFC8F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979671, "uuid": "1c2d668b-a307-439b-a699-86abb7f13234", "value": "384:1IVGRAa3mUX9gJzZIxbmAk6nGQk/F7+ajva8GIgzbN0Huuk4a0n7q5z:1gG2a3QzZIxbmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979671, "uuid": "2c3f9534-1659-4a26-91d1-e9489abc95db", "value": 4501876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979671, "uuid": "4a79febf-46e5-49fb-bab0-d514a4e315ae", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979671, "uuid": "8e0f3051-27ae-4493-a586-23c2e8aaac24", "value": "1SMAR30_Hvvvvvvvvvvvvvvvvvvv-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b4fd82-2cd0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774940918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940918, "uuid": "bbe86c8e-fb63-49f3-99fe-ac802797d0cc", "comment": "Malware payload", "value": "0ccafa8b504e44d361654ac7c5ec2646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940918, "uuid": "d4c53c15-b90e-45e4-9b05-28507270e97d", "comment": "Malware payload", "value": "0874ac4128f38465b8f844e4ca3a81796f727770113c2c446b6fc7e5c1104527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940918, "uuid": "182f7cc8-db84-4f2a-b187-366c941b889f", "comment": "Malware payload", "value": "c82b5ca0807d18d64b254bfd6f9f9047d32603ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940918, "uuid": "a35daedc-be0a-4bd0-a91e-cdd14f7ebde5", "comment": "Malware payload", "value": "80fb86d9d844a80666363ff163f9f816826bee7f660a063f1381e4f6351416fc1e18363165358a8d58da4b8ce4f1b874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940918, "uuid": "5ff424f0-7192-415f-a046-c9d7e64a0c6d", "value": "T136C29341BBFC4518F2FB6F34ADB152A00A77FD9A5D32CA5E0940658E0871B91CAA0F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940918, "uuid": "7a62d790-25c4-4b85-bc16-f5ee402ed152", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940918, "uuid": "8e0e888e-0989-4c00-a7cb-ba631f6f89b4", "value": "384:maXoATL94VktAgzN1WCaAswZCOdyY9jE/xf6SStcc76c/zGwcwexDPSVS:maXoAAkiAs69oVziVexDPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774940918, "uuid": "63edd3bb-4af4-4f70-96c7-2be81ca55894", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774940918, "uuid": "caa407a1-419b-473a-8f1b-594007c766a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940918, "uuid": "39dcfe92-298c-4d6f-8b6f-f7c2e983e651", "value": "0874ac4128f38465b8f844e4ca3a81796f727770113c2c446b6fc7e5c1104527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15db08f7-2cf1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954939, "uuid": "28670159-ba27-4a5d-99a6-3faff8e77402", "comment": "Malware payload", "value": "45d4c309b9bc5a780c73a2f0f53f7c02", "object_relation": "md5", "Tag": [ { "name": "ar-py", "colour": "#42FF97", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954939, "uuid": "4c6caf86-63d3-4574-9149-f4107c25c0d9", "comment": "Malware payload", "value": "087a90de98dfeaa598d31ad0aa410b4c0c400df01e98c8eeb40441cae6107553", "object_relation": "sha256", "Tag": [ { "name": "ar-py", "colour": "#42FF97", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954939, "uuid": "73a00bc1-b9bb-45d0-bbbe-756e39da14a2", "comment": "Malware payload", "value": "227a8ce5b0e8597b93a51ac52d26ef6d55a455a2", "object_relation": "sha1", "Tag": [ { "name": "ar-py", "colour": "#42FF97", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954939, "uuid": "559426bc-6f9e-49fc-81d8-1abc2689468a", "comment": "Malware payload", "value": "b01162ea4be0b2d21da27376ddc8d473d9810a8181f3f5b66b58d26b3bb19002a0fb78a5d3e2023f0a087aa5b9520424", "object_relation": "sha3-384", "Tag": [ { "name": "ar-py", "colour": "#42FF97", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954939, "uuid": "b40a7ed4-130c-439b-9381-615bdf21320f", "value": "T109C18D33A4E0D15E18DDE62A83730918E36B43CF39A1167641BBADE157D7322A02FC72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954939, "uuid": "0ac0d953-38e3-4f76-ba38-a664dd0b0bca", "value": "96:+YmKeW4ccx+1TxfxsUFxdPyXyTbNtRxuATvjdOjyhxAIe6rOHhexvurnlDyhSEre:+Yzelh+1TzPaif/VT7oehxAr6CBexmrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954939, "uuid": "83147103-b45d-4b93-a316-1de3d575e131", "value": 5680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954939, "uuid": "2163af63-bbe7-4355-b00a-809cb93fc1e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954939, "uuid": "e325872e-656f-410e-a85f-ffce358416f4", "value": "ar.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26df3638-2cf6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774957115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957115, "uuid": "53b006ff-d3ad-4c2d-94d6-d9c708a75dbe", "comment": "Malware payload (Gafgyt)", "value": "2bec0d7f5e0bff4f0f37b99b60383ea3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957115, "uuid": "e3a9b676-4478-4565-93f8-eb7a8e2b2ae9", "comment": "Malware payload (Gafgyt)", "value": "08ad5b2299e73f782eabdb47bfe7bb5afa872f9b13cf4f4224218553ea0fc386", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957115, "uuid": "9bed7588-4400-44fe-aef0-41387635bdc2", "comment": "Malware payload (Gafgyt)", "value": "e667afd75a445f6307113412fd29570749e0615e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957115, "uuid": "296618f3-43cc-4d06-807e-54a3b557a10b", "comment": "Malware payload (Gafgyt)", "value": "218fddc3fe4fc74e6390ea7af9cb15a6afbb5346d6eb3ac4e6b160f99667622cdec5f7663a21edb4d3fd48963b7a730a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957115, "uuid": "ca69265e-3458-4c0f-ad62-cc48522f77da", "value": "T1041429417E409E23CBD0677ABBEE42CD731223FCD3EA7113EE015B16369A51A0E36592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957115, "uuid": "9aa6a747-d4e7-4347-bb72-0169a0f7a2e7", "value": "3072:ArTwazXhbpX6GDA0cUMwyklRZakii1OTR9XFaSoSFSWNkyxg7o7Vs1rj60kPikps:W8AXhbpXBDA0zMGlRZKi1OTR9XFaSoSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774957115, "uuid": "3c1ea027-9a1e-455a-a6f5-ae510ed5f5ee", "value": 196200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774957115, "uuid": "14aed966-433b-4c90-8724-42e7358ff7ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957115, "uuid": "fd4e3cf9-f418-4042-b94f-627f1ab5a74e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67aff03-2d28-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774978884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978884, "uuid": "32f09d41-30aa-4b45-b977-0caf27e7b6cc", "comment": "Malware payload (RemcosRAT)", "value": "940644c823ea0ef593f724cf35b7b960", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978884, "uuid": "b581c2d0-7ed3-48d6-a86f-32b047778774", "comment": "Malware payload (RemcosRAT)", "value": "0a4118fe4308cbb2db46ba76de82d70345b00cd3ec93167056fc572e8d4c4f64", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978884, "uuid": "a146a76b-672b-476e-ba53-318dbc4cf622", "comment": "Malware payload (RemcosRAT)", "value": "02ea8b0bded4e1ea160d7c8ac767499886eafefc", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978884, "uuid": "2699d255-7474-4d78-aeeb-d00b84a789f3", "comment": "Malware payload (RemcosRAT)", "value": "0316fd1795d66bce23e50542ba91a9dd1dd5df10f90e9211aed659d1ece592fe4da621b5f255b22337afcce8aa57e8e8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978884, "uuid": "595b9d42-f093-409a-9d84-90596c802d34", "value": "T19D02296C4FC3B2CF6136B3EAA1B60590DBAD803F2539F5A5D721F5384891DCD92290E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978884, "uuid": "87643c8e-b33e-447d-8036-77d0bfbc9f52", "value": "192:NBeUcyimtOOvXcai5pwz2M9nQSls0O36Fp8bKX0Qq5HZp8bxO5X0QqUls0ZpnQFc:X2u4xZskB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774978884, "uuid": "ae127227-ad9c-4c64-8434-b034c62fa3b0", "value": 8432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774978884, "uuid": "a5769e76-58df-4a64-99f1-d870d6012b08", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978884, "uuid": "2ba0af0e-5561-425b-9d29-ee6b6e577c77", "value": "Banco Santander_C\u00f3pia de Pagamento.pdf.vba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7163ffc-2cbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774933707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933707, "uuid": "f7dee5c9-29cc-4d35-a090-3670c3f33972", "comment": "Malware payload", "value": "5554f40406629909d764ba4fa36716f4", "object_relation": "md5", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933707, "uuid": "f74b04d4-a070-4017-bb28-f24e661906a5", "comment": "Malware payload", "value": "0a4ac8f45a51ed772a35a667c8dd318c2da8f47ea0c92bf814f183de459ddd3f", "object_relation": "sha256", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933707, "uuid": "32cefa46-10a8-49e1-834b-7dd971c48750", "comment": "Malware payload", "value": "b69c623b93c00a44c1530eeedee7d9c5ebaded94", "object_relation": "sha1", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933707, "uuid": "66d84f2c-c0a6-4983-999c-34280eae9470", "comment": "Malware payload", "value": "84441dc424c0e9c587b0e73591cc62f97009f007e82c114b6efa2b89592a81e6be6a9e62280e1ee35c1a52752879ff37", "object_relation": "sha3-384", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933707, "uuid": "be4e54f9-373e-4ed9-98a5-b65be63b80c8", "value": "T15C74CF02BAF2CCB2D57219335939B7256D7D7C201F24FA1FA3D8696DDE304816225BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933707, "uuid": "8fb31d61-4028-46c1-a014-751e69f86d6b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933707, "uuid": "b34d84a4-354d-4120-b1f9-767e3db74e67", "value": "6144:zOYGXaPNxdgSdcq2pVZPOJHAbKdq3xv9mT8MpaTYImqbYHqHNzk4H:HGqN/XdctpVtkNq3h9kpScqbvHNzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774933707, "uuid": "8580da2e-2f8a-4a8d-9c05-ef46822dc4e6", "value": 362552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774933707, "uuid": "361318af-44f4-4f80-acf2-d0ebd028c594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933707, "uuid": "5a327f5e-79d4-4a53-b34d-1c1b3f0057f8", "value": "0a4ac8f45a51ed772a35a667c8dd318c2da8f47ea0c92bf814f183de459ddd3f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa2e75e-2d47-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774992160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992160, "uuid": "c1596a1d-3476-4116-b752-4e13ac583e06", "comment": "Malware payload", "value": "60c55b1fbdfd8eb8d762bafe03e02936", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992160, "uuid": "bf14bea3-4090-4ff4-a6ce-ec3dd60f42bd", "comment": "Malware payload", "value": "0ab588411764cc47f270ca775b90afd8ae5981d118256e18a7b9c4f48e0abeeb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992160, "uuid": "c4227387-f9ac-466a-b524-bd51cbb8d3ea", "comment": "Malware payload", "value": "21749bd09eaa8003581c55aca957340808eb367d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992160, "uuid": "5911ef79-1dbd-476a-8faf-f3643e688065", "comment": "Malware payload", "value": "d2b085f0e8d9b44f92a688edcd6c3259216d1e8804ccfd91ef8b1021b52c56255f62b924e3e1f08b2bc1818e333e3de3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992160, "uuid": "4f7b1ac0-7306-4fa3-95f2-8fd585dcc75d", "value": "T1F0A63395B9D86487FD0DA871F27D02C2B360894E1C91A035CBDE976458BCBEBC232E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992160, "uuid": "9987ea17-d634-473c-8998-b989802c5f86", "value": "196608:t/bGUVk9puCWIBikxHng7SJjUNNj7prV9b9F3iE:ArBx9j+lrbeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774992160, "uuid": "48b0be87-c958-4cc6-a578-2d75bf5d672b", "value": 9613462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774992160, "uuid": "f3dfd726-e12d-4d63-858c-29b9d1d60ff0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992160, "uuid": "8a1dfa66-0b70-4559-859b-cf9f444e29d5", "value": "release-hotfix.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df79963-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958898, "uuid": "ad56b95d-1571-4a44-8426-b1da0965686d", "comment": "Malware payload (Mirai)", "value": "199aecfc6e8186f718d6a9362613667e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958898, "uuid": "955ec963-b0f2-4228-9e4c-97fe829640e3", "comment": "Malware payload (Mirai)", "value": "0b609ca8a0c5140953b8754b0840441817c49087886215321523e17fa98c5fd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958898, "uuid": "d327fa3c-c9d5-4b25-ab74-aac9c9065875", "comment": "Malware payload (Mirai)", "value": "c369833fb21955cd154021e481988b66a3d644d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958898, "uuid": "a929b566-4cc3-49f5-ac59-8ea8e18a7715", "comment": "Malware payload (Mirai)", "value": "98eb030163e9bb590c5783a10116a75c207a2e7462c21fbfcc48553c2c6a838b213a6f48a8843d663eaff3ee2bff19fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958898, "uuid": "1707c670-971a-4a3b-9e57-34014713bfc5", "value": "T1D3733A9DF8024E3CF94BE5B954560E09A92467C886C30F27B7ABFDE36DB30586D06D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958898, "uuid": "2175f67d-f69a-464b-80ae-d7af7813113a", "value": "1536:uWvGEjK4q1RuQJ2KBMUTIj8WhjAlqrqLCSadBZ1:uWOEG4SRuQ4KBMUEDFqLb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958898, "uuid": "a1158638-886d-44a1-922f-f55d1de557ab", "value": 76420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958898, "uuid": "89e8c2ac-dcd7-4c1e-be14-cab39909f21f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958898, "uuid": "505b3582-819c-4b67-9aa9-f3ec88dd542d", "value": "jade.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504426c3-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958902, "uuid": "3b7a89b8-f126-4f6d-92c6-7c1763af28b5", "comment": "Malware payload (Mirai)", "value": "b9736e10097474c0abba3755bc1ffea1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958902, "uuid": "03913b6f-d70a-4d52-9390-e5200b86a8a3", "comment": "Malware payload (Mirai)", "value": "0c8116208bdc6b2022e89a07eb513b29865e5174edf50a94d8e6f3fdb965924a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958902, "uuid": "367da997-a1a0-4261-b674-c083c54b25af", "comment": "Malware payload (Mirai)", "value": "8b4925938823715d01dd89989a335d74afbd4d9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958902, "uuid": "799e85c6-0b0c-4fef-b636-281ec322ad36", "comment": "Malware payload (Mirai)", "value": "1c9194a5d2c3ac18f435df65be14cd47950c83faf30e28d2e51ea22b78d8b8cd7bde540d726b1efc330852e0cf193d8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958902, "uuid": "899a467e-41ec-4002-a860-a8c9f0c72828", "value": "T1F2634BC0B583E9F1DC16067430A7FF339E36F0B6622EE98BD3E46963AC46641940799D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958902, "uuid": "d7fae05e-395d-4e95-9448-7767e7d003da", "value": "1536:HafAEdoRs3D25y5uScmhYr/pNeITYN7tNEWNc5SRCFIVX0ivR:HeWs3D25y5Tcmhq/p4ITYNbKJFE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958902, "uuid": "37cb08bb-3308-480a-aee8-65c8c3913a48", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958902, "uuid": "e23ddf4e-53ec-4c96-a1c9-06c08d3bad22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958902, "uuid": "2b7e1a8d-b8d6-4c04-b65e-8021754b2dc5", "value": "jade.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1327f352-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774989294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989294, "uuid": "3437bb7e-039e-4e98-9b35-8522ca50409a", "comment": "Malware payload (Mirai)", "value": "6a513d35bfd63b5082536cd0bc84657f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989294, "uuid": "d6e6a330-8e0d-4508-ab74-6aa7654f2530", "comment": "Malware payload (Mirai)", "value": "0cb1f23f92b965c4e56e5ff0daf6ecb504bf4492ee59265470715ad4a25a7516", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989294, "uuid": "af89c117-188f-4e60-b73d-d5f07e72fd13", "comment": "Malware payload (Mirai)", "value": "af7c8133bccf0eb800f4ea19555af730f5318b00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989294, "uuid": "d9456da4-8059-4f51-b49d-2fb2e8acc389", "comment": "Malware payload (Mirai)", "value": "9cc3fcd196e4efb37bc3f983dd3ba6617024fd3a4f246ccf39a9928a473455fd1a3c4b853f94cb9ad7db5a1205fa7e32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989294, "uuid": "bc773cb5-21a2-440e-b96f-83a6c3328a0c", "value": "T18E13F785BC918A2AC9E427BAFA6F418E3321B3D8D2DF3617DC111B147B8591F0D67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989294, "uuid": "6204f4a7-2b0e-49c1-a879-07d83251c9d5", "value": "768:rrPw5kZ//DAdGWc8RuP1suK9EDfkaI/TKlUqel4WvLMkvWHOEUNc:AaZMkERpuKKDfkaI2CkWLGHOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989294, "uuid": "49d9c687-40b3-4301-a413-546c94b236b4", "value": 43092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989294, "uuid": "5f4c04ed-35ab-4c3d-818f-d3896ae4808b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989294, "uuid": "1e94d73a-99af-4f01-990c-27e75352dc0e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a993620-2d0e-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774967429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967429, "uuid": "18d529cd-7501-4611-b420-0298bb52504f", "comment": "Malware payload (njrat)", "value": "754e5826ad8389170fe886a16d876244", "object_relation": "md5", "Tag": [ { "name": "bb-kgdhjc-com", "colour": "#092548", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967429, "uuid": "5b469190-d0ae-4375-963b-b05f1b1b3e6f", "comment": "Malware payload (njrat)", "value": "0cbfb6577e081e6c10a8da3b73df29b9ed2482ca7fb68993fa91b4a084ea9fea", "object_relation": "sha256", "Tag": [ { "name": "bb-kgdhjc-com", "colour": "#092548", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967429, "uuid": "d4ad6fda-ee55-4f54-9b91-4dd0c37c1fc7", "comment": "Malware payload (njrat)", "value": "c7afddd53c2b35eb905e8e197a9b6dcf3e4c43fc", "object_relation": "sha1", "Tag": [ { "name": "bb-kgdhjc-com", "colour": "#092548", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967429, "uuid": "066a3406-afff-4800-acf2-11375d856c1d", "comment": "Malware payload (njrat)", "value": "3106d4d9571c78b9ea8434509958c746cafa7e31bf46294e4ff5398b4b9685c4cfdf4f01ec4e1bfbbccdb948810169fd", "object_relation": "sha3-384", "Tag": [ { "name": "bb-kgdhjc-com", "colour": "#092548", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967429, "uuid": "46c68258-f432-4661-97ec-1004991af0f0", "value": "T17927331284DECF3AF307C9FF684227AE51D536325F29A2709262F68594CF62954E13CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967429, "uuid": "75c39acb-0c97-444d-9fd3-56fb1a58773d", "value": "393216:tEc1YrJGnkEqYcCEKr11VS+EekWbZPKR+0G0MHpdlkiIWRlY3gHHXIiTSiKjYs:tEW0JGkEqfCxhb1EVCR4I1Hp8infY0VW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967429, "uuid": "70aa41df-7cf0-4589-8be8-0424ecee426e", "value": 20445184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967429, "uuid": "deba3ea5-3f86-4c3d-b13c-95dc40094d69", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967429, "uuid": "7e1428e7-e705-4262-bfb2-be4107ebae27", "value": "MSTeams_370.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8dd682-2d12-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774969442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969442, "uuid": "d2e2a143-7060-460b-a199-88e2a04c1453", "comment": "Malware payload (QuasarRAT)", "value": "74c23b889093f42f463852f5776e2192", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969442, "uuid": "9019369e-7f7d-4d3e-8d69-c215fd192c35", "comment": "Malware payload (QuasarRAT)", "value": "0de8543897c9b92326c552911780ac07e2972f50fa452cbc348f7303aea5b09f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969442, "uuid": "c6ef4ab8-29cc-461a-849e-25c6892033f6", "comment": "Malware payload (QuasarRAT)", "value": "0e6876d7f79c687c5368fa28fce9ae4d4a387883", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969442, "uuid": "6cc4ecd9-1be5-4b23-8b25-0d8b6d213c27", "comment": "Malware payload (QuasarRAT)", "value": "2e61fa22be25b4d6fc2128871da81a3e439b8cfc42f677756353c9e116a796c1d05260afe1fbe9a5d3267bea112d6415", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969442, "uuid": "3e8331fc-861e-4154-b692-ce731673f144", "value": "T172450207BB3B15121123D47B30B1E8553E4CCE79C9B6E480B6E2131FE1ABC55A9DC6BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969442, "uuid": "fcbe2083-7e79-4c58-9d27-aad794184e65", "value": "24576:bhPVY3QHsSQfPIWYLjpK0a/eVd8OXprGRDDlkNVHplBkQBbXh32h:s3Mn0wWQ5aAHumb1XBp2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774969442, "uuid": "bc82ee36-8ee1-4f23-9595-84cf3fc13b6c", "value": 1223112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774969442, "uuid": "4241ed4f-19c6-4313-893a-4c171003e6de", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969442, "uuid": "1e806e25-ca06-4f04-8905-93b2f654c0b2", "value": "0de8543897c9b92326c552911780ac07e2972f50fa452cbc348f7303aea5b09f.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf9ae65-2cd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774942737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942737, "uuid": "722dbf1b-ef1a-4628-8949-eaf324403b42", "comment": "Malware payload", "value": "c306246fbb594ff3872c871149c232d8", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942737, "uuid": "9a87ae75-d88e-47b0-bc4b-7545d7dd13c9", "comment": "Malware payload", "value": "0ed6dba3092b7e546c0ee9c6fa7ed1cf9f4c20ef28e6d96f9c7e2a19c20b6a6d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942737, "uuid": "087b0e9a-136a-432f-9362-8a004406ea7f", "comment": "Malware payload", "value": "af652fb7fe766022ceb7afcf911d94567bbcde05", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942737, "uuid": "7f2bb785-9c3e-4efd-a640-d7032fab18d1", "comment": "Malware payload", "value": "3b2c87de3650898b7d4bf32ea655043e414d9402f72d1cd11e584b3222a6b3203aed827bba12d6afbe0559f28a6be489", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942737, "uuid": "00968978-b31b-422d-9bd7-6611475efc98", "value": "T1CBE2BF26E502B032C64353B497395BCFF33E7492B66B93973E5B6AD589430BC035AE08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942737, "uuid": "6a53aa97-ff91-4a75-bdd1-daf851c97a12", "value": "768:vBhVWqCuqNL6tFFZUHh0HXb84ui5gSZL9rtfhV4dM:vBnCLL6tbyHh03b84uQgSZprNhIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774942737, "uuid": "b2d9a8cd-fc6b-49bd-bbc9-5cdc90e50805", "value": 31502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774942737, "uuid": "a78ede29-4959-437b-b707-32364051dcfd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942737, "uuid": "f2d76f20-2f5f-40b3-a105-e70b83b69704", "value": "design.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bceac79c-2d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1774995592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774995592, "uuid": "8c49c23e-9b65-448b-85ae-446c836f71d5", "comment": "Malware payload (Smoke Loader)", "value": "73522e67154192641ca6db26f692b2d3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774995592, "uuid": "eb8f4022-dc29-4d12-9ee5-6ad8e48165f0", "comment": "Malware payload (Smoke Loader)", "value": "0f5e6d6347edaae85d0a523d7950ed4d669f1ba4394b68ddb205286ccfb7b08e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774995592, "uuid": "15782be3-e2d3-401d-a8b3-e99dd0a86dad", "comment": "Malware payload (Smoke Loader)", "value": "1e682a080f7f3aad944afd7d4db7036955790cd5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774995592, "uuid": "bc67be86-f0e6-4bcb-a721-466f1b0aaa9b", "comment": "Malware payload (Smoke Loader)", "value": "f4b3e82baa43aef635c1e4189df9741aefbb4e3475f1d4ac7300812a62736f4de53bb593eaa095ae372271319a697b35", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774995592, "uuid": "b99653cb-ad74-47b5-bb94-b01ce793c67d", "value": "T151851207ABF80A25D1357F78C8F28722273578A12FAA579BD64880705D135D83BB1BDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774995592, "uuid": "8fb789fa-8318-4b8c-b184-3047426493dc", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774995592, "uuid": "f860f64b-570a-406f-afbd-97143b6aafb2", "value": "49152:fydjpce0N79z/EX+VgrzYB6FKri2F6FnslD0d0pW:adtO9z/EKgrzYB6Arjci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774995592, "uuid": "3b00fead-baac-4637-915e-1566e99382f0", "value": 1804800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774995592, "uuid": "1bf320dd-5c67-4add-a0a5-39a657c09b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774995592, "uuid": "7798ead9-9f2c-49d9-8853-4ca7bebeebd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e405ae4b-2d28-11f1-a769-42010a9c0008", "comment": "Malware payload (UmbralStealer)", "timestamp": 1774978907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978907, "uuid": "a5bdc48b-a30a-410d-9484-524fe1c23995", "comment": "Malware payload (UmbralStealer)", "value": "dc866d0b5822a2fc6750182ae9c5242e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978907, "uuid": "7fdb44f0-b38a-4adb-9aa7-615832c4a11b", "comment": "Malware payload (UmbralStealer)", "value": "0f608e6d16bfaecb7bf11cde5badf364ad8cc4d3f857c2754bcbf47a1a159b3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978907, "uuid": "1fcbe9b3-3ada-4512-a401-daf59324b1a9", "comment": "Malware payload (UmbralStealer)", "value": "27d69f11af6a9f6c4f70179c2c92b9a8e7034695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978907, "uuid": "8feb0599-ffca-4954-98ed-545b9bda8b94", "comment": "Malware payload (UmbralStealer)", "value": "4798da2c4935c644e3f06a91c1234880d874ea215e545aae0fd5b8fb683b9344ee50646729d342d5a51b56db69a93a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978907, "uuid": "36e42cbe-3d3c-4f51-9cb9-d09d3a992e78", "value": "T1ADB4AE453BA8CA02D25F4F7895B186AA8771F903ED07F34F2D44B5E86C727C1AC09A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978907, "uuid": "c02bc70d-346d-45a0-b044-7fa0aea82aa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978907, "uuid": "f47a9bcf-5e0b-4413-a91d-ba364463cb97", "value": "12288:5oZyHPvWCwjXCsIJK6gMNRx+jX8HjOyULOnYy6:3npwzfO7gK+LwOyU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774978907, "uuid": "52a405bc-5c13-4556-874f-c20af200514c", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774978907, "uuid": "800558dd-8df0-430d-9b2c-697cba4a4f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978907, "uuid": "28571c4e-ece6-4988-a53f-657bddfd43a6", "value": "VALUE LAG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46465772-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774958885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958885, "uuid": "14fafd29-c39a-4e4b-ba34-b8ee00212469", "comment": "Malware payload", "value": "bce8a96587f7485a16b22e1bbd07583a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958885, "uuid": "083b7fb1-f5f6-4fc9-a03f-7abbfcdc4784", "comment": "Malware payload", "value": "0f7283534e998f7dd95dd600cea42ff4dd093d3f2641254e6183736da20ea20e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958885, "uuid": "f89dc41b-330f-40e4-b7da-ed0cd8beba8e", "comment": "Malware payload", "value": "3de1738268aa233e0df203f630122a168567a6d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958885, "uuid": "97672e60-b4ab-4471-8f6d-85c6a50665cc", "comment": "Malware payload", "value": "5d58dbd4f64162c38c6ff4e21569b98d57db2aac2c3a7044f49bd12a415fae0c425fe3f5c6965a198e01e5b93c92e86d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958885, "uuid": "dd51d5dd-57e4-4638-8d34-1669bd02e4f9", "value": "T1E2D45D02BF955FEBC0AECE30496EC217009DE58245C6522A73FCC78C7B6DA5D0AD7998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958885, "uuid": "6d8b9854-ee24-47f9-ba3d-342e2d615e05", "value": "12288:TKdrSZz7YRlsjJ8tyn3x28cCfP7dCzghgri1hxZrpry9b0C31s32Cg2TrCQFB6ey:bZz00diyY3bIY34JBU9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958885, "uuid": "c1f93826-17f0-4ca2-82ad-8e3bffb86532", "value": 622164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958885, "uuid": "f46e0b4a-2fb4-4235-8110-88ee2cc932c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958885, "uuid": "1d178451-4892-410c-89a0-4e5ceec152d5", "value": "jade.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c60f61-2d1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774974885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774974885, "uuid": "4f860704-c43a-4e40-abfa-33723d118f72", "comment": "Malware payload", "value": "f1403192ad7a762c235d670e13b703c3", "object_relation": "md5", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774974885, "uuid": "9a5e9736-5664-422e-a1a8-cc2394c2f8a8", "comment": "Malware payload", "value": "0fca9dae54a7a55f0805a864e9d2911d727a6e274f4ddc9b5673078130e0f9e1", "object_relation": "sha256", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774974885, "uuid": "8f302c87-3f56-4bfa-bc51-122ea2ed334f", "comment": "Malware payload", "value": "f4d2c26f24eec22e439507103cb019dc6c7d6b15", "object_relation": "sha1", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774974885, "uuid": "c9d96558-f571-455b-896b-294e0ce1edc9", "comment": "Malware payload", "value": "d54c4ff421f06dd95e65bb9921e14e956d9e093ce892d8e3551004c8833cf802aabaa933dc592ddb93361a33476aefc8", "object_relation": "sha3-384", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774974885, "uuid": "3af8b862-49b4-435e-9ded-ddd88f66e21c", "value": "T113C5F1FD225C375CC01E88788033ED49F1B6522F5EF589BA76CB7690A7AF510D682B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774974885, "uuid": "bc672dae-17e0-47f9-b3f4-ad594fe0f1c8", "value": "49152:2htH6EPThC9uBvnjWJO3T9PYeyx4EQ2QRk6OgWsgwsm5dd9EpojgowzAawggNojd:WtH6EPTh+uBvjH3ZPY7VdQRvOgmw5n9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774974885, "uuid": "c894a522-85db-4a06-8c57-aea78aa9fd3e", "value": 2744573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774974885, "uuid": "03c1c9fd-fa44-4315-8eee-057e4bfb1852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774974885, "uuid": "8397ed03-6ff5-4782-81b3-928bd0d262b8", "value": "exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad13049d-2d45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774991270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774991270, "uuid": "9580cb56-fcc3-49c9-9e53-94069672daa2", "comment": "Malware payload", "value": "7aa01525f4fa37bd64e1c74195e02e23", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774991270, "uuid": "d940f6c3-25ea-4af7-a5b6-4092eae60865", "comment": "Malware payload", "value": "0fcbbe1cd6339c8d4ceb07fbbd614898a65dc1cc4222bd1290f1166710027ac6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774991270, "uuid": "822c2ad3-74ad-4e70-8759-8bb361928b75", "comment": "Malware payload", "value": "29c12077264792b7f91f3c21203b8e2ff68f96a5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774991270, "uuid": "b65cdc1d-08dd-4873-a83f-407456706558", "comment": "Malware payload", "value": "c0bc692b3c2802523b340760b24a1ae60ee43a5b0b8a7cced91b2c16eabd346740196f4a3c5f70247d438a7f316d8598", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774991270, "uuid": "7f9d7943-ebfa-44ee-bb27-5137cd5d3d91", "value": "T104D3D49433FC6B05F7BF6BB5AAB011508B36FD729E11C64D0C8961CC2A32B959A15B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774991270, "uuid": "0b2e866d-b68b-4c4c-8b91-3ffff29d421a", "value": "3072:kjMj9v4UpqVr1Jwwl+6Jy9bVeslDYHfZ:kQiJXlG9bA7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774991270, "uuid": "b6070966-b0fc-45f8-b4c1-53e70e5005a7", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774991270, "uuid": "899f12aa-eb79-4201-a12d-e5ab848585e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774991270, "uuid": "b72d4325-439a-4b3e-8cbd-0c32d31f6b38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a8df50-2cff-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774961238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961238, "uuid": "c09d618c-1668-4b5d-a299-cf1dedb138ff", "comment": "Malware payload (AsyncRAT)", "value": "f7bbe1b7992c8cd5ec54c6057de68bda", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961238, "uuid": "f7e1651f-c2e8-423f-be39-20b268234f7e", "comment": "Malware payload (AsyncRAT)", "value": "10043a81860273c5903891860bd93cdc06ae5139c19033a4c2fb339e1f903ac0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961238, "uuid": "9fbefe34-93ad-47c5-b7d8-f4c98fa8ecf5", "comment": "Malware payload (AsyncRAT)", "value": "a028d287e9e6cf5d351b98de9b32e72269fe3564", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961238, "uuid": "ab284428-0c05-476c-8d1c-2465bf7a7fb4", "comment": "Malware payload (AsyncRAT)", "value": "5bd2df555739c9d961d32d048507041dc881f1da57c16ffe5895cfcd97f12cdb6ac7dc3de7d6c9834e456ddd46613892", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961238, "uuid": "758c9561-1433-4fdb-9e87-79698ace9337", "value": "T13A231C003BE88227F2BE4F78ACF26145467AF2636603D6491CC452DB5B13FC69A526FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961238, "uuid": "ef55958b-f7b8-4300-83dd-762212d35df3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961238, "uuid": "09b274be-eeba-4044-affc-a8c1c03551bc", "value": "768:mu/dRTUo0HQbWUnmjSmo2qMwKjPGaG6PIyzjbFgX3i21zhZt/cFV5HjnBDZyx:mu/dRTUPE2kKTkDy3bCXS2158DBdyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774961238, "uuid": "6b809e81-39a9-480e-a0ed-54aa64417971", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774961238, "uuid": "7d9ac07c-94c6-4c60-bee7-524d8ad540dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961238, "uuid": "300af15c-a73e-408c-aa56-e5453d7f99e5", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb409a59-2d3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774988314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988314, "uuid": "5e28c48a-0942-478f-9af1-46524b9ab88e", "comment": "Malware payload", "value": "453297f281373f8786b520bdbd8986ea", "object_relation": "md5", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988314, "uuid": "ae88ea0e-d06f-437c-a61d-f6090f525bfc", "comment": "Malware payload", "value": "10685e552cc2462f78f8ec31926c3f654677352fd08adb5784c937f40d47c4d6", "object_relation": "sha256", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988314, "uuid": "5d1156dc-5f12-4ad6-89d5-e03d2bb92aa0", "comment": "Malware payload", "value": "a1b37af4d450fd18f7ab94f09fb936c5ba16f260", "object_relation": "sha1", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988314, "uuid": "a411f80b-e096-4246-aaa8-639720fe3b35", "comment": "Malware payload", "value": "398af40834e1d8df12b2ad4446372998a6afbcfaf5842433c6d2e6e82aba5c99607ddaf002acc77a1db61cabba1a42ff", "object_relation": "sha3-384", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774988314, "uuid": "671b9746-f0c0-41d9-88a1-fc262634ea9a", "value": "T10A12901ED7CC5CC2D0DFF1B55AA08155CE2AABC447E604091BF852D56BC2EB7A131375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774988314, "uuid": "b3b5366d-c871-4403-a750-5a294b947cda", "value": "192:RfwPqeRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+cfO:RfkqeRm/wksuQJ/g6dI+cfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774988314, "uuid": "0e5ad4af-5af0-4340-a51a-d2a4d1b10d90", "value": 9030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774988314, "uuid": "f9b59a9a-0ae1-4c0f-bf48-dca85e28ef8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774988314, "uuid": "b919a704-4909-480c-9d62-82f28ba5b978", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae7fb09-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959188, "uuid": "854dca9e-974d-42db-bb72-4e7a9e8b6e2e", "comment": "Malware payload (Mirai)", "value": "a4ef841063e97d9e55f3b6a47a77bbb5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959188, "uuid": "699d67c7-95ce-4f20-8d7d-55c1e84eaf55", "comment": "Malware payload (Mirai)", "value": "114e5ec5f210360cc42fcad1595665a43a3af92e537d47ef902ade871b8ac200", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959188, "uuid": "c5057071-2ad3-40a7-8b5f-0ef255aa14a8", "comment": "Malware payload (Mirai)", "value": "02d4c60f57ce7664c339f0ad0d7a31a2671f2149", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959188, "uuid": "c40c9f1f-d2f1-46fc-8d96-43e63eb2c6dd", "comment": "Malware payload (Mirai)", "value": "41e2024bbd7b6696659f0777411a90bb7e81458204e0722420b8db468d8e00948a203eaa98ffc28ad5a1ee776ac5527e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959188, "uuid": "db539c00-3697-4bd5-8e84-6331c43e2d70", "value": "T1C1A2D030A3460D71CA310E75BA6ACAC1F3F34A78C17A32A1235172DC667159B5B7D18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959188, "uuid": "d33a1a21-c190-4fb4-a7c6-a19f22e25fb2", "value": "384:Yp52IVSFSqEq5uxPrgJwa2xKQuDI+ofOPwwUahymdGUop5hFC:+2IVz5CAEJwa0eDLoUVs3UozrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959188, "uuid": "1e8eb949-4a1e-4b19-aefe-a49f1443db5d", "value": 21976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959188, "uuid": "7c1e051b-b976-4985-9bf0-e3bcd7fc3c50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959188, "uuid": "333ac9a3-a4f2-4d93-b917-d18991c59893", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b376d2-2cf5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774957035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957035, "uuid": "e19c7353-29f6-42db-9d3c-7c99e80c3b16", "comment": "Malware payload", "value": "3af743fcc063a92c1e74c06f2092f01a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957035, "uuid": "98cec524-f40d-4b02-b675-77a3008fba59", "comment": "Malware payload", "value": "11570b840633975939084c1ac5cf7a49e5ec52c80d91344c05cab10316a44d3a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957035, "uuid": "cb731b6a-809c-404e-929a-67d543e38243", "comment": "Malware payload", "value": "5b89c85dd16fc0172661ca83bf8a95858c38f055", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957035, "uuid": "b3d2e599-be7b-4a6a-87ee-ab97c26ede8a", "comment": "Malware payload", "value": "2fe9b13e9e1c5d35eba2a8e51436baa2296b6c7a6c6fd0c373bbfcf0987285de297de7e954ec0e1ff23449e2f1484f62", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957035, "uuid": "7b63a3e8-f2a5-4f39-8d00-247525fe3677", "value": "T187E5332916036FA752A0AAA71BF909C8DC15D3CDB439D984333C2AC5C05F7A25F997F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957035, "uuid": "2441cd87-d37b-46e1-9d9f-a96b96961581", "value": "49152:V66u4Sr3c9lrmlm89pIMrjVSGxB9kR3MgwYaFg53sUo55qiRckJ+gBPH:yVr0mhgWSGt83CDFwiIiRcs+SPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774957035, "uuid": "561784f2-5ec5-4401-a187-0ce4497fe47f", "value": 3037392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774957035, "uuid": "ba421c5e-b23f-4f8f-896e-9c22af5ce96c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957035, "uuid": "14545f56-7408-490b-90ab-13562b82f22c", "value": "cdk-iam-policy-builder-helper@0.0.194.jsii.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e849f0a3-2d28-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774978914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978914, "uuid": "55ca38b8-c85a-4b08-91aa-d41c1c064f4f", "comment": "Malware payload (AsyncRAT)", "value": "03bb9f2d582790ce584c3f85800a5af0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978914, "uuid": "5a40463c-46f0-46a1-a1da-ed58b0729a97", "comment": "Malware payload (AsyncRAT)", "value": "1159467031d7e6422cc1dbb955b2bdd50a0552dc433364caeffb5e2204f042aa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978914, "uuid": "261a6554-5c07-49df-8416-44ebc297e42a", "comment": "Malware payload (AsyncRAT)", "value": "5a83ed4ed8a35651a8a2b01ce1c540381dbd160d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978914, "uuid": "ccae1535-3fa4-4af0-83ef-0410a9d85ffa", "comment": "Malware payload (AsyncRAT)", "value": "4457ae91acb151ea1bcde4cb1470635986ae7b477037c54ace61d291feebd54259301be252d03289aa24b5f7ae92ee0a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978914, "uuid": "e3331507-42ab-4302-ab10-4ebe76a3eb7d", "value": "T1DC034B04B7910625E9FDAFB05973650A0670E707D917EB9E0CE885CF6B27BC0CE507A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978914, "uuid": "d94fca67-4139-4553-b878-7b674860a025", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978914, "uuid": "ddc79a9e-e8ba-4a6e-9b7f-614e4e57665c", "value": "768:TiLgJ2EY1bBod99PLZXFyQ9O6q6YOjhWPyz2d:TiLlVV8z1Fh9rq6YOjIjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774978914, "uuid": "5813d9ef-c206-4e65-97f5-e480ec7d1ab5", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774978914, "uuid": "263b77b8-9c87-460f-b80e-713067e4bdeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978914, "uuid": "33757b11-235d-41fc-a0c6-a0fc8d3c9e0d", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9542480b-2d14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774970185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774970185, "uuid": "7482e087-5e8a-4a37-bddd-5dbc9020e3fb", "comment": "Malware payload (Mirai)", "value": "2a5014f70292d8abf63dd78000fc46cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774970185, "uuid": "59a23448-45ac-4605-9249-54212ec61813", "comment": "Malware payload (Mirai)", "value": "1164be3850808e9b4a26dca24da350dc0d91dc3d8526414fbaba38ca1b914c89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774970185, "uuid": "86e14685-61cb-4480-bcbe-1092fa699eac", "comment": "Malware payload (Mirai)", "value": "a42648b7f56a57b39acad37708bdb9b0d3c684f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774970185, "uuid": "e3c39517-dda9-4847-b171-fab0d370cec6", "comment": "Malware payload (Mirai)", "value": "8a5793328f32834af4de598a1b53ded803e20565a07c1b87321f8f6fc48f40cd053bf914758a519cb45cf374ce067861", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774970185, "uuid": "a55815e6-90b7-4883-9652-934404f1f9a3", "value": "T13EC45B59A8419791D1D02BBBFF1E934873131B38E3EFB0069D196B646BABC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774970185, "uuid": "1dc0c9ed-7deb-46d8-921f-d1aa17a1068d", "value": "12288:duZHpYX+7X2HCMFzp+EKK5R/OExZ8tM9+uxbIHQaJtV5Kh2mdtu0zFhW:yHpYXI2HCmn3OExMupAtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774970185, "uuid": "de230661-ee05-4de6-ab8a-3ea372fcb096", "value": 561812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774970185, "uuid": "6eb77232-af32-428f-a1e5-62c867832baa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774970185, "uuid": "5557f374-d742-4e06-8fd1-bf5033937971", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed3e211-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954578, "uuid": "55d64bbf-67fa-4aad-a8db-7bf514fa61d8", "comment": "Malware payload", "value": "cca024a040cce384ed40d54829790847", "object_relation": "md5", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "nol-zip", "colour": "#2BFD27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954578, "uuid": "91d43591-c49d-4cef-a1c5-078a9a4d94d2", "comment": "Malware payload", "value": "11b92aefea710bef8e36e2ce24aca1ab8ad22256aad6dea18131d594f6cf93db", "object_relation": "sha256", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "nol-zip", "colour": "#2BFD27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954578, "uuid": "46162841-014c-4091-8e14-6b74f4404d9f", "comment": "Malware payload", "value": "c6f99ab5a41c52edf1404833805405571b8cd7ff", "object_relation": "sha1", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "nol-zip", "colour": "#2BFD27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954578, "uuid": "e25a2dfc-ac22-4023-9657-54f20a7043a9", "comment": "Malware payload", "value": "d70147055534d23e69680f9e7957370c2582b812c35c21b8a5591cac299864712ef311988fbaaab970f1212d4dad5a9e", "object_relation": "sha3-384", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "nol-zip", "colour": "#2BFD27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954578, "uuid": "dc73e5fb-3fd9-453f-8739-fd1469f20df1", "value": "T138442343D546C5DBD0D1B9AC0DF36E85961CA3BB2ED63AD5484CE3061C6132CBC4AABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954578, "uuid": "2694621f-0080-40b5-9f05-1819d00f4a02", "value": "6144:L4fROtc1uwNOJ9Yo+7gp4dbSFaXY2qYKCrX7uvQvxNFUZ7g4:LqRYbMqYo+7k4oFaXY2xNFUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954578, "uuid": "ccbcaafd-0c8f-4fd9-821a-eb26ba73d995", "value": 274547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954578, "uuid": "e948d781-9ce0-48e2-9363-a02b79df0274", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954578, "uuid": "523c9b8a-6ea2-417f-bd43-acf4a409418f", "value": "11b92aefea710bef8e36e2ce24aca1ab8ad22256aad6dea18131d594f6cf93db.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739ea218-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979577, "uuid": "e54986a4-568a-446e-9dcc-fe098c38b973", "comment": "Malware payload", "value": "f43f34866f58685cab07804daca07aa0", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979577, "uuid": "5ab29e77-bd98-4680-8e72-ab025254538a", "comment": "Malware payload", "value": "11c884789a2744ac5b0cdd1a35e5af6002f260ac1c122302c131a1107e2c16d8", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979577, "uuid": "77e46f53-82ac-4a9d-843c-5cbc3b0bae3c", "comment": "Malware payload", "value": "39cd1c5604f5c332643a641ad9e5b94124772e0a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979577, "uuid": "fe033bb3-5266-4391-b30b-e90ae2602443", "comment": "Malware payload", "value": "4999855a757b67acd11cad157f3429da2b586ee04813ae86416c908d60cc7f8f1f26ccc6c8bd16af94e876c441980234", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979577, "uuid": "d807572e-eaba-4694-a2b7-56434b9e094f", "value": "T1408643122BE65658F3774F318BF7B2620B32F8218C07455D9084E28818F1944E9AAF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979577, "uuid": "6ee0021a-0c3f-457b-84c9-39ca4da836fb", "value": "48:XE91o52zLnfUlvswm0dAKR9fU/KRJBblcmU:XE91vf0vs3Qf5Z3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979577, "uuid": "fe456aa8-fe48-487f-9ff0-904d4d8fa296", "value": 8388784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979577, "uuid": "a6abc139-ae5f-4894-8ae1-0fba1f9bad54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979577, "uuid": "dc0142d6-0cb6-4e46-8daf-92a9bbcd89d3", "value": "Foriegn Relations.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73085087-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774959390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959390, "uuid": "90c93f8b-7cc0-456b-9bc9-5deb707dae09", "comment": "Malware payload (Gafgyt)", "value": "f3c30733a9e69cbe50fea6e9690a4002", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959390, "uuid": "c544a51b-6340-4bcb-8e15-fc54e51b0770", "comment": "Malware payload (Gafgyt)", "value": "1236442b01aca5da8c0f3c32606a88d5d44c305e9b7792792f67ca98db202c7e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959390, "uuid": "68c951ea-d132-4c15-86db-90d59447e08e", "comment": "Malware payload (Gafgyt)", "value": "b2c976836d8f4a7730e22905aee8a91dc4b0135f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959390, "uuid": "726990fd-c264-49a2-a5de-bba5d364dc26", "comment": "Malware payload (Gafgyt)", "value": "c6a70c03810d521782f432f5ad4329fd96e3732afd98c1ec7812dd49049f510a403eecbbda0c39ac8f3f583420f11b25", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959390, "uuid": "4e7bbc0b-1509-4761-aac6-31e3856d04b2", "value": "T1C5C3B91E6E21CFBEF65A827407F78E31965877D62AF1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959390, "uuid": "58c480d4-2645-4149-a989-e4d52d1ca950", "value": "1536:tw4lPfv7d7Y/YL1dUo1DNNKHvntki8hPDoM1ISWlKnKevNeThZF:7lPfDdMWdUoXEHvntOhPDoMCsnShZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959390, "uuid": "47da15ba-bd9b-48cf-8e9e-9b033d3f9048", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959390, "uuid": "5f27bd0e-64dd-406e-b5d1-fe7af009fcc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959390, "uuid": "5df46a92-edd7-44b7-9f89-8d7ee24779c1", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c78383-2d06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774964199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964199, "uuid": "e1985664-1f4f-4641-83a0-c33b770adc8a", "comment": "Malware payload (Mirai)", "value": "11b5bca019537cf6486ee5827d383935", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964199, "uuid": "5d8f6961-c3ed-4c66-aef4-b98086ffcc06", "comment": "Malware payload (Mirai)", "value": "128396e00e8d7f3b3ae0ea8764c8d05448861a825e872d729013768537c0fdde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964199, "uuid": "9e952326-c986-4fc8-bf3f-3aba53b5b611", "comment": "Malware payload (Mirai)", "value": "3cea9e6d7678c666c8bb842ef2e7b6c91026317b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964199, "uuid": "9975d5d0-904a-4590-9c07-f6ea8433f6dc", "comment": "Malware payload (Mirai)", "value": "fc89fbc00336af30ce00d940a5dd2276acbb9e86f0e0d3114d3e5691a5fae53b1c5fa712a23d40bfa73754db0007c3a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964199, "uuid": "b32516cd-cecf-4715-81fd-fc9802118620", "value": "T1BAB30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964199, "uuid": "5499b366-28b6-46bd-a4d4-055b69f9967d", "value": "1536:TUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45ZvI:AixnUHz4Z+5ypkn3E8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774964199, "uuid": "8507ca08-064f-404d-813f-05fb1c499c89", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774964199, "uuid": "aaeaf855-d3da-4fcb-99ce-3711062a320d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964199, "uuid": "0e9f18d8-bae1-4915-89e6-7fe72c1e4a8d", "value": "boatnet.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbea03c5-2cc3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774935568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935568, "uuid": "a1cd47cb-2008-4ab5-b75d-e69d84827234", "comment": "Malware payload", "value": "7e2eb98757430ce004efe6ffd856e030", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935568, "uuid": "a9357160-81dd-47e6-8c2c-6e5701432c8f", "comment": "Malware payload", "value": "12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935568, "uuid": "8523c93d-039d-4214-bc53-c490e89a048e", "comment": "Malware payload", "value": "e06729d861044574cfd60640258821162fc193bb", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935568, "uuid": "9351ae9d-ae2d-4948-8eb4-847167f82276", "comment": "Malware payload", "value": "0eb851ee4f15b3db0013e6901e608ed14128c887652bd601397ed81a3916949b43690d9eac672a0c79a4914bfd7cc71f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935568, "uuid": "ae787a8e-dc2a-4280-857b-a090df064bdf", "value": "T173C358E713980AAE6B9089D7C149760758EBC17B2C5E1389F9E25607F13F920B726F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935568, "uuid": "69b04b93-5466-4fc5-9ded-a46cde5c65c9", "value": "1536:upAZ1OUf7wZkL976N8odeOMATYJMkBFHntcZNE84rvRtI3yJ0zLv8dEgSMXHyVLw:rGRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774935568, "uuid": "84424311-674a-41e1-aa9a-08820c8c91d3", "value": 126620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774935568, "uuid": "f43da02c-8b5a-4368-92c9-480da7fd34c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935568, "uuid": "2e8a901f-b282-4cb8-b14e-b666e3c0bf94", "value": "index.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435d63ed-2cd7-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774943848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943848, "uuid": "17731cc2-1613-46f4-8db5-fef60776d80d", "comment": "Malware payload (AdaptixC2)", "value": "0991e3647f40583a93e4b9be276b2fc6", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943848, "uuid": "10e9f811-cfce-4c4b-b745-3387593d00a5", "comment": "Malware payload (AdaptixC2)", "value": "12a8b0903c176cb6478b4f0bfcf8a621025c37faf83941125c803ccc3e0913e6", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943848, "uuid": "60af3bea-23e3-44ae-b12a-dae298910efa", "comment": "Malware payload (AdaptixC2)", "value": "817127e086af505b077cfeb772ab781b7840912f", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943848, "uuid": "0ed20186-f520-4283-bc6f-eff8374dc616", "comment": "Malware payload (AdaptixC2)", "value": "827f6ec62f0739714e6961540c3d72e5c7cf86681bd7e4aae17a25f5748e5a3c9bfb2ffaebafd69bdb55b914fec5bce6", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943848, "uuid": "151e7ee7-a85d-4d88-8b4e-a9142b2223b6", "value": "T188664957EC9414E9C1AEE23589A29553BF717C891B31A3C32F50B6293F73BD0AA79340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943848, "uuid": "f92d618c-2b16-49a0-b7bd-2e2f5e2b18ac", "value": "49152:m6AlnbrKe4mUEt6GHVwXot4Vi2rYX6hMjMBiqnBEsQqKC/Mm9BjD1sDKlK1KyqpG:m6AprdA6FqICXjDayDIEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774943848, "uuid": "5a2d1ccb-ef9b-4a4e-9ece-8df96deb653e", "value": 6709410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774943848, "uuid": "bf6d5503-4735-4da6-8666-107745565f04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943848, "uuid": "63b146cc-15dc-4c9f-839a-89d8d69c83f6", "value": "agent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34e3d0e-2d5b-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775000756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775000756, "uuid": "e4558585-a232-46bf-a9c8-e6f511e4dcdf", "comment": "Malware payload (ACRStealer)", "value": "091048e5a87ba7cc427f8fffdd2b5a40", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775000756, "uuid": "571ec9b3-51e7-45ff-9d51-207714f5232a", "comment": "Malware payload (ACRStealer)", "value": "147b20174a0c78fc72b79ca1f78130f601097771d75ae8bf8b173db47d7da199", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775000756, "uuid": "f35ae70c-5c48-469b-8ccf-9d8d92b5378a", "comment": "Malware payload (ACRStealer)", "value": "0eb3c37be5a45400750dce22a67abf2158f42f9a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775000756, "uuid": "dd8c1363-6562-49a9-b324-d482280376f3", "comment": "Malware payload (ACRStealer)", "value": "62ba454363739524883cb57d063825a911f3dcadf04eff13a11589c4d6c0861868a459cf3db8c241cc1e37502f780217", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775000756, "uuid": "b491b852-32d2-47f2-952e-383b6615f36c", "value": "T1EF364B0BFCA158E5C4A982348967871ABA717C851F3163DB2EB0B7782F327D019F5B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775000756, "uuid": "0b443541-3b86-4176-8a00-3dd8571d36ae", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775000756, "uuid": "d342c180-39f8-4b5e-aa94-c048778ca957", "value": "49152:/lYNMTWAqOTGSIDk1OVGre+8Dgdv2cKE6Emp4sajYMtsQQclnYWoyhnpc:/lJqUMcK/NAamYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775000756, "uuid": "30419eb8-7156-47a8-a84d-9951d8a7a8fe", "value": 4919808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775000756, "uuid": "e3df0c5c-c709-4950-8a3e-fd26432d1a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775000756, "uuid": "68c1678b-6938-4549-a02a-8793ddf38d43", "value": "SecuriteInfo.com.Win64.MalwareX-gen.71475913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2950f3-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1774960645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960645, "uuid": "c0e44cdd-b77d-4ba4-ae4d-e3ac2102b3ee", "comment": "Malware payload (DattoRMM)", "value": "c94f7c833d4a4ccce15c2b4f8edbe0eb", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960645, "uuid": "49bae067-dce6-486c-a0a2-98d42252f8b3", "comment": "Malware payload (DattoRMM)", "value": "14ddbbe0ce2f67d3be5cb3f9f29933ab8ca64cfa0dd841f75e8a2b5b170232a9", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960645, "uuid": "e3294aa4-c17a-449e-98a9-d93bc8d8bdbb", "comment": "Malware payload (DattoRMM)", "value": "74d5f40fe1f1dd1b2e792688b7a256648a6dedee", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960645, "uuid": "1d39de36-9860-4364-b7c0-41d3bee85e46", "comment": "Malware payload (DattoRMM)", "value": "f541d1f67c0004ca165bbc4b68fb1332d4cc327b2b832db898f3c793469d8afea1e7336ed7afabfcaf8bac9d618f7902", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960645, "uuid": "cdc17edf-0b93-40f5-95e4-974b7ca5176d", "value": "T15AB63347D9778DF0CA330A3890D2196B3305980E485BF4C9E609277ADEF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960645, "uuid": "43595b0a-42b9-4bf2-9d3d-1c47fea829bb", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960645, "uuid": "55d7be8a-731f-4d74-95a9-8cacaf3ecfaf", "value": "196608:TaZk+wnP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s23:zn2mzZFw5S9pE7Asjp29qIT0jarlZr8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960645, "uuid": "3dbdf0d9-4dfd-49ca-8c13-24f0b7e2c405", "value": 11056048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960645, "uuid": "8540a381-d970-4490-b076-b24147c906c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960645, "uuid": "34c26a9d-feec-4d47-98c0-6c78caff4e85", "value": "Leonardsace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef94dac-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774960537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960537, "uuid": "c04155a1-6d88-4c85-9079-509b3685c77f", "comment": "Malware payload (ACRStealer)", "value": "9d9f0ddd86d5eab3652a7e9f895e210c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960537, "uuid": "164ab98e-1d62-4f8b-a417-50cecceed5fb", "comment": "Malware payload (ACRStealer)", "value": "16a812166f66489602dbda752ab8cc1853c5eb254d43979c358535cbf9432aca", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960537, "uuid": "cf602e2b-725a-4eca-8a5d-1ee737aed74f", "comment": "Malware payload (ACRStealer)", "value": "98a118841163879d0f76ab0975c3169eb44b9322", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960537, "uuid": "d5ca3409-b972-444f-a66a-49a149b3a6dc", "comment": "Malware payload (ACRStealer)", "value": "f7d5742d002bbf0a9198e767beaedf5d071e4e4df735ecee928f2022da384f31d78db0c7b0afc349fdd6f683f6a565f7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960537, "uuid": "1faf457a-dcd4-4c75-b9aa-41bf05f0543b", "value": "T16347339E183D21F0C5D5AA7DCD1A19F5C6A24B37EF58072B5E38820714B391E2A7723E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960537, "uuid": "f7dd82e0-2b61-4d8c-ae91-9936758314e2", "value": "393216:xqxBLGYtDkp+iOx3tDXRYPK7E5aMdPdg/b2t7zWxl1mcgl99gmRxlicqqdTZEwiR:oLGYt6MRs2qByCt7KrcNlJR6wi2TWCnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960537, "uuid": "549004ca-f04d-40c9-92a4-b4ec5180e86b", "value": 25792669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960537, "uuid": "04ff0095-b361-4c91-9263-c5f6e88cf83c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960537, "uuid": "17d76b99-0e2d-4b3b-b14f-30c3859b8d60", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e38892-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774989290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989290, "uuid": "02feb589-cbd5-4538-aecb-b73126860741", "comment": "Malware payload (Mirai)", "value": "b9c785d1b0213609a30a749326ca8423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989290, "uuid": "408ca992-3743-4774-8c6e-0ba770b6a219", "comment": "Malware payload (Mirai)", "value": "18dbd099e3e1eeb4148b757e06a2d8c34b2e8cb866364006c1719353df8a6c70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989290, "uuid": "84cceef6-d708-479d-9b49-731bb8666028", "comment": "Malware payload (Mirai)", "value": "df143cbd24a6f31366fa6ccce9ca47e38a2430a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989290, "uuid": "3a613c84-e82f-4300-a191-83d24bf4efb9", "comment": "Malware payload (Mirai)", "value": "e267c7f4857aa341d6e84b7bc2c7bd95269d3d26f3646a9e60291ee9f42a5518a3c7a3aa02a80db247f5811a7ac94fb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989290, "uuid": "99992fe5-6613-4135-b238-129d6dbea1d7", "value": "T12E231781B8D19A12C9D453B7FA5E418E33256398E2DF33079D222F547BD682F0D7B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989290, "uuid": "78e0dee5-889a-4cee-80bd-8a1ca96f5baa", "value": "768:Pu5lt0vq1lCCZdnLTaW7nDfaZNtPmGehIWvLci4fyQpn83ZNOPcusLS:qlivUY8LTN7nLaZ/jWLGaQpn8H+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989290, "uuid": "1cf9f2b6-16c6-44d5-ac42-66c0bf517656", "value": 46968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989290, "uuid": "c76b3fb5-2c45-48c0-a44e-0e6270fb47a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989290, "uuid": "008e4fe7-8c3b-4756-ac53-4cd1ef4bb032", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f29b6f2-2ccc-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774939224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939224, "uuid": "f8ba96fc-e911-42bb-a566-f2c433f63333", "comment": "Malware payload (PhantomStealer)", "value": "63d17273c810a85d78a70e2641fc23eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939224, "uuid": "3194d09a-b986-4c56-8864-3f5da6de44a2", "comment": "Malware payload (PhantomStealer)", "value": "196581d3642185c47a7c31ccd801c6cd67534e4119bdfcbed7b73a72c93776a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939224, "uuid": "1a189ce0-dac8-4b7e-855b-43f33bd6371c", "comment": "Malware payload (PhantomStealer)", "value": "b7a327d8712d7192dabd33c379164272ba0aab6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939224, "uuid": "7221dd0d-31d1-4f88-86c7-57b1cb41cd7e", "comment": "Malware payload (PhantomStealer)", "value": "8a9a5185d915d02957ca692fae30d02e409670defcb958343d3c1bc5b3e261ba4212b2811df42d80ca07aa764357ef2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939224, "uuid": "b16916a2-6a3c-47f5-8f82-3e73a57d2257", "value": "T1D995E00163E85E48F9BEAB384935942097F6F943E631E79D7F89429E1C32F41CA52723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939224, "uuid": "009dec8e-19ff-4358-a4e4-75443361ef9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939224, "uuid": "8d9621e5-c907-4f9c-82d0-177aca7642cc", "value": "24576:nGMEF4Am1UB2TKf+6uVgBqGC/eH9B+VOqIPA/G3nqh89XKPD4L:G422TE+DVgBqJ/zVfI13nT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774939224, "uuid": "ea5d27db-0fa1-4a6c-9b4d-1a1283e4e310", "value": 1875456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774939224, "uuid": "f4e2e85e-1cde-455c-92e5-54d8c694be72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939224, "uuid": "6ceeb707-9335-415f-af05-304fdce25478", "value": "COMMECAIL INVOICE AND DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0678e2d-2d28-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774978874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978874, "uuid": "ed77009f-03d2-4045-a4cf-ee33ff1e87f7", "comment": "Malware payload (RemcosRAT)", "value": "9fd4618f38f9e5a2d9bcf9f0a116c44e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978874, "uuid": "67719d17-f9f7-4c02-944a-06c9e6519156", "comment": "Malware payload (RemcosRAT)", "value": "1ab6dc490b9ed586b753cde9d7ad0209b5577b29d929fabaf7ce67bc2eb1ab6e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978874, "uuid": "b4fd1b08-2119-4906-b9de-a08041f994cf", "comment": "Malware payload (RemcosRAT)", "value": "9f232933e6a02c9025b41aed5a68946cad547b0a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978874, "uuid": "986e9c0e-f0ab-4072-9b0a-44854704aebc", "comment": "Malware payload (RemcosRAT)", "value": "af01b3b2962ba34d412bfd739cf9cacfd0774ad6ed0da114821a0fd9b65d28da55271b8b0cc7f452779f8b21d2c5722f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978874, "uuid": "65465581-3779-4b56-982e-ede8c4227e00", "value": "T152219605B017C9D9CE7612B6451006F63E15ECC6C97E1B0241577AA10CA4E5799227B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978874, "uuid": "e8bf1c56-8ef6-416c-9449-19b5149bdf1d", "value": "24:UlexhEnQRjj1Z8XdXziyHlB+fri6oF8D7QCzl27A:wexgu31KNXj+tlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774978874, "uuid": "e621ff86-d61c-4e74-8afc-2b4d7babca72", "value": 1158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774978874, "uuid": "dbcdff8a-4b5e-4309-bd73-b3c52ed1bcb7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978874, "uuid": "b6a933d4-9ad7-4e27-9c94-3f600f5ccf08", "value": "31032026_1550_31032026_Banco Santander_Cpia de Pagamento.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9250fa49-2d0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774966744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966744, "uuid": "3831b34c-9a07-4508-a8d7-a1ebf0f5295b", "comment": "Malware payload", "value": "4ac3e3b1f0d054a4ed682a1d6a53ddb3", "object_relation": "md5", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966744, "uuid": "0ab358a8-aa64-4622-b528-9b1125a86676", "comment": "Malware payload", "value": "1b52d27482ab140ea372e8ce644585013d1b9c5618b1d7880c164549eb15f18c", "object_relation": "sha256", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966744, "uuid": "dc813f86-6a4e-4ede-aeac-c25e3c8aaf93", "comment": "Malware payload", "value": "9b50f284f6e423a2dc10fc2fa9cb5176ed5ee75e", "object_relation": "sha1", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966744, "uuid": "6cf8dae3-a51b-4de6-b7e9-fd1af61f1440", "comment": "Malware payload", "value": "a397e8909f136e17d37bc026672d739ebfae2b0d63434dc6d17e07e4db9c73db9c2bad1b59e6e98ab976d94021476320", "object_relation": "sha3-384", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966744, "uuid": "f09751c7-05de-4714-9c03-c50ea7b308ae", "value": "T11BC0C08BF410CD30B7043580310F209CDF03FAC0106000E08913087775058057013906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966744, "uuid": "5e4e1179-252b-439d-a569-d9c7798babed", "value": "3:TKH/WXFvtYwbXaB6gsVVf0QXKLV5I4gRbBg8hnzYiRIVK60ziGEmCi2:ewDawjtXQV5yNguHugxWGEXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774966744, "uuid": "f2bc1989-9de4-4131-a8bb-1526a9e4b829", "value": 179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774966744, "uuid": "91a77f04-f3a7-445f-9277-60e46da7f3ae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966744, "uuid": "f50b261b-db24-4d14-9bc1-9cdd063e9c62", "value": "1b52d27482ab140ea372e8ce644585013d1b9c5618b1d7880c164549eb15f18c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6887b3ee-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774960661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960661, "uuid": "16ed79a5-49ac-49fc-98b7-e73a2eeed05c", "comment": "Malware payload (ConnectWise)", "value": "32d9746327866ccbc445ecd06689cb5a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960661, "uuid": "1e58b628-0595-4be8-b450-0726048689b5", "comment": "Malware payload (ConnectWise)", "value": "1bf6a46c4bac1d502db6ef5247bc783702949f25d334d333fb4f86c96223faa6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960661, "uuid": "4dbd6226-a341-4105-b513-ed02c1b7c627", "comment": "Malware payload (ConnectWise)", "value": "2bb17f763d4ce6a79ba5f672a91e118611e4ff79", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960661, "uuid": "d8c97cad-f3a2-4e5d-9c6d-59b03374cfd7", "comment": "Malware payload (ConnectWise)", "value": "c76f6eac2610bce6511b18e7d33170d4ceebb16caf1092fa81b083368791511147943eee00ef3add9fb09cfe66cf2139", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960661, "uuid": "0a9daa57-22cd-455b-bb4f-23cb1f7e9218", "value": "T1C0A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960661, "uuid": "ab06ae0f-4485-43d4-b9c2-30d51aae24a4", "value": "196608:pnCtVYqI5MvbWEpKkqVIJqKYnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqWnCtO:RCXvI5MvHxpJ2CXvI5MvHx6CXvI5MvHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960661, "uuid": "7e4f296d-f8de-4ea7-a9e8-fa96738b9747", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960661, "uuid": "40864736-c178-4ff9-8cc3-e4084626b0a4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960661, "uuid": "70b39ddd-f33b-47b5-af6b-7d09c8851c6d", "value": "ScreenConnect.ClientSetup2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21613f3d-2cb6-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774929618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929618, "uuid": "fa527769-7ccc-4dd3-bbbd-42a9d3676bff", "comment": "Malware payload (njrat)", "value": "88d3792263b23fb5ed2430f5e4b4dea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929618, "uuid": "1151c7ba-859d-48b9-be1b-7506f3bd3fb5", "comment": "Malware payload (njrat)", "value": "1cf006fa584b222653b8a12bfee6c73a46e6aa38e6d14574cd503873e26f1d28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929618, "uuid": "b680b76e-2d6f-4691-a49f-294cda061c73", "comment": "Malware payload (njrat)", "value": "6cd30acc38b9805cef40319df89aca7b4a49ebdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929618, "uuid": "85579b0f-1dae-48f7-a6b8-0a56889f522f", "comment": "Malware payload (njrat)", "value": "8c181e6d2be0232aa1a6d91df0dfe8d6a142214ea45ff7a7f8b28ff7a3093b199bf0610d9a81b041baa2aff135d79f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929618, "uuid": "b958c7d8-ba61-4813-a974-65b39ef72fea", "value": "T151432844BFEA5A01E2BD8F3468F645150A34BA63F532EB1E48D668DB17327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929618, "uuid": "40c657ef-ed95-447c-98b6-9ba9dd31956c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929618, "uuid": "d67b2041-85da-47b5-90ce-33c6b2f2edad", "value": "1536:AJPCGsDnQwNgkpAAuF2DGwsNMDZXExI3pm2m:MsDnAuo2DGwsNMDZXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774929618, "uuid": "df7af7a0-713c-4629-9e15-01d0017691be", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774929618, "uuid": "b0da9cb9-0c38-4d2f-8dcd-03cebe37b174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929618, "uuid": "0e02c1cb-b03a-4dc6-bbc0-92ff99c1131a", "value": "publiccocos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc24ed5-2cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774934386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934386, "uuid": "5a1277e3-ca18-4e09-a75e-3cba7d4d69a8", "comment": "Malware payload (Mirai)", "value": "0c3dadb54177e2b4b1910c1234e10ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934386, "uuid": "68dc0d71-0f93-4e2c-b0af-7aa47000f7ee", "comment": "Malware payload (Mirai)", "value": "1dd3fb5ebad3a6c96be41d89334b2b683ec8d4f4595513fd737e9d56a37aec3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934386, "uuid": "6258563b-89a9-42d7-9c7c-45671a747eed", "comment": "Malware payload (Mirai)", "value": "7dddfe62a06fcaf39a53fd1d0983825df7fc6726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934386, "uuid": "7e0d29b1-b5d5-4246-9250-2a332ec01243", "comment": "Malware payload (Mirai)", "value": "521ec5e069f12d2505108b5189de5777fdb20394d8b9ac2fb8d0eb87d349cf4621ee7193a4a5b902ee1df55e6e33f5e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934386, "uuid": "6fa932d4-b4e1-467b-b162-94fb5f93d5ad", "value": "T10A244A1775D189FBC4C68BF52BEB95619933F4391B32220BB398BDA52B0DED85E1C210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934386, "uuid": "b6df63e2-c5e4-48b7-88ac-a9a8e4dd4162", "value": "3072:f6jIwHPlJSi0EbosVucvboeqz3UdQ6GUa9WjsUOSJqmnERv10Ew5MU7:AsxS1E/UOSJqmnERv10Ew5MU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774934386, "uuid": "f0bf8dff-e173-46aa-bd6c-5c63f18f5e7d", "value": 226789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774934386, "uuid": "9cbce7f0-a398-4905-85f0-d37643806dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934386, "uuid": "9512cad4-5201-47cf-b070-fac820a7ee98", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43b92c6-2d00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774961700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961700, "uuid": "5eb9427e-58c0-487d-b416-9b6967d64cc2", "comment": "Malware payload", "value": "59f067fbf2cb4fc9ad1e6e9cc1ef822c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961700, "uuid": "d657882a-3966-4030-a663-566acc2234ce", "comment": "Malware payload", "value": "1e41fff6339d8056b37af2a0de5c6cc3b8bf90077ca6d2631372958515086205", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961700, "uuid": "98db2cc3-6664-41c4-91cb-0db0be2a238a", "comment": "Malware payload", "value": "061e9481c51f8e299ef7670aa3bad226e1311881", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961700, "uuid": "cd3a5e70-0e52-4484-9d19-213c363135e5", "comment": "Malware payload", "value": "45d31c1b6024136bc505f22167722d29165a967e5f5231221e299fdf5e8df3563c3ba0a42fa27922032333dfe28891ad", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961700, "uuid": "3505a970-c347-4c09-8180-8fe5907bcebc", "value": "T1B4746426EDC75CA383D3DFA3D1F3D21CBE6984AC801B5EC5B5B886825860D690789F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961700, "uuid": "2e3b3d08-a9a7-4afe-b01f-0d300d8f0314", "value": "1536:lJwLI4mcMpeN8+v4jqD61WPO/f2+3w2MULQ4i:jw/MpeNRv4jqD6IPOW+A2M2Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774961700, "uuid": "0b735d16-2e87-4f62-8a5d-4b3d561b391f", "value": 355464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774961700, "uuid": "91734763-48d6-420a-879a-dd7512f5b6e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961700, "uuid": "faf0af10-f3a3-4f78-b234-b6d16088d1b1", "value": "telegram.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a757e18-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774989279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989279, "uuid": "d8c2bc77-d1e0-4e22-833a-0f8eb99158d8", "comment": "Malware payload (Mirai)", "value": "9ab899cd8ef3f791298c2e39062e8c7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989279, "uuid": "97a00b6d-cefb-4f0d-8b54-e2a48c55a008", "comment": "Malware payload (Mirai)", "value": "1f5a0a2f3ef85dbbad53544199d06bc263b40a474029ac0e5b7931a5f3da6da9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989279, "uuid": "2e3fa43c-ed36-4be8-bf0e-da5320d2de82", "comment": "Malware payload (Mirai)", "value": "c647884bbcbba5bbba7e8df48b92fcfc51597197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989279, "uuid": "1e433bb0-ea6e-4784-a87d-26ba873e20e5", "comment": "Malware payload (Mirai)", "value": "056a3438b1130bb422cf7b2e49b6a61582c006337acdca9d0cc17bdfd52c9628675c071e320d276ba160c1bf0cf583fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989279, "uuid": "9b81db68-6943-4d51-b746-370cfff33f5a", "value": "T1D2C33B46EB808B03C4D51775BAEF42493323D755A3DB73069A186FB43F86BAE4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989279, "uuid": "2af70738-416f-4262-bcf1-5ca49cf28805", "value": "3072:6mL295W0oW5zvnm82C7L0//+AHmDIM/9nT:6mLM5WYbnm82CH0THmUM/9nT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989279, "uuid": "dce976b8-03e6-4ee6-af39-bb85729cbeb6", "value": 120609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989279, "uuid": "34374193-d30e-4985-97b3-194204991cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989279, "uuid": "216f5122-6ebb-49fc-a3a1-fb00a195bd16", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066acaf8-2d0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774967798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967798, "uuid": "dc1c508e-6e97-4adb-8a6c-e60dba7e12d6", "comment": "Malware payload", "value": "b457d59352d7888ec91bcb4e31a880b0", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967798, "uuid": "0c799be6-d257-4b0f-a5b3-bb897bba0a25", "comment": "Malware payload", "value": "200b208215b7ee1c31d5ced4ffccd509a25ee887c6299583192b9f0b288053e6", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967798, "uuid": "3971c05a-7f45-43ee-a6aa-d5da282243a1", "comment": "Malware payload", "value": "54096569a16792bcc5a73161a4f22b3cf32070c0", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967798, "uuid": "7c7e4b0b-5c37-4523-baec-de578c874224", "comment": "Malware payload", "value": "31c8e880716ca43c8e06fa1a2bda8c340d51abf901ae24e3742912d3d4b97643ff2f49ac7b572006a997400d634c37f1", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967798, "uuid": "835437c8-d718-4b90-9f2c-23e6b9982c10", "value": "T13D56123E23988620D126867168E34B4A0614797C0F6663DF62EF9CFD3D1B95C87B6783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967798, "uuid": "981b6224-97a4-499b-8404-fe1bd8fed195", "value": "196608:p2eYneyLhG2dA3Bh0ZHcLkEZj5QekxjH:p2eYneyd2hLl9kxjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967798, "uuid": "c7e9c6b9-9b3c-4f25-9d41-e8c373b6632f", "value": 6452224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967798, "uuid": "066113e2-8517-46f5-8375-56335c9cad9d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967798, "uuid": "00a26696-0bc3-4418-8b8b-9fc3c5f83d27", "value": "200b208215b7ee1c31d5ced4ffccd509a25ee887c6299583192b9f0b288053e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5caff9b5-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979539, "uuid": "ee1bab38-bf3e-482e-8597-cece04e8bdd1", "comment": "Malware payload", "value": "eba8acc9e751d06d0e49093d2a8f5e93", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979539, "uuid": "8d3dcba2-92cf-472b-b29e-60052f18abce", "comment": "Malware payload", "value": "216989f56970e3ea045773224e82b2afe78ed29e49df7d044d5a5992d622d881", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979539, "uuid": "ca1d7a49-3fb2-45f0-82f5-fd4c14b841fd", "comment": "Malware payload", "value": "014d05419630657865e5f08a5fb4ebb92351018d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979539, "uuid": "906ad2a6-7b09-406e-a544-c144392f17df", "comment": "Malware payload", "value": "20e00df0d705195efecb1d6c5725186b429d3535fa1b2f711f7a6dbeb516e9437b43a82100baf8536dbc8383f62a3943", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979539, "uuid": "7d382279-a7de-491e-8e1f-6a0dc7c4fa48", "value": "T170358C2BB245A53EC4AA0A35057BF331953BFB162913CE1B97F0894CDFB61502D3A25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979539, "uuid": "20d2a533-bfe9-4c6b-a4b3-1f9ec4a2baf6", "value": "551af7f202e2768c63b16f27eadd2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979539, "uuid": "30460030-b764-48a4-9128-89248c80afe2", "value": "24576:FDMUAngFozNckjKRbbf+8m3SoQPabMRmt4:bFoR3jKRTWSx6MRmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979539, "uuid": "177f7b0c-863a-42eb-b1cf-b70e9608160a", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979539, "uuid": "584c3425-e6ef-4b71-8d38-d135ab6d19d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979539, "uuid": "5d542910-797f-4fb4-b924-e239cb0c8132", "value": "216989f56970e3ea045773224e82b2afe78ed29e49df7d044d5a5992d622d881.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435cb038-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958880, "uuid": "c6684f68-ccc0-45fe-bd63-06a522ad2995", "comment": "Malware payload (Mirai)", "value": "fa66703adb6e98482d2e9dee9741704d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958880, "uuid": "ad963a2a-7a72-4132-9e97-9c54a81e88f9", "comment": "Malware payload (Mirai)", "value": "21ed053784a335777dce9913d822feff1be2f9812dfcffd758b27af350705783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958880, "uuid": "19f790a6-7984-4fd0-aecf-2a1e3d9ca454", "comment": "Malware payload (Mirai)", "value": "a4d938776f3c10bc3e8af4e9408e6b3c8f1080c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958880, "uuid": "e79ceda4-4dd1-40d3-8643-b2da54f1c3e3", "comment": "Malware payload (Mirai)", "value": "9db4c7d657e97e2e354740eb5cc79d017849f0256f181b1985fe5ec884fef4773396d4a136289276302703f1a7cef7bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958880, "uuid": "904d5bd6-901e-46ce-9719-7a5ad9d54279", "value": "T1AAA3A41E7E258F7CF799823447B78E22964833C626E1D541E29CEA015EB034E781FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958880, "uuid": "be5ffe1a-41f6-4d8c-90ee-521c213e1d75", "value": "1536:U9aImucT6Wv4ZgarVYBo8y720FyRJuG0j9KUlzLWyZ2fGKhl4N:zuWbv+XY7y/FyruHKUlzLWyZ2+w4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958880, "uuid": "084c2796-0819-495b-93f3-0e6a77b133b9", "value": 97824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958880, "uuid": "63c0bfe7-d37f-4315-b4f8-bc67339bb83f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958880, "uuid": "2fe6e9c1-92d5-4528-9341-01718725b0ba", "value": "jade.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4caaca-2d22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774976104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976104, "uuid": "5d3fee3b-3a95-43bf-a72d-ded08f5c4453", "comment": "Malware payload (AgentTesla)", "value": "74d8af3f3025dc170107765fc3d72f4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976104, "uuid": "741aff64-2e59-481c-9996-40348b56929c", "comment": "Malware payload (AgentTesla)", "value": "221367d0998608cbf888f56cc107af6e4307606fb87bb53579dfcad1f0619819", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976104, "uuid": "b745c8ff-86d4-4e32-a91a-f28eebff1492", "comment": "Malware payload (AgentTesla)", "value": "de49cbefc3db497dcf233c918602fc54e454041a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976104, "uuid": "ba18b666-b78f-4528-b4b1-bd3b4a5714e9", "comment": "Malware payload (AgentTesla)", "value": "8e43355c2fcf01ddf56abb05069dfe581b89373097bc4f7a6d7b038d403927b0979ccef59d02064d7f9f98144c838739", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976104, "uuid": "5a946454-499c-413b-b00c-a3efe22392d8", "value": "T1C05412247F96D453D67125305876DB7E0AF1A6BD22A2EF1F23A05B4CBA207D0B80A352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976104, "uuid": "578daa6c-1117-48cf-9f71-7603edff69e1", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976104, "uuid": "9a289ff4-b4d5-4297-853f-4cd286d2ec3a", "value": "6144:vMm4CCNUMgnjon0pnv9OQHG6O/jwf6Ro+6zOQH3F3Vj:vMwaUMBn0lv9OQmj/jwCxHkF3Vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774976104, "uuid": "cfd1c7b4-e5b3-4643-ad83-68c3e37a11b8", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774976104, "uuid": "58610bf0-fae3-43d3-b751-bac89c1a7c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976104, "uuid": "cf9fa333-6dc6-4309-b3a4-59e5eef6af1e", "value": "WhatsappImage00298737260331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9346c08-2d3c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774987425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987425, "uuid": "6892fe95-3f8d-43ab-a2fa-d38d6ddce5da", "comment": "Malware payload", "value": "de7f93b5eb20991cbd04e1443defeb7c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987425, "uuid": "0a93b724-a8b7-4f93-b9be-21c2a4fe6260", "comment": "Malware payload", "value": "227c292a25587436c7d0bf054f5fe302a1442344750a27f817ea7f642c88bc1f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987425, "uuid": "f1a5a077-ffb0-4ddc-a884-e77108866018", "comment": "Malware payload", "value": "faa267ecce193d37cb4830efa86b082bd029ea1d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987425, "uuid": "03e31e9f-b954-4874-aa42-87a7ab3b11b8", "comment": "Malware payload", "value": "863d14c87a2a89183c1bbc742b219ecf99cd667375704745bea63a3c30b5dfd81d68880c86307a6bc26a8a1ad4edf21e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987425, "uuid": "d64ec63a-551d-4751-b259-18d7d2874fcc", "value": "T19AC58D07B36901EDC0A7C2B9CA565A13F7B178461730BBDB16E08A562F33BE55A3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987425, "uuid": "aaf94c63-c75d-4a8c-93df-c7082d00dfc3", "value": "ad56047e03deeae230a0b532022617d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987425, "uuid": "57404d9e-fe76-441e-adcc-90616857ea69", "value": "49152:JedslLrslrkGQCiiaUErDnqljJSjv1zAz6+LT:UdsXzI0z4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774987425, "uuid": "71261044-7618-49fb-8eb1-ff0dd5312e8a", "value": 2596718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774987425, "uuid": "4bf8cb1b-0458-4789-8086-88a0bae18f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987425, "uuid": "f10ff3d2-b500-46df-9a53-4318aa25e793", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae2ca4b-2c9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774918816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774918816, "uuid": "ebd4c38a-a331-4106-936a-9dbbacf94872", "comment": "Malware payload", "value": "774200b562ca927a3f4d75e3b2d57eaf", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774918816, "uuid": "3d7f8d09-b51c-42a3-b4c1-c1329b3b172a", "comment": "Malware payload", "value": "2326bf6f34ab2c03f75fa8c176c5e551b5e1986fe39384687a3a92c6a7ae8d74", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774918816, "uuid": "a70dfc27-75d9-44ac-b93a-f957509457ad", "comment": "Malware payload", "value": "c403e3fe5fc64d3fd1bbc8f7cd04a9d972e55008", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774918816, "uuid": "7ef72327-a0fa-49fe-9223-6daaae84604b", "comment": "Malware payload", "value": "e9a598d7a19ba85b4e85cd2e8b2d6aead01ead8dbcad7eaa4befd766a4bbc94d67a2e25b349d05acc4ebf9ea223dc660", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774918816, "uuid": "ca37d80b-e4d5-468e-8332-64173b5b5e4c", "value": "T16CD51A0D46A7D0CD7A45A936B462EBC46F8CEEB3170C61F68D34CE9AACC116351A35EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774918816, "uuid": "27b6b9b1-b5a2-466c-9eab-c11a5f0abbde", "value": "3072:abbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbN:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774918816, "uuid": "192e2c08-b584-4c86-b4f1-674a43ef47ae", "value": 2832127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774918816, "uuid": "0ac1252a-4c37-43bf-9c99-6a0f28c51a62", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774918816, "uuid": "cc5f4b16-a59f-4c09-af38-b84f20551fec", "value": "rBOQSupplyCommericallist_MTCEngineeringSdnBhd.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a7ae69-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928814, "uuid": "b2cdfd03-8613-434c-ba92-4d0796f1be41", "comment": "Malware payload (Mirai)", "value": "92d90d34915d29a77b2b059e35cdee81", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928814, "uuid": "a0185ae9-9ffb-4ce8-a012-3640bde38fd0", "comment": "Malware payload (Mirai)", "value": "24aa822b95d167d2ba120d772a0a0c6f8fa27e4e80ee3c2ef7aca7fe17a52ae7", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928814, "uuid": "7e791716-f67a-4650-85d4-7eda3b8115c0", "comment": "Malware payload (Mirai)", "value": "38e2c863451f777279ac9c764598441b63d24c57", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928814, "uuid": "4720d8f1-d131-4424-99c9-9304f0f7864e", "comment": "Malware payload (Mirai)", "value": "5a6586dde2cf55fb9a74eb44d98f3bb1392f248a55033fa7713412042778e6dda51f5d3457a001ad669bb2390be5e42e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928814, "uuid": "5a043e46-65d7-4069-9e98-e33b14d361a4", "value": "T1C7245B43B71D0A83D15B2DF036B723F083EBE91125A66284E60FFEC45277A75641AF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928814, "uuid": "2320b350-892c-473e-9e98-39e43d227928", "value": "6144:fIZ/qoxO2RUp2LP4Jj1QNHeXWUQdv4mDsoY86eeaL57sc:wZqHkUQMJJQNxTdv4mDsoY86eeaL57sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928814, "uuid": "8dfb4647-604e-451d-8692-0ba61399370c", "value": 214342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928814, "uuid": "b2d6c527-ddf9-45b6-ac01-7822fcd4a340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928814, "uuid": "da98ef89-70e5-488c-a2c4-6f51a4fefad0", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02031495-2cd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774941591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941591, "uuid": "949cd460-6d0e-4d69-a5cd-3f718835058b", "comment": "Malware payload", "value": "9381d7216a84cf92565f003742e72545", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941591, "uuid": "76174878-6df3-4e75-9223-85979eed82cc", "comment": "Malware payload", "value": "24d701823ce0f2fdeff4fcc7115c9464b7f646b40573892fd65ad12d2407fae6", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941591, "uuid": "845f85f7-4883-4f37-ae56-9b8ffe005bfb", "comment": "Malware payload", "value": "4f43a9c16210cda08b636f225ba04bd0a250785a", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941591, "uuid": "27939772-1bb6-4bb0-9081-f0d24ab985a2", "comment": "Malware payload", "value": "4b1a49e4ca68d66bbe13932ff23aabc3881ac2f5ff659eb6b63df5947e9ef8591e8a5c94ae0727b8ba13d1fad25d85d9", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941591, "uuid": "39624c0d-24f1-4b8d-a5e8-fbda5e327437", "value": "T1B362C0B1447BE67D3A64C18F1E3F6A1BEE5520FA346B6F6464D3C6C303132544D36826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941591, "uuid": "8ff5b0e3-47b0-4e47-a20e-457fd812987d", "value": "384:6kIzg4Xb3F7ByJGP/t3wkSf+HCpu1KU2kEYv0DBXivlno:6lzg4Xb1Pnt3ZSiCpvJI6gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774941591, "uuid": "5305785b-facb-465b-bf73-a8accc9132ea", "value": 14951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774941591, "uuid": "59df7ecd-4ab7-481c-b43b-058b2f9a6cbf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941591, "uuid": "04834124-d90e-4ffa-924a-6f2eecaaf41b", "value": "24d701823ce0f2fdeff4fcc7115c9464b7f646b40573892fd65ad12d2407fae6.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d331f6e1-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774960840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960840, "uuid": "fff70eb5-037a-4e09-8497-d4f51eaa80c0", "comment": "Malware payload (Mirai)", "value": "9e9ab1eeb45d5066288a4d5dff39d781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960840, "uuid": "a3eb5200-292a-47b4-9db7-b5b2d22fcaa6", "comment": "Malware payload (Mirai)", "value": "24db1fd9ae6ffce9e1b415e95b75c61000a37b1fd24feebc51a0e14b126a7093", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960840, "uuid": "e655e836-e179-4598-9e1c-a45bb807b8e2", "comment": "Malware payload (Mirai)", "value": "a6fb1dd91bc466d359bac43fffa9faa95159e790", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960840, "uuid": "11e00acf-ed08-42ed-a7f5-e76dc29078c2", "comment": "Malware payload (Mirai)", "value": "e84369f9495d543be82b3cd5fed60f6b4de1e3e60841da98506dc2e023d3e37ecd55256bbd8ce5871ed1c22e3eb1c55e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960840, "uuid": "0b2fa17b-54c9-4142-af91-a75788a500b4", "value": "T1A9B3F946A9429B12D5C631FAFBAF414933536FB8D3FA7101D9205F6023CA9DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960840, "uuid": "d672dc7d-1315-4702-95fa-19dcf76b52cb", "value": "3072:LSwrlqVLrwO1nnfG1vdiL1Pk8tMazF7h1eLJezWfV3I0c+bUBf:LSwrcttne1vdiL1c6MazF7h18ezW+0Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960840, "uuid": "47faa4f8-75c6-441e-9c31-b0ec242b540d", "value": 113440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960840, "uuid": "66ee695a-149e-4235-a078-2cab65bba018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960840, "uuid": "b162957c-c3e9-4ce8-a129-61057754bbf1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7312f7-2d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774976958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976958, "uuid": "c64adbe2-f87b-463d-8e19-61ab608b984b", "comment": "Malware payload (Mirai)", "value": "c85937a40547c1294528240ef795bc97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976958, "uuid": "33a65751-2a4e-4735-b319-61a106899aa4", "comment": "Malware payload (Mirai)", "value": "2583a5d8bc62c447d0fb5531f57a5eb37afc5f3862a04ac107d4b9348880652b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976958, "uuid": "a385c440-f8de-4297-974e-ecaef1ba8ef7", "comment": "Malware payload (Mirai)", "value": "da228000824f20f38decf6a18c398387e8198958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976958, "uuid": "ff684b7e-cbe8-4b3f-ab0c-93b67f543027", "comment": "Malware payload (Mirai)", "value": "b614f307c5791c6045d1709aa70b03a004027ebb9f3a7f92b45b1faaa1d8a6267af7effd33245ac239aa7505f653aa81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976958, "uuid": "8e051f28-f3dc-474c-baea-2b661c1942a2", "value": "T113C45A59A8419791D1D02BBBFF1E934873131B38E3EFB1069D196B246BABC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976958, "uuid": "9b4ac090-95cf-47f6-a485-f9229a55bf99", "value": "12288:/POwHrO+cWHCsUeLESKzRme12K8tvlBduxxIMQahf0FtVW2rw8J78RWr:+wHryWHCFse12jduQQfVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774976958, "uuid": "5b368001-e64b-4ff6-90aa-79ab554f9430", "value": 566112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774976958, "uuid": "ae6ce65a-536a-4b13-90dd-6c37e97bf4fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976958, "uuid": "b971e83c-3605-4bfe-9325-2872773dc490", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c58abc-2cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774930187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774930187, "uuid": "c1813f87-c86b-461f-9dea-b75cd847f05b", "comment": "Malware payload (ConnectWise)", "value": "eca900e62cfc1229ee3b03dd81c31db2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774930187, "uuid": "e0a24bbb-9502-4cec-973a-1a862d8ed927", "comment": "Malware payload (ConnectWise)", "value": "25a68982259ac67e3eed86f3b772c7cca9cc6d0d50a0bd50ef08341fbed3a6c6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774930187, "uuid": "cbaa790a-c01e-4a85-8920-9bef4ec66bc2", "comment": "Malware payload (ConnectWise)", "value": "84e6894524a97d075e92198c9ad519bece1b0cf4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774930187, "uuid": "6da14a65-4397-40cc-96ec-66acb18f0c64", "comment": "Malware payload (ConnectWise)", "value": "78a6a1fcae3073e2eca373e5adbd5b8b05b145b1c5467b96d8e941a8ddc77d16b499302b6088f0a159a8128b017a4b16", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774930187, "uuid": "3d636eb3-959c-4f86-89e0-b343a3c42bef", "value": "T1715723007BD96AA6E53F06349876232067B4BC414F13C36F66A4BA3E5D327C05E727B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774930187, "uuid": "dab5d6ac-69c2-4b12-9979-a2d75bea62bb", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774930187, "uuid": "b7d10a56-2f51-47aa-98a8-f8b45ea81018", "value": "393216:shuOvTi7hha62R3X11gOvTi7hha62uOvTi7hha62GOvTi7hha62YOvTi7hha62H7:shuOvjR3l1gOvjuOvjGOvjYOvjHOvjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774930187, "uuid": "44a7a7eb-eccc-4e57-8be7-283a0501dcca", "value": 27744825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774930187, "uuid": "b4c28fa7-af57-49ab-9b49-7a5f2c32efcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774930187, "uuid": "74ede987-9cc5-4a53-9b75-10988093fc4d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d67037f-2cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774927490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927490, "uuid": "cba5390e-2330-4192-9990-91e5f6c49b36", "comment": "Malware payload (Mirai)", "value": "ac7f1d74d5101a4bce56f8a325acfa87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927490, "uuid": "0cea8624-6679-4d99-93f3-a722873550c1", "comment": "Malware payload (Mirai)", "value": "264818e170ff995895e102f89e6cd77232c64e31f72505a3417645ef44fa9f0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927490, "uuid": "80dcd5cb-d152-44d6-82a0-48307cd1c746", "comment": "Malware payload (Mirai)", "value": "87b4f1d482a1e36525db92ce88dc9937d75ece22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927490, "uuid": "bd8b5af9-5ad7-42c3-b0bd-05e4a55208e9", "comment": "Malware payload (Mirai)", "value": "6e9295ea8f57c097ed3cb04c19d2649e0e1b1edfbbc3f6d8aa10529d52c82788103ba22331de15649b209e41e266aeda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927490, "uuid": "d5049763-cca9-432d-b0c7-7036626c2ce1", "value": "T1A8064922BC90CA62CBC066BAFB5E829C73135B75D2DF71068D14473436EBD5A0E3B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927490, "uuid": "69d7556c-070f-4412-b1b6-da5cb3dac732", "value": "98304:P1Pw2DeV52yww7ZwUYGkGd42/jAK983Kny:t9I52ykGd42rAK98an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774927490, "uuid": "5b1cff7a-6fc8-4235-ab0a-89f272e83221", "value": 3999008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774927490, "uuid": "a9174a3d-c06f-46fb-ad0b-6b2bce594efb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927490, "uuid": "59b86bc7-c557-44c9-9a93-c6ec654b3a69", "value": "wlan.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3e6cbc-2d05-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774963538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963538, "uuid": "7dc057ac-d126-45f4-974e-b8504fcbe9d0", "comment": "Malware payload (Stealc)", "value": "ad83cd5063ad2e9161ea8abb7aa99b8b", "object_relation": "md5", "Tag": [ { "name": "158-94-209-253", "colour": "#B2508A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963538, "uuid": "d57a1ab0-ab74-4ef4-a3b1-674160860210", "comment": "Malware payload (Stealc)", "value": "26694c42ba45c2f3dd93ca9c6e223edf43fa08a68c9907a422d63bf9cab82737", "object_relation": "sha256", "Tag": [ { "name": "158-94-209-253", "colour": "#B2508A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963538, "uuid": "faf561a9-dfe2-4af0-b3f3-761c934b104f", "comment": "Malware payload (Stealc)", "value": "9027aa523f99e6014cb480d47d934bbfc931ae1b", "object_relation": "sha1", "Tag": [ { "name": "158-94-209-253", "colour": "#B2508A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963538, "uuid": "3a185922-b3d8-44e6-88ee-c10af9f50c8b", "comment": "Malware payload (Stealc)", "value": "8169a91963e9506c9fbd3122d78eedb592649c976a128a90f078e8d128e8ac3fa537b8d77e800719a6f958eacfe890e8", "object_relation": "sha3-384", "Tag": [ { "name": "158-94-209-253", "colour": "#B2508A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963538, "uuid": "0f5ce5ee-61f1-4f29-ac19-e7073947f458", "value": "T1750833E7EC1204D85055FBF055B96F1967D190FB1683F2A83D8D2A606289CE8DFB6CE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963538, "uuid": "3e1f9d2f-218d-4b22-8d4a-1bc9188e4228", "value": "1572864:KhmuWbECG1t5JiJf7nV9YCX2pEZzN8Yx9ytq:Khmu6GEV9YCXqS6EWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963538, "uuid": "c73a884d-ce1e-49ec-8689-9f8e98ec0af2", "value": 79320190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963538, "uuid": "cc06255b-d554-4eae-aeb8-c5f56e9d51ef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963538, "uuid": "8cf5184e-44d1-4291-b4da-0d0b5b6d7542", "value": "Lic\u0435nce.L\u043ead\u0435r(\u0420A$$.- 2025).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76754422-2cba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774931478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774931478, "uuid": "2872a100-071e-4587-a05e-430806246700", "comment": "Malware payload", "value": "c4b2174296844d32bcb9097bfbe2f95d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774931478, "uuid": "a02fa4ed-d653-44ee-9a2b-8932124fca88", "comment": "Malware payload", "value": "267d81ed801a1a3323f987285c30cb4e067c620d1e1fb0aad35f990c931d1ac8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774931478, "uuid": "c03290af-daa0-4268-b15a-3cb57e47687a", "comment": "Malware payload", "value": "09edc8419ff10a4170e63c32f6b110e1d27efb13", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774931478, "uuid": "ec9854a7-24b4-4c46-a8a3-8f3e6cfa8e89", "comment": "Malware payload", "value": "e9392cffc811273e561b1fd41027814110407681b0a71e670abbe24196284ce66548fc9647939260fdfc20cf678b37f8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774931478, "uuid": "71629f44-342c-4872-aee3-86241bcdfda8", "value": "T1676733CAC8E54F8FEC1B55358368829BC5BA7C19BD1158BB5166B6C528B3BF031F3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774931478, "uuid": "e6346c3f-b8cc-4aa7-864a-4adc7b6ff644", "value": "786432:EvUKYIDp/N+NsXFNhwqQ4whcg6VNLzWG6JU+:EvUKhNNPFj84wSp3WU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774931478, "uuid": "f1f338d3-4bb6-4f3c-a394-f0b08a9bab38", "value": 30208000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774931478, "uuid": "81208bed-355c-46f7-99d7-4982b51dabf0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774931478, "uuid": "32e34804-3293-4d1a-b721-ea3e7b2dd683", "value": "Silent_V4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a259d3-2cef-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1774954354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954354, "uuid": "fb87d1ab-e509-4e95-861b-80bb8d0e09c2", "comment": "Malware payload (DarkTortilla)", "value": "12c2a95893c7fb3b63248b3b51ca53e1", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954354, "uuid": "3a6e5526-40da-4a60-8942-3c02cc2bbc97", "comment": "Malware payload (DarkTortilla)", "value": "27f555873ce5ab6b6cdbfa5690db3a663793be34e29917be22ef1e9cb1d2dec1", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954354, "uuid": "9b501fa6-206e-40bd-8121-f8f2ad733389", "comment": "Malware payload (DarkTortilla)", "value": "076ba2d96adfc5d01b6abe481e544ff3ddecf100", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954354, "uuid": "ad68062b-09c1-4535-9c50-d381c842b239", "comment": "Malware payload (DarkTortilla)", "value": "c5ef2bd978b487fa2e8e9cddcf813979b15c028da29c87ad8b32809c2c771552c581270a058167338130abf103abf728", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954354, "uuid": "2679eecd-5b92-4eb7-bfbc-af67724d3e09", "value": "T113F4CE210E872F98E22D0F78C056186977F5E863A297E76F2FFC01B069ABF51CE16151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954354, "uuid": "ba40751f-ac0d-4f02-ad19-63f3885f536e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954354, "uuid": "b8878467-d3cd-4ce4-8ef2-c294f9ad2275", "value": "12288:R957EvntYbcoamTEoF4e8cmXFUDgO2TKfHJEfM/E6P2VgBxzuU+Tddp:R951JaEF4Am1UB2TKf+6uVgBxST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954354, "uuid": "1ada0eeb-697e-40d8-97e8-c318a51d21c6", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954354, "uuid": "47750419-7b34-4e1d-894a-41919705a23a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954354, "uuid": "fd3b04f6-c56f-4139-9236-3ceb1335715b", "value": "COTIZACI\u00d3N METALINSPEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac26acb-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774960879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960879, "uuid": "e9e70f22-02ce-40d2-aa5c-c01156f79314", "comment": "Malware payload (LummaStealer)", "value": "b35c3d02f0849db58454359ead4b6755", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-8413", "colour": "#5F3C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960879, "uuid": "1142ffbe-f82d-4058-a745-8b81bd64c1dc", "comment": "Malware payload (LummaStealer)", "value": "28085d995e1b9a8bde3e2eb61c23accd28be7ba3dc99c4397508a7824e5d358a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-8413", "colour": "#5F3C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960879, "uuid": "31812995-901f-4f50-9e87-f9ef64986f45", "comment": "Malware payload (LummaStealer)", "value": "3c163d61af23f472d114fdbfb2c4d3a2ddef6d76", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-8413", "colour": "#5F3C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960879, "uuid": "8705e54d-e141-4276-888b-0a5b13ba6193", "comment": "Malware payload (LummaStealer)", "value": "4e372277b13775921b81af01aa5a4f646fc153be272350716a5921430edafbb942d2f2432a2cc00e04b2b40e532bc478", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-8413", "colour": "#5F3C41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960879, "uuid": "89115256-6720-439c-8850-ec43225db7c3", "value": "T114F53300A28145EC59D727C28739168FD7A7F0FA84FBEFF8272AF921A05955CD06B44E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960879, "uuid": "e291679a-948e-481e-9edf-a4d2a55e7d76", "value": "98304:3e/mSuTEda5siG7H4zp3nghHBL0yQM8QOhFKFMJ:uluIc5sP7H2WL0yQlQqFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960879, "uuid": "17560931-19f6-4a5b-89d8-8fef4eb3d90b", "value": 3327459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960879, "uuid": "4e1f6978-45c7-400c-b3c6-9962260f6f85", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960879, "uuid": "e60e77f1-d544-44ab-ae0a-f3274a750e39", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8c6d72-2cce-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1774940109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940109, "uuid": "613522b5-2ad5-46b3-8801-3fa311e9091d", "comment": "Malware payload (Loda)", "value": "186df13eab46fcc9086f1c5bbaab7d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940109, "uuid": "7f8f289c-2e31-40af-9923-10033b3654ea", "comment": "Malware payload (Loda)", "value": "28323e22c0a18e5db019c427854216cfee876fb2eca58e468565938281cccff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940109, "uuid": "a986d37d-f5f8-4f2e-b07a-460dff1f1ec7", "comment": "Malware payload (Loda)", "value": "25bf26ca7eafc0ce551b817068690c6bb719fb07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940109, "uuid": "0091c2fe-341b-4b2d-a17b-050fa2cad383", "comment": "Malware payload (Loda)", "value": "d8c90a79613c62213f361b367d7bb94123fdbacfa935ab18b9790949044ba614d7cff2a5fc20664f9870172ac215c80c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940109, "uuid": "bcede680-8753-4b38-8c87-f7b26d994d03", "value": "T1BD659D73639B439CC271C236B9BD62215D77ACE10152BD46EE88FD6FAE10D904D8ED22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940109, "uuid": "f09c3ca0-3f97-407f-82b1-a7dfb5202c37", "value": "0e136cae6f625c80ecae333d9e2a37fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940109, "uuid": "d832767f-c8e1-4eec-837e-21cd89b093bf", "value": "24576:04lavt0LkLL9IMixoEgeaBO2otzs3g5SYqKOmEFZJ0HJAJq9MmCS:Dkwkn9IMHeaBCf5gKOmSGiaPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774940109, "uuid": "593c4021-7d33-4384-ae2a-2738b50f06dc", "value": 1515520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774940109, "uuid": "ded999af-6a50-48b1-bb74-f750b01ff9d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940109, "uuid": "99b61007-c2d2-487e-8e56-bec745bfa196", "value": "186df13eab46fcc9086f1c5bbaab7d4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b63e86-2d39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774985922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985922, "uuid": "4ee11614-1f5f-4750-9300-011d53fee5bd", "comment": "Malware payload", "value": "e8c3c0b612645824d38b0ded0be2c0ab", "object_relation": "md5", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985922, "uuid": "474978cc-e040-4dfd-8725-3d0913ebc8cc", "comment": "Malware payload", "value": "292579b940c837a51f74bc1c065c69e570f6f0f8bdf682cf08e82a9c933734ac", "object_relation": "sha256", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985922, "uuid": "a8e2d8c0-1757-4b1b-b3ba-9f05895dffa1", "comment": "Malware payload", "value": "0446dfd45e5d135ab4df111fd1db852adc813741", "object_relation": "sha1", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985922, "uuid": "0aa72001-f4b9-4a02-8637-4fd05ed567dc", "comment": "Malware payload", "value": "ed21870f3736bbc20cc5431aac3e096653044d352073b34f773f46f50036b670cc2cd4f5f8fa9d1a023ab11a3c641a7c", "object_relation": "sha3-384", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985922, "uuid": "8f7a2d13-6a63-41b2-abbb-bdcca21a811f", "value": "T11912AE1EC7C84C82E0AFF5751AD48159CA2AEBD447EA040916F963C5BB81EB79231271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985922, "uuid": "4c5ad2e1-b526-45ee-8c77-e1bd643ba2cb", "value": "192:YKRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+5:NRm/wksuQJ/g6dI+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774985922, "uuid": "67ffd162-18be-46ed-bd9f-d9a30c7a2aad", "value": 9035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774985922, "uuid": "fd858786-ce77-48c6-abd5-0ae7ef7f7cec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985922, "uuid": "6071bd91-3ff1-4b9b-8962-2bbfbbbff2dc", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfcb11f-2d39-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774985926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985926, "uuid": "149460da-813d-422b-957d-9cf65561022b", "comment": "Malware payload (NetSupport)", "value": "e1773abe7b37dfa7dd5b58ada46e821d", "object_relation": "md5", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985926, "uuid": "43366dce-71c3-48a0-9a42-7977a042fa25", "comment": "Malware payload (NetSupport)", "value": "29cb13b83596f358c18357c5159cba1155087257e4b8a6a5d2cc69ba8f7d3f43", "object_relation": "sha256", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985926, "uuid": "57581aca-9ff0-4dc4-bc3e-5edab67ad7b9", "comment": "Malware payload (NetSupport)", "value": "0202b66da7666886720106d067758a0af38f5dfc", "object_relation": "sha1", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985926, "uuid": "9f71c8cb-4598-4524-8605-07e8a1637f99", "comment": "Malware payload (NetSupport)", "value": "c6123fe155bf09d20ea4e5b65ae9e5fdc0ec980e947f3170e46e395599966bda82491984efb4665eaa8532b08e429aed", "object_relation": "sha3-384", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985926, "uuid": "ec9c27da-866b-45d3-bd7f-7d1925d3095e", "value": "T1F9967CB88B84975EAE6E1A07E078571E67F37F26D09271FC5B62370B216FC086639C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985926, "uuid": "5f707dbb-418e-4663-b1a1-e6ce756e52b7", "value": "49152:CZ3I7kVIvGaA1UzZtYxlGDRISgvSgpV9xwSjuPV73u2zAxN9cNF:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774985926, "uuid": "e7d0a734-6c53-4996-bf93-3e2d8eb7d53d", "value": 9410837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774985926, "uuid": "49776e33-712c-43c4-a891-d3e45daa12f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985926, "uuid": "e60f760b-29be-4936-ba9e-052e2432e2d4", "value": "ffa.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e2fdcb-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958906, "uuid": "8fff1f93-7336-4e76-ae6f-ae292ae9777d", "comment": "Malware payload (Mirai)", "value": "3a815c3d0ae68ed8f02ada092e18c836", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958906, "uuid": "f75c8053-335b-43fd-846d-471bd55b54bd", "comment": "Malware payload (Mirai)", "value": "2d0510c7fba47222afdd96d1ecb0c814830863e4610fb17fc86fdb088d6e0b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958906, "uuid": "48fbbf10-faa6-4d92-8362-a4897f7c5bdf", "comment": "Malware payload (Mirai)", "value": "4cfec906200b0ba386fd42fcff1c8b9265452459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958906, "uuid": "5cb2d431-ac6c-45ff-900b-708d9e570ace", "comment": "Malware payload (Mirai)", "value": "60ed2e42ccce86ea43de672db71ca58a07a89373d1d2a1c5753174cfe7f93a3b89260defe89a6a37f6b8297e77196d76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958906, "uuid": "7da5a454-9afd-422e-ab32-11a402c3cd3a", "value": "T18AE35C46FA818B13C4D517BABAAF01493332A79493DB730689285FB43FC6B5F0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958906, "uuid": "c14fdb1e-5e26-4629-a1e8-7a1f40cbff8a", "value": "3072:iQHlfs+leH9waS+iFAdKwH5m3m7phtcEfXfMYM/9ij3We:iQFfsueTZKwH5m3mdhtXfLM/9KWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958906, "uuid": "a4cfab7e-a471-438b-a46b-a39bb2ba3671", "value": 153787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958906, "uuid": "df9b86f8-ff61-42e2-a044-7543840e66d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958906, "uuid": "3e893a6f-cd01-4df4-bafb-7dd5bd1b4712", "value": "jade.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb30a644-2d48-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774992609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992609, "uuid": "e7529ced-acdc-444d-8828-cbce739e9774", "comment": "Malware payload", "value": "169080e34221ba5bf35a73abbfe9d576", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992609, "uuid": "bcd6127b-a807-4237-b4a0-ee8bb945e7ac", "comment": "Malware payload", "value": "2d22c06b34bc0cd6aa01b638446526af9b043d146034f1ed9fa9b049133f1027", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992609, "uuid": "e0ab86be-c6b7-47e3-ab82-5682c59c31bf", "comment": "Malware payload", "value": "8b7dc9574d7554ed2216cd80ed22884c7a32f0df", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992609, "uuid": "051df114-0731-4cde-8df2-46d77d9e8066", "comment": "Malware payload", "value": "c929c16582bf5b75b1dbaa022ba0b8fbade3a014d1f6c8e38a2bae7fcdbf688f6c73034ad768b9423b9518268f6620a3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992609, "uuid": "54962889-b2db-4d2f-b976-589d7362ec28", "value": "T15D553352F93647457B7B6DB0BE179357AEA316E43DF325AF32331677AA190A8938000C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992609, "uuid": "86bbb851-73c0-4936-b67e-7b8d2a5a02ff", "value": "24576:mHI9dbaPK35X/W1JfpPTnca+O8CpcUAVOn8cn10dCt3ymPGf:00RaPK35X87PTRaCpRAVO8cnntD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774992609, "uuid": "8084803c-0115-40ed-b736-5fe69b811606", "value": 1303851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774992609, "uuid": "db9e996a-6b09-4f6b-b2d8-74d1ac91e1ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992609, "uuid": "bb7c9cc0-9808-43e2-b625-74d1e00beea5", "value": "Cong_ty_Thuan_An.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9da159-2cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1774960243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960243, "uuid": "34c31bed-e0d1-4c17-9f6d-b8ef73f1aa94", "comment": "Malware payload (PureCrypter)", "value": "bdd5a7fb680fc4987d03d603aa9c7a78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960243, "uuid": "7dff05b6-3fb2-41d5-9460-e7f788be7e28", "comment": "Malware payload (PureCrypter)", "value": "2ecfae6dbd7647ace5980e6ea59b9bdbf82253943fb437fc79c7e74fc30d6119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960243, "uuid": "56f85a53-3438-499b-9770-3af54f84cc1e", "comment": "Malware payload (PureCrypter)", "value": "8ed3f9e9460f0d5ca4bf51e1e665a84fd0747b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960243, "uuid": "adafc237-2f43-4458-8aad-09058fd13c35", "comment": "Malware payload (PureCrypter)", "value": "0de0720e18e2ec304310be015b86fdd4f4e208de885ac4351a4093fda85f17ea060ce13c8d5efb3e114a27b1f53a7c58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960243, "uuid": "8e2df632-d908-4cbe-b13e-78219aeae593", "value": "T1FA1733366DE213A1DD3C6830EA4FF4748A7DE81C291460415F5D3BBD46AE03E62CB7A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960243, "uuid": "acd8c6fe-edd7-4557-b35c-128e771d1c90", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960243, "uuid": "f6d8e573-fd28-4573-ada5-3fa58c3e678c", "value": "393216:h+DpjRGxBk5wG4xdHCiS7r706rylaOKFeoJnOoMf9PVTOPzcZ98cj:h+eBk56nHAv0zadFeoJOoyPVTOoZ9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960243, "uuid": "64d93b5e-397b-4dec-80fe-7daa8fc84f1b", "value": 19848704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960243, "uuid": "50b2c546-6aa4-4cec-ac8c-23fc318db4c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960243, "uuid": "06abc32d-3bab-4dfa-bf0e-bb75d2f385bc", "value": "Installer_v2103_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce329c9-2d13-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774969526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969526, "uuid": "d0ff1799-3879-496b-abfb-220c83920f22", "comment": "Malware payload (QuasarRAT)", "value": "0020b06dc2018cc2b5bf98945a39cbd3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969526, "uuid": "7859eee0-d9f5-4857-800a-671d33eb3210", "comment": "Malware payload (QuasarRAT)", "value": "2f810da956fed7faf74c8ce2cf65638ccdaa92b282dc7492592d7aedce280c44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969526, "uuid": "0390b4f5-8567-4bec-bc76-fe551d13eb7c", "comment": "Malware payload (QuasarRAT)", "value": "71ad34cd9f4f3ee2328ca1c7a64a576499208f43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969526, "uuid": "764d6592-a72c-4dbe-b91e-253e37f97513", "comment": "Malware payload (QuasarRAT)", "value": "ff0b48574f78995f8623cec9a14530c1c40f71f3d63e18e27be774abe23358f00e6d5ef27f69913bb8ddb5928f53b5ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969526, "uuid": "7f1a8650-fb8f-4cfc-a72f-d966339f8e56", "value": "T1CF04D5412694EF6FD6AE15F8F02C412657F4D54932A2EBE6AB8674FFBC1274204602F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969526, "uuid": "55ad02f6-601b-40b1-a1d2-0fefb938fd72", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969526, "uuid": "8eee8bfb-4d5a-4eb9-a88e-1aeecb814bcc", "value": "3072:gI/XTlCoylHtwpX+oK/993NTA2h0/5F3tMLUnejNXHsBbYw2krf+Gyzy:d/ZCDSK/99dTTWejVHgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774969526, "uuid": "45ff799b-ff09-4387-b4bd-afb609fdfd81", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774969526, "uuid": "803aceaf-7d08-400f-8d56-7dc833febb0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969526, "uuid": "b9d1a11b-95bf-4222-bb0b-2be5b02af211", "value": "2f810da956fed7faf74c8ce2cf65638ccdaa92b282dc7492592d7aedce280c44.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e789b1-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959370, "uuid": "2a44c11f-9ef6-4eac-9a70-036d1cf98e31", "comment": "Malware payload (Mirai)", "value": "f5ce2e105a5fa3214cd34c160ab02dd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959370, "uuid": "7dcf04a1-c1dc-4b8f-9458-61bd57a22489", "comment": "Malware payload (Mirai)", "value": "2f8785d8135c19d6fc8b29e12bc81bb260d15e50172808bd289e1203479d5383", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959370, "uuid": "140720a2-0209-4a1d-ab75-f4854870baa3", "comment": "Malware payload (Mirai)", "value": "77817d62f8853ac88fa151449860d43cc8c46f36", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959370, "uuid": "fabac7a4-e729-4b1f-ae51-4bfe00fd2294", "comment": "Malware payload (Mirai)", "value": "a2b60b56b076f9ee787967bfce45001fbb17bf564d013697fedc367767660caa87ab2c765b4263daa4d982d6dcb236e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959370, "uuid": "7b08bca0-9130-47e4-843f-2a641abba028", "value": "T106B30946A9429B11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959370, "uuid": "68b559a3-1925-458b-a47b-66ecc987ad17", "value": "3072:pqiy9qVvpOFnQfG/7/0VZYPY9On5NaBF7h1uzagz8fBZI0cMbZgf:pqiJKdQe/7/0VZYPCK5NaBF7h17gz8gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959370, "uuid": "082d0b91-72b1-4f57-b44e-0780cb9a883e", "value": 112656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959370, "uuid": "6355ff4d-f8e7-4b64-805d-4c11eed4cd2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959370, "uuid": "3fd7be9c-ca55-4297-b4d4-4a469f9c9f53", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56954ddf-2cb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774930995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774930995, "uuid": "1e36b182-4f58-4b16-87e4-4c77c8d07f07", "comment": "Malware payload", "value": "835a3a3eb49219cc034b9ed7aa1e56af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774930995, "uuid": "2ec3ab4c-8295-4988-a0bd-97f9ffa5d9e2", "comment": "Malware payload", "value": "3006d3cf298cbd55a7cff8f908341ce044fa27cafbdc4178db685dcaa0b54720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774930995, "uuid": "58684a03-3519-4363-86cb-09fba01616a0", "comment": "Malware payload", "value": "7e6b6321da442a48290f47001eb7e7819b59f9eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774930995, "uuid": "6f31fc36-da16-4d8d-a066-95cb4e14652b", "comment": "Malware payload", "value": "4b558a0ef36f2d792cfff39803562c7581d44e2287960adaba2aaaf7ede317e73c53c479afef4f7a90cf34b9d6e246fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774930995, "uuid": "c3c15776-3df8-41fc-bb63-9d8175a1054d", "value": "T1CA665B03EC9554E9C4AED175897A9223BF317C481B2123D72B90F6392F76BE0AE79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774930995, "uuid": "4c761810-d54c-4b36-badf-69eaeef2fdd0", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774930995, "uuid": "a9dd1cdb-cf65-4cfe-ad9a-12146d786c48", "value": "49152:DbVW8ruWFVMebqtmMSSVVXra1II2A6xebzX1R70rSiblvjHIWrjmqedjg9KVK1K7:DbcSJMc7BcDIBaVIVEJZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774930995, "uuid": "bc78b912-de02-408e-9453-09c5cba51be9", "value": 6624256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774930995, "uuid": "442733fe-02d0-44ee-bc3e-a34f3ae91a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774930995, "uuid": "af1a3665-c1de-4132-9c40-fecb5d6a628e", "value": "2026-03-29_835a3a3eb49219cc034b9ed7aa1e56af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ef9731-2cab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774924850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774924850, "uuid": "c72c4336-2ffe-489b-8d4f-9838d94cd80c", "comment": "Malware payload", "value": "d2133cf566de370195924bbf27529ad7", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774924850, "uuid": "cadddc75-2480-4372-99fe-3cf9c43375bf", "comment": "Malware payload", "value": "30e9eb52de31d723926606e2fda8b80a7359b05ca9f5842c039afd7678e08569", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774924850, "uuid": "31621945-da2e-4469-a55c-1b98e685f8af", "comment": "Malware payload", "value": "73e4df317e8e67ebcbd8d495450d0a073777befd", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774924850, "uuid": "e5f0224a-e56b-4ae9-855d-01ddae6e2c06", "comment": "Malware payload", "value": "4ed148cb7388fd900ab929db99be68fb1324e332286b51f9d50005016b1c2dfb8fd60eb23d920eab264916b22dcf9c71", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774924850, "uuid": "4b51b1b9-f6e1-4bb8-9bb5-c6faf10f996b", "value": "T14F369C06B7E546E0D177D278CEAA9333D77078901634CA4F15D8EA1A2F33A919F2B325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774924850, "uuid": "2a95e3bb-31d8-4863-adcc-b7e502587ac0", "value": "5ddd4d07d62bcef8c27a53c26c4f53a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774924850, "uuid": "81e9a749-cdcd-49fb-b209-4b808d1e2afc", "value": "49152:4byPDHakcjm9kstcfZSmxsb+xDsWIzaRrlaxCFsu4uK0CMwWW+0fTvUqL5FGZWjL:EfJxDyeElvUg5FGilF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774924850, "uuid": "b2db9c65-c6dc-4475-a88e-bf5b2d3764b1", "value": 5316608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774924850, "uuid": "a524620e-09ad-4562-b860-f0cd7e5441a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774924850, "uuid": "77385e64-e7a4-4ad8-bc89-d5fef44b33b8", "value": "SetupAPP3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7a663f-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959996, "uuid": "97be4977-67f0-48d4-89cd-71696bc38bb1", "comment": "Malware payload (Mirai)", "value": "ed88ce857633cdc0ca8de9846a8ef48a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959996, "uuid": "807b4c37-82d3-47c1-b063-b33ad2dd7107", "comment": "Malware payload (Mirai)", "value": "30f2dabb2255327ab0a10ac4dda124a3ca76ca5c75552dbdfe53b06287b78af7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959996, "uuid": "288bd03b-7a97-4fad-8277-a6f4b5814aed", "comment": "Malware payload (Mirai)", "value": "9bf4cc2a2ace6232ee92bb753e8db6a4313d8653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959996, "uuid": "f33ed49e-8d47-4da3-ac1e-fa010b85d88c", "comment": "Malware payload (Mirai)", "value": "19928dd3b4743b581c92dcb22bff8482ac50e57249f29dd0baa31c0e25fd12dc3e7c0620afc50e47858ae68c6d3adaad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959996, "uuid": "215ec0b9-0814-4893-a842-e50b0afa590c", "value": "T10BD34B46FA418F13C0D6177ABAEF42493322A7A4A3DB730699245FB43FC665F0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959996, "uuid": "5e6f9fad-2d13-46de-ae3c-2a910b69fdde", "value": "3072:K8xYMKZeukpgNIMZsbWQaPe8zYsSaPnp9om2J3zM/9R+9I:K8xYMKZeukBMGiQaPe8MyPpum2JDM/99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959996, "uuid": "1df85f5d-111e-461f-8fd2-0fe046dd9195", "value": 141428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959996, "uuid": "24d5f36b-535b-4996-b276-2d177901182e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959996, "uuid": "a68e9262-2396-403e-b372-63f897c45202", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9ba6ff-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774960773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960773, "uuid": "00c14d89-e788-4efa-a89d-9da10aec3fc3", "comment": "Malware payload (LummaStealer)", "value": "19c78bee4fb3b171899bffa31b1f86e4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-4069", "colour": "#C3378E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960773, "uuid": "8f801004-23ca-41a2-8779-add0eedeb6ba", "comment": "Malware payload (LummaStealer)", "value": "3101a3c02410b6ac2f5dd6fbadf87d727cd5221f732e5e2ff9b88c8c02d1c562", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-4069", "colour": "#C3378E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960773, "uuid": "82cbdbdc-5e0b-462e-897f-ffba7d5a566c", "comment": "Malware payload (LummaStealer)", "value": "984c3214e1d2bf057294d4624082d7656bda1958", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-4069", "colour": "#C3378E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960773, "uuid": "f5fc234e-912e-41e7-884a-97c62fcca8a1", "comment": "Malware payload (LummaStealer)", "value": "79a5bbdadc7eca8528060cfa46244e9242f3584b684726a7333f8f3d95f73b0167e3e6686dd9076bf84d681731167bfb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-4069", "colour": "#C3378E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960773, "uuid": "d85dec7a-c62d-46b5-a2fc-5ab24eeda3fe", "value": "T1FDE533890AAF9F4F8F1BF212A1E8DC9249777DF0391E1281A69D31367322C6D4175CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960773, "uuid": "a61c5c4c-288f-4d53-89c1-cf325d62a2b5", "value": "49152:99oR/ZSUtKaeaJFR+sTCPHS1rfY6R+9cUXyUGbdsAG6bNrIhW9T5w7LuXqQ:99o5ZSmh9JFYvPHXXy9BG66/76qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960773, "uuid": "8df2fb52-a1a1-4e2e-b389-41908ed5d94d", "value": 3302963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960773, "uuid": "34e1a15d-3fde-422b-910d-00c07b55d11c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960773, "uuid": "b803adde-7c27-4432-8275-3115e5611015", "value": "downloadlink.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccbcb0d-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959594, "uuid": "5ba8e325-59dd-42fe-aca7-1416c775aaa2", "comment": "Malware payload (Mirai)", "value": "676346035726ad2d301f0b6dc96ce0ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959594, "uuid": "e6732661-5c0a-4133-addc-f033528c6542", "comment": "Malware payload (Mirai)", "value": "312c4ba029a605fae997860667eea6b46fdfacccd00c90b40f4b6dd392e6d304", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959594, "uuid": "0e0143ad-f003-4002-a82b-3a00c5e99113", "comment": "Malware payload (Mirai)", "value": "caf8b9078ea76198340d798b94ab3cb89539edee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959594, "uuid": "31f7b052-e303-4b27-9a3f-4072283a8dda", "comment": "Malware payload (Mirai)", "value": "a7d0d7e90e00897193e07d2b9df32faa6678483d8caa8a49e78468b4be7571d87f25846c6297db526d228fa828621e1f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959594, "uuid": "cc4877d5-d4d5-4b70-a865-257f79c27ab2", "value": "T18B32C517A7BBAE1BC4D037770193072162E95F916024472FBD0D1C8E6E9A3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959594, "uuid": "314c2320-bb8d-42f8-a8e9-285d05219be8", "value": "192:xvrOR1CQOsz1NxfAz+OH9iG0GhWaDpU/O7Q89AGSybDqeif:xvrbCzfap2GwIU/kwGSYUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959594, "uuid": "58340681-814a-4ed2-b5f9-fd9a3140c4ee", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959594, "uuid": "a65bf710-0a4c-442e-a826-fefe474ddfc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959594, "uuid": "0bef9b35-585f-48da-98bf-dc54bcf36163", "value": "boatnet.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09348ace-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959212, "uuid": "7ccc1ea0-34c4-40b3-bd38-2aaa8d2420e2", "comment": "Malware payload (Mirai)", "value": "75c861b0cebb3405362400aad26c350a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959212, "uuid": "cd3f8def-fe90-48d6-8cf5-bac86a1e8f5d", "comment": "Malware payload (Mirai)", "value": "32ace463b3ef724a87ad97fa7dd17a6578981cf060595fc092bb089692c04ce7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959212, "uuid": "b6eea999-8992-4575-b486-18e96787c5d9", "comment": "Malware payload (Mirai)", "value": "88e8195327e63db7734921406d03a8445819f9bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959212, "uuid": "e7b4b513-749e-481d-a203-b6a9f9cef22f", "comment": "Malware payload (Mirai)", "value": "6306752b2e91eec826450596c0b85495bf0d149dd38e5996d31fa4c4751bcc112dd56e82adafd8f77168dc2aa2d2e2fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959212, "uuid": "91976825-fb75-43f5-a587-65387b58820e", "value": "T1B8733B2275392F27D0D0E47E22BB4B5572A16ACE2694C68E7D730E4FFF22550A8439F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959212, "uuid": "aae0ce5f-2bb8-4ebf-a18d-34cb3bb31a2e", "value": "1536:JrQNNjS9IX7XmB6TcHfeYcW8yoqsNd3LXoGWiM8eqUDXcQ1YAHWuXVQ:mNEEB6yFLXHCXXD1r7XVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959212, "uuid": "69ba06c3-6797-4a85-9528-fe32515ea37e", "value": 77792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959212, "uuid": "ed50c2fa-35e9-459d-ad36-86a5b1ced5ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959212, "uuid": "f07430f0-6742-4a41-83cf-8e668582b374", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de7e664-2d05-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1774963649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963649, "uuid": "ea6d2f3b-377f-4074-8405-6337a8e52da6", "comment": "Malware payload (VIPKeylogger)", "value": "6e88d9787a59531acc7fdfc31ab0c058", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963649, "uuid": "eca51313-e8af-4fc6-838b-7f1996dd8f5a", "comment": "Malware payload (VIPKeylogger)", "value": "32bdc14b86e8ed0f0ca375f34550c97a6ad85de7f8417e6e76f570f8d91422b6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963649, "uuid": "861bbb55-1d76-42c7-8396-af31a3360f1f", "comment": "Malware payload (VIPKeylogger)", "value": "4cc6580a39ebe2ae987dcba9d923dc73218eb8de", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963649, "uuid": "5083cd92-1443-4347-adfc-c6c890e660bc", "comment": "Malware payload (VIPKeylogger)", "value": "f2b6ef575fb9856e032afc0db193f49765a51bc38c71f659c950f960740bb86ef111a8e4c563a172b4c8084bdc61db62", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963649, "uuid": "428f9e53-88be-4225-a181-dce83fd64dc0", "value": "T1E234F210D6D84F59CF981E0840FE1A2DD3E18A6E4269BA89DB7B7E46FFE7604410B1CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963649, "uuid": "1f6b4ab7-64f3-4f44-90d8-1c457d15e44e", "value": "3072:zj+2Ge4SKkGsnH4UzBWP32DJgu+dsi72Q3HSYVLfLrGHsLlvK3DTc9MGnFMbrse0:/+gNnc2DEdq03NfLiYCTYjebjQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963649, "uuid": "7f277132-afd4-48e9-8999-b275548a22ae", "value": 242631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963649, "uuid": "1b75e84a-ff23-4c8b-90c0-65e8cb4c6cc8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963649, "uuid": "bdba9499-6c1b-472e-9be5-136dac763b7e", "value": "Intuety LLC INT-PO-2026-042 30.03.2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e86c6b-2cff-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774961217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961217, "uuid": "02980274-647d-448a-86d8-0c887a7963cd", "comment": "Malware payload (QuasarRAT)", "value": "78730d3b13c2fccc5408b14f62b01ed6", "object_relation": "md5", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961217, "uuid": "2f87508e-768a-4a1e-a568-f8547cd44071", "comment": "Malware payload (QuasarRAT)", "value": "32f152ba15f960c54be6fa2ebaeadcb20211ae5aef0d3986dedc2578a7dc38a2", "object_relation": "sha256", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961217, "uuid": "da70cd4b-0e5d-4cfb-bdbc-c825a9ee28fe", "comment": "Malware payload (QuasarRAT)", "value": "908a42a0f26dae156b5a0a73bc7a56fc144572df", "object_relation": "sha1", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961217, "uuid": "aedcc579-8172-471c-b30d-491fba8adfc6", "comment": "Malware payload (QuasarRAT)", "value": "bced87c6cfee845ec0ee30261a9eeb20476f6ebcd90b67212626b89176db24be9b1fb48cd074e032e4d44bf36f58ce72", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961217, "uuid": "b1b880b4-a4c7-4ac9-92a1-f4c48abf072a", "value": "T12052992C09BDFA5893D9E316EB99F3276D461CAFD2B875172AB38C6DA0024C045DB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961217, "uuid": "b40253c8-2183-4888-8ed9-f1baac191978", "value": "384:Ya3Jne6BkOMKJCGFkDd6KFrwjSswoRkHge2MM62c7kOaq/JnFSWsu9d3zyQBziJZ:YI3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774961217, "uuid": "4d7b97ab-f1f5-40e1-a6cb-33f0596fe498", "value": 13520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774961217, "uuid": "954fe395-4155-4a55-a015-e094c9fd3d76", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961217, "uuid": "43fd5707-92b1-409f-9b6b-fb93ac845da1", "value": "A.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e300e444-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959578, "uuid": "c3dbe165-ed3f-421c-999a-33a7030a39b1", "comment": "Malware payload (Mirai)", "value": "1108e44314223ae8245932c239388a5a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959578, "uuid": "8a40b94e-2f12-44d4-876c-77c9c28b56a2", "comment": "Malware payload (Mirai)", "value": "332e784b02746b3dd6054d71e22112fc4cede6384d4ef44ca447ccc34d84674f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959578, "uuid": "41c80edc-aa41-4cae-bd73-b26d360cb4a6", "comment": "Malware payload (Mirai)", "value": "552cab0c2f30b75d25f59346d85f3f8f755c3003", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959578, "uuid": "e18a49f6-360e-41c8-8430-e8f550a11a86", "comment": "Malware payload (Mirai)", "value": "8a60382b8a13d71850c7961c35f8864874fbc4be77f19d537adca17d43704f3045974497c6f94f9d34c3e393ac2d6423", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959578, "uuid": "7e3596ee-bc6e-44e3-9464-30bdbba24a12", "value": "T144C30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959578, "uuid": "0fb5cb46-56c0-4726-867a-cd7c7fbb1f0a", "value": "3072:fWD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1c:fWD76aX9aKTcRQVnoiYq1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959578, "uuid": "a3e519a1-69de-4636-9b89-1e1da0d2e2a1", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959578, "uuid": "4c235471-db45-4e05-9128-31a9bd7b8580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959578, "uuid": "80b6dc47-b725-4afa-955a-9ecbf5c53088", "value": "boatnet.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0aa24b-2cff-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774961146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961146, "uuid": "e3d8e993-d565-44b7-ba77-c425966bd1eb", "comment": "Malware payload (AdaptixC2)", "value": "5e4e3f759d6a31a1e3fbca6c0dc7e9a8", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961146, "uuid": "d092a891-4903-4f96-8138-c7343f7a1488", "comment": "Malware payload (AdaptixC2)", "value": "333712884658f7697b96da4ae3f1f9511d079e9e402f51f671b8ea1ab8c2886c", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961146, "uuid": "3065edc7-d358-465b-b84b-6dd278a4bc26", "comment": "Malware payload (AdaptixC2)", "value": "ec10c749d5337272d34f9eb3ec7d02c7cc8af0cf", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961146, "uuid": "b914d0d4-851b-4698-be6b-ad7eba64ea01", "comment": "Malware payload (AdaptixC2)", "value": "354985255b90cae43758a1d2570883ab9206c4c76cab6f66b0fb0e51c5d6f51b36e22114c90c373fd710be1f0796f356", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961146, "uuid": "89be71fb-216c-41dd-8591-cf0a495a0e0f", "value": "T1AE6633D781010CCAAC75D47A0DBD5E4FFE46032A12957615A8E2E233F6367978BBE231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961146, "uuid": "4f236af4-3434-461e-8f09-bc2d3beb2e26", "value": "196608:Y8WzaxfY9SOaqXNbXPsbdufqlDJOOtDTC:Y8YufYIOfXNrPqdufqZEi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774961146, "uuid": "1e62e53a-66a9-46de-9dcd-12b83eb7bb01", "value": 7017404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774961146, "uuid": "6db1801b-af69-477a-9159-4cc9afc7847e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961146, "uuid": "a38debf2-ae22-4527-9321-5cf76b509e3d", "value": "localhostc2-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450383c3-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774954588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954588, "uuid": "3b965d3a-f1e5-4393-9919-6bbf552e0ee1", "comment": "Malware payload (Mirai)", "value": "95ddaa2ddf8eefd4eb8e51bdc06b5580", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954588, "uuid": "8d831a73-76e7-4e57-864c-bd8747529493", "comment": "Malware payload (Mirai)", "value": "3398f6aa08fd21b87a404c8535b9da157ede1cffd5561ec8a66f2f5434e795c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954588, "uuid": "cd8bdd5b-b986-457e-8b24-ea28c95b4fcf", "comment": "Malware payload (Mirai)", "value": "60af1e977ab2481ebd619782079d41fdc66dd1ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954588, "uuid": "e5137007-1ce2-4ce5-808e-7f8adf5ba005", "comment": "Malware payload (Mirai)", "value": "8fdcfa1a8736d081244c79f86df21b03ee0d995a018c62d03c6fd34f759ea17963935d5b2ef6f52bb2f6e3a1b6cb868f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954588, "uuid": "41833c2a-c401-4e09-be48-7a8dd0a54825", "value": "T122233A49C703C1F0E8460570507BAB7AEE7A6C336170ED5AEB987A26BC32B11D50B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954588, "uuid": "b4b4368d-525e-497a-b817-bd7d17e39210", "value": "768:sXK15wniDa6PO5+m0h5phDQrJzm3WUL9bUFUB8JIlAecucuN7iKlUH1msPK9K:sXK1KIfPk+m0rQomUL9lHcu5SmsiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954588, "uuid": "be3e1b2b-343c-440e-a803-50ec68f7ee9a", "value": 45728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954588, "uuid": "df4bef53-b697-439d-a5d1-24530d68cabb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954588, "uuid": "9012cec3-7a06-4181-a3db-498e9aefcaa9", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944edbd8-2d31-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774982639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982639, "uuid": "8ec15748-63c7-4a10-a4aa-adaedcdc579b", "comment": "Malware payload", "value": "ef5d7b40ae3b5d3ae6b81b65b961a742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982639, "uuid": "b2666b4d-cd40-43b0-98aa-ce862d6fd485", "comment": "Malware payload", "value": "356b186ef1508cbb135594e7a04fafdf69610176a75605cb1c81c818c062bc85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982639, "uuid": "696287a5-9306-41ba-b85c-9c529a8be216", "comment": "Malware payload", "value": "e81ececfccedf42ead96d63c3595578304ad7e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982639, "uuid": "c5ce3f6e-375c-497e-ba92-e6c80a18c378", "comment": "Malware payload", "value": "8a345013b84e08d79c4daedbbbaa6a2d70007c65b891e441663ec2ae01aa65b162aaa4d391206333e13f510234d4d47c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982639, "uuid": "fe20d6b5-473d-4ea8-b7ec-5523e00b5bd6", "value": "T16304525BE67660ECD1BBC03982527632F9A17C5C83356BA74B5187321734BE0BA7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982639, "uuid": "ea886a2b-aab3-4a99-8ac9-5c370800b41d", "value": "dbf059222d1ebab08383b60c600a0162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982639, "uuid": "54eb68fc-b1f8-46ab-aa12-640d3ee99fda", "value": "3072:Dk+xx1un9K/ymhFQSgwAjjfmDlbq1OUb9XeboI:QPtmwlmszObp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774982639, "uuid": "48c51b29-7880-4cea-909f-791378a08ee6", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774982639, "uuid": "1ad0cee5-a6c4-41bf-b039-53677d56aba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982639, "uuid": "de1c80e6-106b-418a-b3ea-4d09bca0caf8", "value": "qr2q4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8421a6f3-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774960707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960707, "uuid": "a0793e7b-a483-4283-b3a3-8bfc2b892b7e", "comment": "Malware payload (ACRStealer)", "value": "0664c83d26c7a70b14b63e56328de1b7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960707, "uuid": "4b0feb21-8fa1-40a4-8ca8-7aa8bf7a60ff", "comment": "Malware payload (ACRStealer)", "value": "35dbae3e220f782f3014dcbf35f5a4ecdec87fe727371739e3798624043f8413", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960707, "uuid": "f8cc148d-f362-4ff9-b770-e27dba7458cc", "comment": "Malware payload (ACRStealer)", "value": "712c716121938125da085a5b6783635d8ca142b8", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960707, "uuid": "60a080bc-54af-4525-b6ed-f97e522f6df6", "comment": "Malware payload (ACRStealer)", "value": "020ca95300ce04fb910d35dc5eb0e9a3175067ccfa2dc6ed10f59bf7b577e859f456a60dfb0d608730bfe44e16fb209d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960707, "uuid": "783cc74b-8654-4c32-a313-c56c2a2da847", "value": "T1AC069E32F546A025E9F315F3D3FA0AB609666C587B3AE0D3649478D482718D326FE34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960707, "uuid": "b4104f93-d1bc-4cbe-a7f7-9f57194fdfd3", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960707, "uuid": "1b983323-e7a0-4dec-890e-43ac4658a9c8", "value": "49152:EGWShK7K51yVYuFhM+IQXT7IeWyHPDMZnlPqnkcDib/B3QmVWwii0QzBCFdTx:E0r51GxhiehH7MZcniemVDuMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960707, "uuid": "829f8936-26e7-4c19-a79b-2843ae0fd308", "value": 4017664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960707, "uuid": "1b57d40e-5f0e-4bd3-bcdc-f16cef03932d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960707, "uuid": "418a0867-7e9c-4eff-9f25-5e16337741cb", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef634824-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959598, "uuid": "d8c3d4d4-86a0-46cb-8a7d-fa4e6d597b5e", "comment": "Malware payload (Mirai)", "value": "ba5b60475db6177cd7cefe90942cf20f", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959598, "uuid": "957e916f-1436-4d01-854f-d04dfc51c28a", "comment": "Malware payload (Mirai)", "value": "36283e93299fb13567ff63d1ba6f1ae5a54a345473a6c30263ad45f61b2eb4b8", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959598, "uuid": "d297c49e-53f9-4898-9fde-e2b5bb6bdbde", "comment": "Malware payload (Mirai)", "value": "4006234b3ae5bd9db6e34dd7b5034ef5b9e4ff60", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959598, "uuid": "562de311-ec99-4c04-823c-e19287b66260", "comment": "Malware payload (Mirai)", "value": "b24e64eecf1e80cc8f4349428dfcf02cc460559ef6224ff38b08e156623823ecb5a4dd64c5038ebb17a646451410f33a", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959598, "uuid": "c722c182-baf7-442c-9eea-69cd73cccda6", "value": "T18F23F1B9D667F1BCD8B065B7038EA1D6A52B68014727270F03E132AEFD672686D417C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959598, "uuid": "02908ea5-4c79-4fbc-b85e-5d78bce71bd4", "value": "768:xdGwNYm3GJyOvAZhON6YONKVLQi0jytVwLRZ+v84GZ2S0Jz1b8kpR9gkA4Eo:WwkgI6YONsLsjwVwimoLzxJ9gk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959598, "uuid": "65b6c094-63b7-48ad-bb62-89c1e9c33c82", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959598, "uuid": "42ca47d1-41f9-4319-9f8f-cf38f8972735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959598, "uuid": "43160eda-16b3-4a89-a618-00ec9ddcb1c1", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78534c1-2d4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774994321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774994321, "uuid": "c2cec6a4-b410-4020-9ca6-3f6d747ea1e1", "comment": "Malware payload (Mirai)", "value": "9476a4fc101e07107972ee26d73918b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774994321, "uuid": "b8d30974-3a50-4995-9111-3559b1d2af76", "comment": "Malware payload (Mirai)", "value": "3797a524e74968a07f4e494b8998ed14caa365d2ae8d1635f7c79a725ab51734", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774994321, "uuid": "b21221a2-c5fe-4c6c-8ee9-577fbc83cfa7", "comment": "Malware payload (Mirai)", "value": "c4fd3199fcda03cf2163632d9fa8982bdc2a405c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774994321, "uuid": "39318df8-c42d-4c58-89b5-0c5a44425a7e", "comment": "Malware payload (Mirai)", "value": "81823499dcdd6dd79ffa9e140b35c6128f635851e48def6f1ba3b4873f49ce5ce4e01e8090f123394dae707965df217c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774994321, "uuid": "61a0ac08-cff1-4b6d-a4a2-9ae5060f1a74", "value": "T19D14C71AAF510FBBDCABDD3702E90A0139CCA45722A53B763674D528F54F50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774994321, "uuid": "a557e23a-d71a-4ad1-a8aa-a8327eeff12c", "value": "1536:hR3ynCmOtuIjSdAR+B+1L6JePXxc20gw+nz+K5NbPHSxGZli/jCl0ByzIotQR5qB:6CmOtuIjgBqLrVNToGTuAzqR+db8DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774994321, "uuid": "826599a6-3e84-4e12-9601-0a54a2990e6e", "value": 190480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774994321, "uuid": "c053ecb7-3076-44c7-ac38-66616e055d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774994321, "uuid": "dd4fb8f4-a62b-45d2-ac1f-d2f0c800c81a", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ab2c6f-2cbe-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1774933361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933361, "uuid": "9d9b9bcc-4a3b-49bd-a025-8d2246f48faa", "comment": "Malware payload (OffLoader)", "value": "95e0b8d220a2f5cd7df49fde346d8ed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933361, "uuid": "5eb0e22a-73d1-472f-a569-b3b9e5d35335", "comment": "Malware payload (OffLoader)", "value": "394bc9307e69737bfe23c9b049b40f1877ed4ea7b62d81e376d9e8d3da2820a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933361, "uuid": "3be8586d-600c-458e-881e-26de4cd17996", "comment": "Malware payload (OffLoader)", "value": "7fcc54c7928e58784a9d5591bff117e81decf2d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933361, "uuid": "c907e47d-c572-4bcf-986a-f83f963e79a3", "comment": "Malware payload (OffLoader)", "value": "9e8f31d0f24efc9320e645ac3c190062b189032032a9b816b4616daecbc26077d932329f21c165192b8b552a07aadc32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933361, "uuid": "411009a3-ad57-4d6a-9d70-8e9cdfa97d22", "value": "T150661223B24A673EE06E1A374AF2D2205C3B7E51A55E8C469AE41C4CCF7D0A01E7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933361, "uuid": "9e88a943-f172-4707-b790-f1e60881726e", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933361, "uuid": "ac05d3ff-f679-43f3-bdee-ad6bd2c40964", "value": "98304:IN66FHPsg9ZNQDOUbyoXNBUrsYnVO0KBOfp4EKe+g30Lw4w8T:sFvPNQDdmo9BUrsYVRKeFywK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774933361, "uuid": "245b9067-8cfd-4417-9533-8eddf918795d", "value": 6817569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774933361, "uuid": "87692307-4084-408c-a54d-f5cacfb2f8ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933361, "uuid": "5adefbdb-2188-466e-92dc-f376055b1214", "value": "bckd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11dcbd7-2ccc-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774939281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939281, "uuid": "21889cf0-fdb9-4d95-99b3-c49406a6f18c", "comment": "Malware payload (PhantomStealer)", "value": "6fd1ac7e2e91885d6621bbca6535d99a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939281, "uuid": "be9735e5-7180-4f43-8dac-eedb2b3674d1", "comment": "Malware payload (PhantomStealer)", "value": "3a45008764e6ad10460ddd325f434be6875ddc93a90d0333261c2fa2b35539e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939281, "uuid": "1056c238-d46a-4654-a617-5d510ae1f69a", "comment": "Malware payload (PhantomStealer)", "value": "fab65e0d9b5344aa44f1980b5c6b7bb9f553202a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939281, "uuid": "4c4941ab-6f29-426a-a996-830669f772bd", "comment": "Malware payload (PhantomStealer)", "value": "f38f041327685e32cc3838538ed96ff5012aaf418971bb93805728b6c96e26a7523b483fb5ad9bcac3bbca7119f1df23", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939281, "uuid": "d65595c0-4ed2-43f0-aaa1-2c6b29eb101c", "value": "T1D07512009AB46842487710862E51BBDBCA601EE27CD5BFF9F2B7309E17359685C2DDF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939281, "uuid": "55ce6aee-16f6-4c5f-b3f1-09dfefe1da16", "value": "768:WZV16kkgMZkW9PKy+NqU+NIGY6l6w+NqA+WqEZlMwV6ycXn8kyZSl6oIg+pg/KxZ:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774939281, "uuid": "53bbabe3-d0e7-47b8-afdf-22a4d24a78a2", "value": 1688852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774939281, "uuid": "8738bb05-25ba-4658-b64e-b763816d2e31", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939281, "uuid": "36811ac7-b17c-464f-afc0-3c0afb9dee3e", "value": "eInvoicing_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151fe3d8-2d05-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774963527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963527, "uuid": "88be949a-1971-4357-b237-2e47f4b264af", "comment": "Malware payload (Vidar)", "value": "fb67d796202ea6bb8178e48ded107469", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963527, "uuid": "e7108423-43a3-4531-88fb-e33a3a321cfc", "comment": "Malware payload (Vidar)", "value": "3b69cb71bc5f350af14b40ea14de18df6c3913223054bae2c6936462a5e49465", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963527, "uuid": "953b902e-b67a-4265-a545-bb9142b47faa", "comment": "Malware payload (Vidar)", "value": "c3007c010b2814cf898a58f78e690409221ec6b0", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963527, "uuid": "597761bb-6c6e-4c39-a85d-fa87328b758f", "comment": "Malware payload (Vidar)", "value": "7a96f120cf2ffdbd7d9cf1b151272fee8d3876d40227b352bf2101c85693d2b6e6a8c5cb10b63b5df1a82b343de4041c", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963527, "uuid": "fa2a96f0-8c0d-4ec8-a53e-3a84d03d59ef", "value": "T149A57B0B7CE105BAC46A633289F252927A76FC590B3223D72A90B37C3FB66D05D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963527, "uuid": "bf780423-d93a-41f5-9c37-28d23192fe72", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963527, "uuid": "a81403e4-f64e-49f2-a59d-8411e9217e60", "value": "24576:UNWebE4uRVj2DqJN8H0FmYuFwRhWRzR1TOQsnLtGEDXT4K:U4ew4u+sGHjPqhWR7TOQa5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963527, "uuid": "fa86a89a-d506-4cb1-96c6-2ad0b0ea8c4a", "value": 2072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963527, "uuid": "2aaf5ae5-4848-4dbf-968c-dc09b1aeb370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963527, "uuid": "3820f7c1-d93b-4a2b-9231-7ea1527d335f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bed50b6-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774960640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960640, "uuid": "fe12e984-c0ff-4a40-a286-8dd7b675642f", "comment": "Malware payload (ConnectWise)", "value": "f62f8033c0fdc9a88cc17ffa6eafe3fd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960640, "uuid": "0e67ea8c-fdd9-457d-aa78-64c2107562da", "comment": "Malware payload (ConnectWise)", "value": "3b8800abc7cef4f366cd141cb5cf1a12958747512dc0e6f25f885e71b6d02404", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960640, "uuid": "384367ab-abea-4b06-b7c3-243183209bab", "comment": "Malware payload (ConnectWise)", "value": "bb0749d0ccffafae572f731bb9177a3aec8d779e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960640, "uuid": "267834a5-9b88-481a-a3a3-a052d8a3f3ee", "comment": "Malware payload (ConnectWise)", "value": "943a26b2dc113f40266eb86d2bbbc3558af345f4e34b697c72cdbc7a9457820df47110690608fd05e08ad0e56a03ab91", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960640, "uuid": "f096e540-b052-43cd-8b4e-8d8f84ccf4ae", "value": "T13D2723017BC6AAA7D43F0635987A632067B4BC414F13C36F66A47A3D1D327C06E727A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960640, "uuid": "45afb595-7f2f-4199-bb4e-2dfa77bbb0f6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960640, "uuid": "c188df3d-8fc8-4b31-b0c8-39a1e32f371e", "value": "393216:/h7OvTi7hha6273N119OvTi7hha62rOvTi7hha62UOvTi7hha62u:/h7Ovj73719OvjrOvjUOvju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960640, "uuid": "2d5b7294-4ded-4e3d-b19e-da8b55ddc1b0", "value": 20511288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960640, "uuid": "e37cec2d-10de-4f87-9a41-b504ad4ba9c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960640, "uuid": "3851c471-ef85-4ea6-98d8-d9fefd6bfc92", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5630a1-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979642, "uuid": "867c731c-ec61-48a4-b52a-46b15225f9d8", "comment": "Malware payload", "value": "50fe07b27017e65e0a2639150e554c97", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979642, "uuid": "d238e674-16b5-4eee-b739-105ef90be7fa", "comment": "Malware payload", "value": "3bc36b9b7bc5ee73b26dd94d34a31cb707feb9a68d2e4832d276e9274e780a34", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979642, "uuid": "a9a1a894-80b7-4952-a6e5-1b67f7c07958", "comment": "Malware payload", "value": "a193f316797faf32b24c925c9f79d4661451d78a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979642, "uuid": "775b634d-0e11-4d89-a76d-f75a5476106f", "comment": "Malware payload", "value": "26f1a7f9854bb1d798772d8b250d12856a1038c4a0f42aead7fb84ab6dda1a8d2f641d47b470dc27634de7c4d09889ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979642, "uuid": "caf7331b-4028-491f-9cff-a8e3200b7d37", "value": "T19AF63363C26DA4C3DD32A37829F6C70BB61FD5A52771AB4E1F3AE5886C66090430B71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979642, "uuid": "1af2972e-330e-4c8a-b583-c036e4b43e93", "value": "393216:BXmcBVFq2lCklve8n2DfkkY3ucN6ON2LcIugmgnhYzk4LJrv:oc9q2lGfDfkNuc8/Zugmghy1VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979642, "uuid": "48d6ec62-1b4c-442c-a4a3-85eb9f14ec2b", "value": 16683329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979642, "uuid": "05670884-ef78-42c5-a132-63156be7728c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979642, "uuid": "c712e67d-e699-45ab-899a-94c08c2602e4", "value": "1Mar23MA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed76abfa-2cd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774941556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941556, "uuid": "6356c9a6-6042-4edd-9918-6bf5eb30fe90", "comment": "Malware payload", "value": "f376c2aaa65248cbfd9bac115a48ec6f", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941556, "uuid": "345c4f7e-49fd-43c8-bc73-338d2fbb8e26", "comment": "Malware payload", "value": "3bfc93e71eb756132354b4a58f2c505e708963fdf5d466b978d12fafcecd3af8", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941556, "uuid": "4b1cd206-726d-4ec8-a4f0-6c509888e77e", "comment": "Malware payload", "value": "23e9742d5fd51e7d3fdc4a508e239531b39fd250", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941556, "uuid": "184864f5-47c5-4276-a3cc-6fdb50709c49", "comment": "Malware payload", "value": "3a930878c0ca2058038c066f73448841aa01d9316c0f20083b1a810e8353a925f60afab3ae792a8e68eeac8848ff0a71", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941556, "uuid": "10135386-4a0b-4dd7-b952-fa4b5b563c25", "value": "T1E643572479BA5009D537FF713EECBAEEDCDF26226906545B104603078A22AD0EF5397E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941556, "uuid": "46152fb6-7846-4455-9cd1-393ecaa91461", "value": "768:INK/eHJ08zlO8epBuv2rxBTudHhbzv+mQIII1ta6iN+1kSMKZIrA7AD6E2mGdlfa:INCeHe8epb+u6lPh12KZNAePff2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774941556, "uuid": "31c136bd-7d68-4307-a879-2f5d321df619", "value": 56282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774941556, "uuid": "1001431a-a681-4ff7-92ce-2a733b835d1f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941556, "uuid": "27c911ef-35be-40ef-aa17-4a894470ba6c", "value": "3bfc93e71eb756132354b4a58f2c505e708963fdf5d466b978d12fafcecd3af8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94294fc3-2ce6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774950426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774950426, "uuid": "0f58e3ed-e218-48ed-a549-9d47efaf6839", "comment": "Malware payload", "value": "e673926b85f2e80649b70ab2bb0a3e6d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774950426, "uuid": "c18dc286-6ade-4468-b750-43bf2c4af11b", "comment": "Malware payload", "value": "3c03f964492dbdcfdbf1fe7b4cfc990fecb5e5e71bfdb578f66ad36dc4adea0d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774950426, "uuid": "dd4b5329-d62c-4850-b7d5-04accfedcd06", "comment": "Malware payload", "value": "32957c0d3a42d872d4d38487d0e9b6fd05c1039a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774950426, "uuid": "b4ccf8a1-362f-4b60-831e-e1559b0303ef", "comment": "Malware payload", "value": "d942e6f56f35bc2e31e1a73a03ebcd3ae7f438a651ac850c6e77626d2145895e5604d2fd9a1fdfad4a1c58f40fd3f80e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774950426, "uuid": "a4058dd4-1b70-4dd4-98a5-e4cd757cd8f5", "value": "T12941CB0527F45728E6F38B3DAABA62229572FC14DE25CE4E0160804D58B2711D975F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774950426, "uuid": "8f4cd940-50f1-4e94-99f9-f7af6065195b", "value": "48:8hCvVeTrRsUo4NkSLS+l1+e0CyjMWBnSrjOZpab7:8hCvozoIuyYe0C0MWB4jOZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774950426, "uuid": "9d8c7932-b164-4fc1-a7a3-1bdfa9860fa6", "value": 2187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774950426, "uuid": "4b01a8c0-142a-4d07-8493-d9ef0f82d43e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774950426, "uuid": "65e5a45b-a7fa-45b7-83cb-1183234be60b", "value": "FURUKAWA FITEL-ARTWORK PROJECT DESIGNE SAMPLERS 3-30-2026.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d783eb-2d12-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774969355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969355, "uuid": "e057e3a7-4fe4-436a-89ea-9057dc10ada3", "comment": "Malware payload (AsyncRAT)", "value": "5781affc3e9f082793afb33130433042", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969355, "uuid": "da0568d2-c608-40bb-829e-4405d3a6039a", "comment": "Malware payload (AsyncRAT)", "value": "3c25e70be79c3f4728f257f560a9499f01a42f42d976da4f120f0eec0e9d1309", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969355, "uuid": "8536aca1-dcf6-4930-95ee-ec99ec2da643", "comment": "Malware payload (AsyncRAT)", "value": "3d2c2d59d20aa97ecf17038200deaa14eba2d0b9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969355, "uuid": "b1a6de55-7c27-4599-b0e2-0ccd0d3bd465", "comment": "Malware payload (AsyncRAT)", "value": "4e708605e9444e9bc7958400bb3fcf50b3520477dcb269f2a1739234375524ac51c816427060f8750f84f0fe1e3a0594", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969355, "uuid": "0e5ee9b9-89af-4ca6-bdb9-c3768c988feb", "value": "T10123D037F7C35200862F855BC460DE47378A8FE70B1D8AA9E27A55A3C496F85940CFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969355, "uuid": "0981132c-7893-407e-9c40-4402e6995cfa", "value": "768:Mb3/4lrwxicMmcZyIa9lHVUuadeHVClAQun54bET7PBqGkYO8u6VMQddlLh23/oB:FlkL1cZyXuuas1MA3YEXkYVXLbEPiHxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774969355, "uuid": "9f036fd0-9e18-4cc8-b5a0-492bd5d0ea09", "value": 47954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774969355, "uuid": "dd993cec-a7c6-4d4a-8335-202b1a0f155f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969355, "uuid": "eee1cbeb-e680-4820-81ca-68755f50113a", "value": "disqxgklpypl.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f78806-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959287, "uuid": "0b4a28ea-a7e7-44f7-8bc5-96e0b50a8ca1", "comment": "Malware payload (Mirai)", "value": "00de94cb911eccf096e190ef7fe9cb08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959287, "uuid": "5343eb21-29c5-4306-8098-829b2fab1d69", "comment": "Malware payload (Mirai)", "value": "3c355ade076646af7e12f9ab9cdfe483abeb56b5bc416d3c45c567ab06547467", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959287, "uuid": "1b3b82b1-96c2-44c7-8d2f-5d5b55de8a4c", "comment": "Malware payload (Mirai)", "value": "d87c1b8fbd1de6e673cf7d1c421ca47bf0aa6816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959287, "uuid": "58d7fc99-6a53-48f4-ba97-3bf421414d16", "comment": "Malware payload (Mirai)", "value": "659f5496c795da5a2de5e30b3cb35e998fc9ceafaab90ca737bcb561f9af9be22942c0da33f52525dca70a08ca8ba41e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959287, "uuid": "6080bb91-f7ce-42d3-ac54-6fb0ea03b688", "value": "T132532AC4F653E8F4EC0606742036FB379B73F1B7622DD943DBA59A63AC41B41D406AA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959287, "uuid": "00a728dd-57a6-4b31-80e9-59d9cca368c2", "value": "1536:KbjRYRbjfyJn4Ud+6PolEzgpiAgMKlGl8+DJzTZR7wJKV1s0+c3wwxYuBGFJ:ajKRb7yJn4Ud+6AlEzgpN3l8KJPZR7wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959287, "uuid": "36853da6-aef1-40b5-8968-5f17a65ad9f5", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959287, "uuid": "39410aa7-84b2-4391-811e-36959dcd6c4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959287, "uuid": "58f923aa-67ca-4921-923c-2843f3c4e11f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef73a6cd-2d11-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774969048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969048, "uuid": "2b66ac14-3d06-4813-b43d-51109b2d345d", "comment": "Malware payload (LummaStealer)", "value": "734180c91b9561d1ff75c3b0633d06af", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969048, "uuid": "0ba88aa2-8233-4ffe-8c86-b5ec5b34be83", "comment": "Malware payload (LummaStealer)", "value": "3d9c9be6ebf52a46fe919cdbfdba0562e7d7591956c0d92482e8679ea439929d", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969048, "uuid": "f3e2e625-efc0-4886-8cb8-3d9413697b84", "comment": "Malware payload (LummaStealer)", "value": "cf7a1d069fcb03397b63a2495fe457d874b5733b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969048, "uuid": "6531eaef-5c52-44cd-b89e-ab658c3aa552", "comment": "Malware payload (LummaStealer)", "value": "22cd5bdd4ff73c86fb2c259a88f909f9a9ea24982e3080100ba400473911f4268fec2a40c279741224c78a564621ce7b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969048, "uuid": "ade53de7-6585-4026-85de-d05c46f09b40", "value": "T1E5655B51FED744F6E416173249FB62EF233699090F329BC7EA407A39BAB72D10922351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969048, "uuid": "1b177edc-9ebf-48e6-ab75-37021a3572e9", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969048, "uuid": "98133bed-5506-4006-a0a5-d120dea114a4", "value": "24576:c8K1gWiDJrQvLhtjtIAVsoZGEd8DhBOBF42KhFHVZyMlQ/pTkIHWNWG:cvgY5H+a85lwpAEWNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774969048, "uuid": "118a67fa-77f5-4ed2-b159-6442d68efd8e", "value": 1473664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774969048, "uuid": "e30ae526-e699-46ba-83e2-87ee569a6735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969048, "uuid": "73350c87-f4fc-46af-a861-01b8358ee99b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1883ee7-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959575, "uuid": "18c92ff8-2d78-4e8d-9042-bf002f8db069", "comment": "Malware payload (Mirai)", "value": "3f15bcb05a8d4931c72cfe5d06eebbd4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959575, "uuid": "61f13aa5-8b23-40ec-9187-3274c95b51c1", "comment": "Malware payload (Mirai)", "value": "3f064c305e1210001e661ebc6154f3f4f71a1de02a495a70bb266cdb50997377", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959575, "uuid": "6c272e8b-5c69-4c9f-9fad-0546e4f025dd", "comment": "Malware payload (Mirai)", "value": "0f4b962c527e1f6e8e657d8f27c1153e56d232a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959575, "uuid": "f38fc1c1-5118-47a4-be85-d7fdebd19948", "comment": "Malware payload (Mirai)", "value": "0a8e7e2dbbe82ee7bc7243c5bc7a063cd347b783e47f73410ea29c6ea387bcca0fd04f8b34bb33a8211447b05af91c4f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959575, "uuid": "c2a9b348-0e9b-453c-b0b3-6195ec6bd692", "value": "T187B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959575, "uuid": "2180f1cd-651c-4a00-8046-8d6446c4ceab", "value": "1536:57jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxr:1zPqF41OUBljSIxecUtCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959575, "uuid": "262623ca-2ba5-4b96-b918-f6a02533337f", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959575, "uuid": "0ff3153c-1746-4646-ba1d-dcb42522a6de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959575, "uuid": "9cf13a5a-a9eb-4477-875d-152d8aab91b2", "value": "boatnet.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047d1730-2cd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774941595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941595, "uuid": "f10d4942-a5fd-4924-9800-13a658b0e11a", "comment": "Malware payload", "value": "5b8414d9c4bc69222d099e523c999ec9", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941595, "uuid": "d9c30f23-2a91-4fc2-b560-617888240a5a", "comment": "Malware payload", "value": "3f4496da61c2f0c4198caa6d81ba40325717f02e5925993b4d1cb7f93623406b", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941595, "uuid": "3850423f-3ed6-4326-9fe5-8e7d74e3e8ff", "comment": "Malware payload", "value": "1116eb28a920297411742bbee46907a7304dba4a", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941595, "uuid": "f6a38fcf-0253-480f-91c3-7574b41f51c4", "comment": "Malware payload", "value": "82896ea00898dac05671dec892c36c31e264668bc485facb9168a1e63e8fa45bd79404113a8241687e491d33e78380d9", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941595, "uuid": "d3f0de52-47f3-4698-b1c1-c22994f948e5", "value": "T1F062D02B945E5D761F4191BBD15F0E8E1B7405665E56BF4F82E8CC033D883F608D4AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941595, "uuid": "56671151-b2f9-4ce6-93e7-dedad2a0bec6", "value": "192:mASYDXRcGcvqYMyltX2361riXt+uMozbSmJFc4RddUsYjBNdIgLGwvHjd2bJbX:mAp+GcvLD236wXJbSQ9RdXojG5uH8FbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774941595, "uuid": "ea01e909-76af-459f-8933-56bbae0b26d1", "value": 14984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774941595, "uuid": "870e9d9b-d63f-47a9-8ae0-52f64dae3f18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941595, "uuid": "f216a384-b3f3-40aa-bec0-2555403bb651", "value": "3f4496da61c2f0c4198caa6d81ba40325717f02e5925993b4d1cb7f93623406b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117aeb32-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959226, "uuid": "bcfd929e-d8fe-41ee-b532-b62d3b981bdc", "comment": "Malware payload (Mirai)", "value": "26ead3fb6e79060c84225282f3955ed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959226, "uuid": "05b69ebf-038b-44cc-a63e-7b3f1e8b6cc1", "comment": "Malware payload (Mirai)", "value": "3f750c432ed949f91127d1332aa3a51d0d11a1f79fdf545768bc2cf0db749088", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959226, "uuid": "3dc38519-54ca-41f1-94e5-3e6013b3c2d1", "comment": "Malware payload (Mirai)", "value": "036dd34089cdfac7179efab032ee0448882fd2d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959226, "uuid": "58374b21-ff71-4960-9fe6-19c25574707f", "comment": "Malware payload (Mirai)", "value": "81d58ef8c5d2895b523aa6b80e0bb835d1dad0e05d97c2378430ec07a936224c5c70845340dc8ba75e254c985561ca5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959226, "uuid": "d7c69272-1bb9-42c1-a027-4a0546cb5028", "value": "T1FAE34B42FA814A13C0D517BAF5BF028E3321A79693DB731699149FB43F86B6F0D63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959226, "uuid": "a7577932-b514-403b-8ab2-20313873317e", "value": "3072:AizAtFdOMoiZvcIQtIN31R3Vsdia/v+nAvTGnKOetM/9jM2B:AizAtFdOMoiZEIQtIN3n3VsdiaX+neql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959226, "uuid": "ef622c97-efcd-4102-b738-0c6bb92022ac", "value": 151747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959226, "uuid": "144fede1-3e5e-46be-acfb-cdba06cf7962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959226, "uuid": "2ddfc154-c59b-4ad9-b838-98a41aca5b6e", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8db40d1-2d06-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774964258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964258, "uuid": "2d3987ac-c676-48be-b0c3-82bbbb18643e", "comment": "Malware payload (Vidar)", "value": "ac155f50acf249e70c9f9255560cd83e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964258, "uuid": "585c1db8-c889-49a1-8301-c8623dcfee30", "comment": "Malware payload (Vidar)", "value": "3fc853c206881f278a245e00d27e8d4c3fd3f9a94967513ca7e02f639f8c150a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964258, "uuid": "5b51542a-fb39-4a98-a61b-676c8c1cf175", "comment": "Malware payload (Vidar)", "value": "ba97b3541df7ed949a4524ab3657eabc2fcfa4b3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964258, "uuid": "d9e4b65f-f8ec-4bbe-af32-a55869bf93f4", "comment": "Malware payload (Vidar)", "value": "fc72be85c3efc58d03f0b5aab9f8bf509a367a26ae2b6fc7d4861ef2b450e6e4822c25e5bde92a6416c5bdaaad66ec17", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964258, "uuid": "60aa8a8e-b53a-40ec-a479-c4125c1bdbad", "value": "T12A358E3ABF9F49EED81CF27D4082D097CEE09A1C629845DE5BE0311BDC79DB219B8146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964258, "uuid": "493a881e-2d9d-4ad7-9286-76785aa6ea6e", "value": "9b41fbb4f681bd50e69d6f0a1ba2802c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964258, "uuid": "13f08cd5-a540-4c71-ac29-6fbb1b737fc6", "value": "24576:GpFU1plxNK1jrYlP4lRBwF0jlOXegLQQuz53SbCJJBmn/ymnmhHGvgGszmeQPAPu:C8sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774964258, "uuid": "cd7a3c86-1cc3-4d5d-9505-42394f8434b4", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774964258, "uuid": "54094c95-7026-462e-ad08-2672e00f59d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964258, "uuid": "523fdf79-b64d-4ef0-a0de-20723b99b7e8", "value": "cmutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a4e9b2-2cd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774942125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942125, "uuid": "8b876f85-bd6c-4252-a812-2638229475d9", "comment": "Malware payload", "value": "ec5feaf68695c6cb51efbf737a240f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942125, "uuid": "ed3a430f-926b-4e62-9a20-3971b973c963", "comment": "Malware payload", "value": "41a99b0b2be00bc85f875c310dea544492e54889414c8c45b951d3dbdd58c270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942125, "uuid": "864e1aa2-4d7a-47f0-97e5-9ce22721f702", "comment": "Malware payload", "value": "efd58a42ed9e121476535e91df59543464d6d067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942125, "uuid": "f596abd2-85bd-4514-aa44-718ea4182900", "comment": "Malware payload", "value": "c3480906da54293bd6b05b6e03a23b85eddc1b9dad8c48a0e257757584f6d1e43f581e5a74d2690cefdc9fc11af2d955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942125, "uuid": "8fb7b09e-dbe5-4812-bcc7-511969abc65e", "value": "T1EDB23E01BBE80518F6FF5F3659B52A904A77BC9A2E35C55E0D42418E0C75BA0DEA0F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942125, "uuid": "5c54ac53-cade-4293-80dd-e0987fa3db19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942125, "uuid": "1e0ec8fe-35f3-413b-8674-8f38be53dc62", "value": "384:T6aYyubblBlG0HIgyvdYR8AlaUL5yfgxDYOXD8acwS4L6:ivb1GWIgy6RTFNDYOXD8am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774942125, "uuid": "f9f8fdd4-bf47-4cc2-876d-340e53357016", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774942125, "uuid": "53cc4b83-1123-4fd7-b921-46711539dbc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942125, "uuid": "8c5cadaf-0683-4794-a431-6a2f2dc22523", "value": "41a99b0b2be00bc85f875c310dea544492e54889414c8c45b951d3dbdd58c270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9dc52e-2cef-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774954470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954470, "uuid": "54db5f75-0d7a-4978-95bc-6ca41bfdc13f", "comment": "Malware payload (PhantomStealer)", "value": "0433bfd3ddaf58718bc4227be3b53f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954470, "uuid": "cf5c8692-6bfa-4c42-8a70-998a3fc4c33b", "comment": "Malware payload (PhantomStealer)", "value": "4286b1ef315edf02bbde5ffc281362ae96d2d8b73b62d06ed878bc0d8fef10fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954470, "uuid": "6d63b916-53e7-4864-b0db-d0a31f58e68c", "comment": "Malware payload (PhantomStealer)", "value": "cc1d4292c38c537e21d1dd77a9a21242169d1e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954470, "uuid": "1c77cd47-3aa7-4ac7-8645-a579667ddb2e", "comment": "Malware payload (PhantomStealer)", "value": "1cddee142cd4a6b8aec1bc9bf01f2d79ed09e18b20dbfc32582cf599a660346452de1e52123e2f63a149cfada624cf8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954470, "uuid": "d4401fcf-ffab-408f-973a-c01b3d6dd76e", "value": "T11726021189C42FB4CFAC571D80FE1A1EA3F14ACE512AB989EB33BD46BFE7504510B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954470, "uuid": "f5d257e6-3cb0-47fb-9d42-ceb0d46dcf88", "value": "49152:h0jv/fMioHmZLFzb+9BaTtR29W/LhB9W6TdQCclZ8D0Rs7MDjB:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954470, "uuid": "ae3ca449-9393-41ef-a14f-081049846648", "value": 4688456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954470, "uuid": "8d3ac9ec-d4f5-44a5-bcc6-bfaa63425366", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954470, "uuid": "10a99212-5d45-4382-affa-f982e555985a", "value": "V.18002 M.STAR - 1ST HIRE INVOICE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d0e4b8-2d22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774976200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976200, "uuid": "95f288a4-0a42-4112-9cb1-d1e777934b31", "comment": "Malware payload", "value": "b83c970bb871b56ed6746c757700d92e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trueconf_windows_client", "colour": "#63AB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976200, "uuid": "14738d26-538f-4e11-99e5-a3752d3e6e89", "comment": "Malware payload", "value": "42ba749a7b51f55bcf19bb425999c0848ad100c37e2494fb7ce44a18642ebf72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trueconf_windows_client", "colour": "#63AB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976200, "uuid": "0c8b0ecc-07c5-4a49-91e9-d88af07ed55d", "comment": "Malware payload", "value": "379adc33d73ff00b7e10cd0956c5e1d31724020f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trueconf_windows_client", "colour": "#63AB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976200, "uuid": "49fa9a38-cbaa-4693-8fd5-e048ad19d2b8", "comment": "Malware payload", "value": "4b66849322e4fa389c5326c3efe5c8f7b85ab8a4149fe63421d8c56505ce918b23afcce363f8de88611bf94a4a97e9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trueconf_windows_client", "colour": "#63AB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976200, "uuid": "312a7e48-6ea5-46ec-92d2-bf515e1e3316", "value": "T1F5469DA9B6BC0066E87A81BDC2975227D772B41513B05BCF2AA496F90F63FD0177B700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976200, "uuid": "b2eac95f-822c-4749-98c6-7292baa99c3c", "value": "28e9237c435054e1a5bdc65244da2320", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976200, "uuid": "cf4d760d-4288-40ae-a64d-33b4c2ff5bef", "value": "49152:IDXh7zAWPDZNGtlqPuIU6iy7VwASOS8mFfb9U0HXqxm44+3vxCuAFz0pbDnRYzkz:MoAP+yGPbFemUpiz4FYzW2GInOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774976200, "uuid": "f92c087b-1733-4349-9414-819d15ecb755", "value": 5504512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774976200, "uuid": "936c00b5-e028-43b8-b3b6-ec54d2274cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976200, "uuid": "fb1f5938-30a7-4bb9-8a41-059b3157cbfe", "value": "42ba749a7b51f55bcf19bb425999c0848ad100c37e2494fb7ce44a18642ebf72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51c27b5-2d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774965970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774965970, "uuid": "7325bdb3-d39d-43c5-8fb9-67b1f50f4f85", "comment": "Malware payload (PhantomStealer)", "value": "d58c7640c6b26aa2a33690f8f4812e73", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774965970, "uuid": "34115376-0ca6-4286-b789-b58d7543d33d", "comment": "Malware payload (PhantomStealer)", "value": "42baa3989be154fa6628de08549d127bfa94531e13b9bb103d3bc9244a6038bf", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774965970, "uuid": "de788c3d-b509-4709-8543-c86cc20b21f2", "comment": "Malware payload (PhantomStealer)", "value": "b122109db0cdf4215a3d77ed328fb6fffe95ad2a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774965970, "uuid": "00e494d9-41bf-42fe-9057-fe76e92f98f3", "comment": "Malware payload (PhantomStealer)", "value": "61e3b3e9258076364ebee508cdedb5c2c3eceee5a5d748141e1be8643fe08d38366ef219fc07786bb81abd8206e8d9de", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774965970, "uuid": "db78bc3b-9d9c-4ba9-9718-49eb07fc54f0", "value": "T148420EBDC5E1BCC04B9B72D2799EFBC100AE9707B96B1B5CF9DC14510B41698EBB8188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774965970, "uuid": "31c6e142-03db-450a-974f-1bd177d17269", "value": "384:LQDT5a+k5JYLOCi+V1FaeaBeflDyqmxu7UP+F+unqKDcIYBmc1KzaHn:cDTqJNCi+jFNfAlPUrgXBX17Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774965970, "uuid": "26dca93f-3aca-4c50-a38e-09b9d5f53422", "value": 12700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774965970, "uuid": "c52af7a6-4d8b-4f9a-80a5-b43a83c80291", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774965970, "uuid": "0be181b2-017d-4b3c-aaec-cdff15a41f6e", "value": "Order873126 - Ersatzteile f\u00fcr Hydraulik - REGO X-Ray GmbH.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446bb1bd-2cd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774942132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942132, "uuid": "f9c3e4f4-e065-423e-afc3-d787dce1efc3", "comment": "Malware payload", "value": "b6ee02475035a14c7d52254737f53a03", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942132, "uuid": "0c6fb319-011d-46ec-b53a-7c96d4722eef", "comment": "Malware payload", "value": "4317af6f48b13a88f051d15a39d77d0a9f280027ff3a6c50e79a19a8320f5e06", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942132, "uuid": "9090d4e9-e68e-4319-8c46-4b179e524659", "comment": "Malware payload", "value": "89b0630e068b80a7c012c5f374063814f4e30d0d", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942132, "uuid": "fcce2b63-5269-4073-8d42-7b9feaafa43b", "comment": "Malware payload", "value": "aaca8730dc89bf46c465e2c477aaf054db5669628f113bceea5e67bb48ea633794f0cd313340e82b8d50b2759e35eef2", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942132, "uuid": "4e042d3c-df91-42d7-ba39-cc4161b3a211", "value": "T1585108102DFF01CCF177DB355BECBAF7486AF4459D2E65F8118196441B21A80D872E7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942132, "uuid": "fb9e0314-5325-41a4-9df7-d5c29251b2fe", "value": "48:8B5aQwGUrg5pl0iXt7wZ9aEyUYAnhP7jb9T8bs6YxS6BRa:8B5vzogXlzt7wXyUYGbZ8bvkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774942132, "uuid": "b872fb9d-ceea-4ff0-a3bc-621ddb214df6", "value": 2858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774942132, "uuid": "e321f4c6-06d8-45fb-a0d5-643df49238fb", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942132, "uuid": "149a86b0-c496-4591-a99a-e50dd3f7b405", "value": "4317af6f48b13a88f051d15a39d77d0a9f280027ff3a6c50e79a19a8320f5e06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e0bcf8-2cf1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774955069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955069, "uuid": "4504cb6b-9e59-4b26-8391-e39d697ea9bc", "comment": "Malware payload", "value": "a2acfbec2c64fa907dafba6f78eee486", "object_relation": "md5", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "va-py", "colour": "#F5B9B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955069, "uuid": "8791860d-1f54-4768-9c17-2c27749ddfbb", "comment": "Malware payload", "value": "43803cc53793743147d0606bb77312dd734706224f23df8720fb8f26e021f879", "object_relation": "sha256", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "va-py", "colour": "#F5B9B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955069, "uuid": "0aea1d00-76f5-41aa-bc6e-7e0c6d224a12", "comment": "Malware payload", "value": "f60fb3e475075ed7facfeb4c05cc0f5aa354eb77", "object_relation": "sha1", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "va-py", "colour": "#F5B9B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955069, "uuid": "9a2d3b17-79cb-42e8-8378-985010b4d70b", "comment": "Malware payload", "value": "c5e099196d1be3bd36924985501073dae770b84a231c7ea21c78064641a3324f6f6a0c3e0620f625d20c0c03ddc0d4b9", "object_relation": "sha3-384", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "va-py", "colour": "#F5B9B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955069, "uuid": "a4350f15-0631-409e-a1ed-ede051dde23c", "value": "T156917C822B457C6AFF92C1306145A2AE0C8F821A4A71EEBFA689A43026F65D82C4CD54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955069, "uuid": "8b32b4ed-ba96-421b-9ab5-b1b6ce6c73ba", "value": "96:mdHMeMRMIz8jsD8hJp4TkLV4UBlemL67JlTU6HeOVhQDeQ1S3wfrcfK:72qD8hJGTuVXBlemClE3U3WrcfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774955069, "uuid": "04ffcd37-3d5a-46e0-8ff9-6d9692945929", "value": 4554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774955069, "uuid": "a8be893b-909d-4e6a-81f5-f5c1a1868edb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955069, "uuid": "9e351060-48b0-4cc6-9a94-5c40784b4d15", "value": "va.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec7eca6-2d28-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774978898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978898, "uuid": "82d220aa-620d-4d08-94ee-3e64ada2ee9d", "comment": "Malware payload (SalatStealer)", "value": "ca50db414d1fce1aae7e7e9694d56d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978898, "uuid": "e8880496-818e-46cf-823c-387ee698263d", "comment": "Malware payload (SalatStealer)", "value": "43c247ea7d659e268bf7dcd0b3b1a9bf23bb86607b08506f5404b656e78109b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978898, "uuid": "7cdb5c43-9f2a-44a5-a44b-f5d00a2ee912", "comment": "Malware payload (SalatStealer)", "value": "68fed05a1b46813ab34af4dbcfe61767fec4a54c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978898, "uuid": "6ab9ffcd-0c77-4f70-b784-3b96396634a7", "comment": "Malware payload (SalatStealer)", "value": "c6f6ecde8ef10761ff399da85873b806ebe171fb111259d3ae5ec7e15feae1023a03dbdf0540fe0388394fe9e3f2a78c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978898, "uuid": "1a50842d-eeb1-4f13-bd7d-d032e010c753", "value": "T1C8F53395D4C91A86F04A04B4D99AB0785E3998E74D8D7D2FAC34090D29C3F4E76E83BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978898, "uuid": "8020dfd6-4ddc-447e-aac1-40f64c54f104", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978898, "uuid": "ef0d03d4-8d8d-4b04-a86d-0ef6a38a54f1", "value": "98304:p8yMvbviYNbeXpSFUMfUAL+YeIltZrtJl6p2IonUx:p8yMvj3p9flBPltZrtg2BU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774978898, "uuid": "da77dffe-2c93-4ddf-ac54-9f8705939218", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774978898, "uuid": "270e7618-741e-4886-918e-318d7e0a1cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978898, "uuid": "09be1b8d-0fb5-4e17-b9fc-6a4700cfc52b", "value": "memesense.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04650d27-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774989269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989269, "uuid": "a296e5c6-7e83-402d-aa7b-2b6648a35d3e", "comment": "Malware payload (Mirai)", "value": "1bd6c79bcbc205fca275a61b247cca2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989269, "uuid": "5c3cac4d-da0a-4ac7-bd93-b346bfadf0cc", "comment": "Malware payload (Mirai)", "value": "43c93faec75852d3f1882f7a4f32571bfcb0687dd01965493b2deedd7d81b1f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989269, "uuid": "144aee95-0e87-4464-abc5-0d2fec28643d", "comment": "Malware payload (Mirai)", "value": "c0afca64d05d876d8f584e7c07359c561a9225d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989269, "uuid": "7c2080f4-e771-4847-a394-c5c90b2866c0", "comment": "Malware payload (Mirai)", "value": "88fdc8f21acc04d2555bc23094627242c78a63a2ea7c59c19fa83588264420a8cdd9edcce130f85ecb5c17c4e5fb6d38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989269, "uuid": "85e5d4a0-e24c-4c60-95b7-9cd7f8aef56a", "value": "T1D743970E2E258FACFBAD863547B79F24964833D627B1C584E16CE9001EB034D745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989269, "uuid": "876a8dda-41ca-44e0-ab3c-3322b6d197ce", "value": "1536:ub+kUPQupLfsLfCELfZQ5mREATMNEugjYeV:a+kUP1r7NEusYeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989269, "uuid": "507dfe08-ce82-40ca-b80a-e97abfabca6e", "value": 60232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989269, "uuid": "6fe86255-401a-4829-b812-1d445ff3a5e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989269, "uuid": "a4a9821e-b825-4ea9-8ed6-2293b7d6777d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4f2f82-2d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774993415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774993415, "uuid": "49010aaa-5fec-4772-bcbc-642bad94a1c8", "comment": "Malware payload (ConnectWise)", "value": "a3bfd1fc10dd31bfa61a3e3676c1ffb7", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774993415, "uuid": "509eded9-4f3e-441f-81eb-a8164cf64904", "comment": "Malware payload (ConnectWise)", "value": "44ba4692041bf139961ccc5f829111cc4bb7db32e8616630bf561a71256a84f7", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774993415, "uuid": "710c9584-e678-4ed5-aa7c-a0a358b2f394", "comment": "Malware payload (ConnectWise)", "value": "94bad920ac3dfe68e6ede2ef1cb96c13c8aacc39", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774993415, "uuid": "6eba82f1-ef90-411b-b0a1-a0ce86fa1749", "comment": "Malware payload (ConnectWise)", "value": "73edf76897073a04f56e12f684733e1e9100faf767bd0efa61ee99ccf3eb46afbeacd23f90c11afc331e291174fe1619", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774993415, "uuid": "f62faf65-a145-45ca-9d26-559b3d25c880", "value": "T18046F141B3D695B5D0BF0638D87A42666A34BC109712C7EF57E4BD292D32BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774993415, "uuid": "380fdf49-94e8-4d84-b938-a09e1dd2f5c6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774993415, "uuid": "7f33d53e-3da7-4128-bd5c-41f939f2e136", "value": "49152:/fmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:srs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774993415, "uuid": "183f013a-c38a-4db1-ba0e-d9aa419d2588", "value": 5670624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774993415, "uuid": "ba893e94-205d-4fd9-9af4-f8aaef02ab65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774993415, "uuid": "66ab424d-fe34-47e9-804f-c20ba7687fa5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523a007e-2d49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774992836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992836, "uuid": "30a96685-a232-4b46-a2a0-7d7815a6da9b", "comment": "Malware payload", "value": "93f2395dfa98e1d06e5fa7335438dffe", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992836, "uuid": "b8b343ac-df0e-4a01-b776-7b5164bab10f", "comment": "Malware payload", "value": "455bf1be7ee17e25e99054d04f83c512b1f4c886f3ce2868831b7c04d9635392", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992836, "uuid": "fffc591a-0b02-491b-8f46-5e5dabe1d224", "comment": "Malware payload", "value": "3d0851d1ab144cd688d3d880dce6e82af4f6005a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992836, "uuid": "143ee507-b294-4fb0-8576-1409f68ff3bc", "comment": "Malware payload", "value": "686bc71155e3ac549290f12ba5272573e77ea8e6ccbc11a53f311490c92b045fa1516b8fbb5d83ce86fcd5a721d44e01", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992836, "uuid": "a8726da9-a980-4070-9eb9-be72e43b390b", "value": "T1A90722C93742AA03EE675C395F57D3EDC22CEC86E920742B2324F38E127B9D29B55614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992836, "uuid": "947a2de4-732a-4a26-8bbf-0c6af45e885e", "value": "393216:qrxvVLPFthkMTHlnCDNdk1CcskTS+pjE8WKp6WuU:cTLllLCsTSg9WsbuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774992836, "uuid": "c24e4d71-be05-4ff9-b06f-ae71f8b37332", "value": 17272832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774992836, "uuid": "c4bac7af-f425-4701-b1b7-3d6b26ea02cf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992836, "uuid": "1fb67a6b-c527-494a-972b-f39ab5702634", "value": "Element 3D 2.2.3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036ecb4a-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959203, "uuid": "6e84b8fe-8682-4484-a4e3-3278f4c9a590", "comment": "Malware payload (Mirai)", "value": "58120ba940e70d27c8bc3d5ea74f0106", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959203, "uuid": "02f2e113-5bdb-46d8-bec5-3129febaded0", "comment": "Malware payload (Mirai)", "value": "45894380e529a897d0f9b04071efbec44d86940cef1923df015deedc350746e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959203, "uuid": "ca343410-8859-4ddc-918c-a68d3bbd34a5", "comment": "Malware payload (Mirai)", "value": "574f0a0620059bed145d5291f5469c3a829ed7f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959203, "uuid": "1259df3b-c994-48f5-8ac3-83a1f069074b", "comment": "Malware payload (Mirai)", "value": "e0dda5aeb89259e5ffc2cc8dfb2e086736a3891f1ce0cd4c0313f4de5095adf2bdb2bd7ec62b5ba0ac8919fba2c32094", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959203, "uuid": "2ad9e751-0e7e-4223-84c0-131f4d479c7f", "value": "T1CEC2D048170883DAD862C0F9A3A65F511EE51B63D562BC0B6E7CEB031FDA4913983AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959203, "uuid": "770ee60c-2fe9-490f-942f-c5a64b0396c8", "value": "768:Zz7bOFU3On/ObVfqtXIJgGlzDpbuR1JeeV:N7bD3OneVrVJuceV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959203, "uuid": "2d18a2ed-db94-4be8-a573-a6bb830c5178", "value": 27208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959203, "uuid": "f1a29b86-95fa-415c-bb28-ba7b2501f18e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959203, "uuid": "da95086a-9dd0-4e33-bd70-a86e1023f225", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe3f732-2d36-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774984940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984940, "uuid": "e892894a-a43b-4d6e-9e6c-04cb295e11a5", "comment": "Malware payload", "value": "2aaacf2249d005ec6ea169538d0f63ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984940, "uuid": "8fef6707-656e-41ad-866a-572bfadb6723", "comment": "Malware payload", "value": "46706ba670a5ff4bad4d772d15c207a9a6a7c8bdade84b5fc271151b4b97e68e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984940, "uuid": "66ef7e03-2c64-4507-bc4c-23f1b74385e8", "comment": "Malware payload", "value": "8be7a9fafa08b6fc8a1fb0754bcdd0b6743c8217", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984940, "uuid": "18e7e0f0-50e1-4ec4-bf4f-7bb88b18cfa8", "comment": "Malware payload", "value": "8dfe26d8adc627e53e1cadd1812140cec93220254725538b507d164ca3763d74c5975cedbc40e7695ae76b55ba6c1c55", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984940, "uuid": "1ec3661e-2a47-46f5-869d-ab70d132855a", "value": "T17C82080F7B8E6312D0B250B2D522467A8979947BFB8454EBFF904BDA06783D1A83315E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984940, "uuid": "fb24c709-092d-4fb0-a9ea-2264a3271ac8", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984940, "uuid": "5eccff1f-924d-4235-ac1f-bd0712593f1b", "value": "384:pIdV6DPxmET1QrHf2t9jZ+qav8U9cauS:xUi1QDfEVNa0UPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774984940, "uuid": "9cfc232d-d21d-48d3-b052-6de86a6267ad", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774984940, "uuid": "79450cc3-2676-4bc3-84a2-cc8512a19fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984940, "uuid": "f14ae41b-e92b-4e7c-a2fd-7ee32a1d3ad1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6a5f46-2d10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774968235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968235, "uuid": "46030ba2-c619-48e9-a2d0-9754705df071", "comment": "Malware payload", "value": "b70d2b470354bf71ff4b760e4fb50b48", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968235, "uuid": "388905e3-5cac-4445-9adb-764cf8d89d40", "comment": "Malware payload", "value": "46f5eea70d536f7affe40409d7aaa5fa0009f0dc4538ba2867cb7569737db859", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968235, "uuid": "78e944c3-6e72-4ee9-b445-ed8b84098568", "comment": "Malware payload", "value": "df4aeab2a241804c633e6e05a05802a2ef58bf0f", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968235, "uuid": "7ed2d0bf-3e30-477d-855d-5273524c40b4", "comment": "Malware payload", "value": "a182d23b400de814832365d731279b9cdbba187292e86027d927198b4244318d503c18dc7d7f2f06330e5532f3952c66", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968235, "uuid": "6222c6ad-d57e-4cf5-a857-24a258eef4d7", "value": "T170328310391BD02456F76329DE57E448FF26413B23651410BEEEC6D42FB096AC6B8FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968235, "uuid": "bc868da8-f62d-48ec-bc33-bb25f6a1bbe2", "value": "192:b9u9gG89mD+SOzuahCnGX1pybp0j5PWFmFBiMluIY26qb7cTOXQWumPTvCfuYRN8:b4KG8MwzuaEnGjPWFMBiM9Yy/LCfj7H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774968235, "uuid": "11b4c63f-2fa4-444e-b2e8-62c872bd4699", "value": 11022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774968235, "uuid": "58419343-1b4f-460a-a93c-9bb9301371d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968235, "uuid": "b794c230-c35d-425f-80a7-31ebe2c8a6a0", "value": "46f5eea70d536f7affe40409d7aaa5fa0009f0dc4538ba2867cb7569737db859.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8478b8-2cef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954389, "uuid": "a5491237-baaf-4d2f-94bf-e3d259d9df0d", "comment": "Malware payload", "value": "481d833f5b9f4b8e0c477d2ab5b65014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954389, "uuid": "cc5f53cf-1316-42d7-830c-0dd05323342c", "comment": "Malware payload", "value": "48e4e03a764edf04b50e01ffae551cc0b1bb07a6116d82851d3d76769b00d4be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954389, "uuid": "ce670b6d-2ecb-4fe7-ad31-59dc6f5331ac", "comment": "Malware payload", "value": "cbcb7d3849349de0f8d87f1f3d38814cd2ba4d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954389, "uuid": "6b27484f-00ca-457a-98e1-c07a87343882", "comment": "Malware payload", "value": "d1ebed0db03ac8fc77b33b89bd56a9bc5f819c851b9be6fa97d45137e169e551edacb048c80cc579e81833239c62df58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954389, "uuid": "869f66c6-d569-48b6-934a-3e79ec064306", "value": "T1E7845A0393FA4618F1F34B98AA7A10614E77BEA92D39C05D1699140E1BF3E149CB97F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954389, "uuid": "e4087182-b222-4ccf-911b-64e6e7d7f606", "value": "6144:tQ93T4hAGOt5vsErQkGm8B4fBCtw0GSHYsjKj5eucZ/h7dSWepe8HJ5INKJJ10Wn:e93T4hKPv3skNBCgSHYzbcngWepe8HJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954389, "uuid": "5cb89022-3502-48aa-86d4-4d21ae0c81b1", "value": 375276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954389, "uuid": "057c6bd0-fa44-4109-8561-859b9dd6eb04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954389, "uuid": "f4fd5298-cf6c-4878-8ea2-0696f58a932f", "value": "KKAMobf1g5oQXJmd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa64f8b-2cb6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774929741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929741, "uuid": "2f604a1d-ccdb-4446-a277-7fe5bf856ff7", "comment": "Malware payload (Mirai)", "value": "b3f8032fc5ad49ae9bfcfebeecf44bc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929741, "uuid": "4acf17f5-cc08-44d9-a28e-9459a1c6f0cf", "comment": "Malware payload (Mirai)", "value": "4944fcda73f45ac864fd36849c3be9cb3318fd650d378568e8b86faf3b56f4ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929741, "uuid": "19e83c9c-6b0a-43aa-a035-d32ad68854e0", "comment": "Malware payload (Mirai)", "value": "61dea3d4f35b2d191e290a87c379a7f9f7160aef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929741, "uuid": "610aea46-26c8-40a4-bdcb-8226c9a2c441", "comment": "Malware payload (Mirai)", "value": "daf4e0ce04c02c7d4aa33c5c7d8c7562a164373e19f34b9df53d8538fd5dc06a18c4379267af051b151dbebbd1d63759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929741, "uuid": "d6e20b41-b6c5-4531-8526-8027576cf862", "value": "T137C3C60E2E629F7DF369833547B78B3193A927D223E0D646E2ACD1141E6034D645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929741, "uuid": "b8f16f07-f3b2-45ea-91a8-d3851a4955d5", "value": "1536:lxW8D+q7jLEIvVNfdoMyKXfpF3alFvHFJaHFEXl+zp/ryx6KophnQthe9XKKS:fW8D+qLE+TBF359yx6KovwoXBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774929741, "uuid": "680c9822-3a50-442d-a5bc-467399020b53", "value": 121052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774929741, "uuid": "1b08008e-9879-40fa-8c4c-c4494957cef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929741, "uuid": "fbb08b06-508f-412b-a015-9ac5906257f9", "value": "rebirth.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574cc015-2cd0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774940875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940875, "uuid": "a13e02fb-9bad-4ecf-9259-e11864f00595", "comment": "Malware payload", "value": "ad935dce98a21e7904e99964dc138d59", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940875, "uuid": "656696c2-efe4-4a69-b3c8-a346d1079727", "comment": "Malware payload", "value": "4ac0ba433a543bb556cdd4f0411951326570ddd28360bd6e8f448db4b5116955", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940875, "uuid": "88685770-f2d5-4e6e-9dd9-7095d09bd511", "comment": "Malware payload", "value": "710abe4532d4b6336c7b27bfe9bad47075c5ef9e", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940875, "uuid": "398db36d-6381-4f9d-81ad-8f09af9d1ca4", "comment": "Malware payload", "value": "4a4b09ccd89ff2f67d2fa28b2df0a4c0469b21645a2ab59f4f8472fe03d38ebbfac1fa96b5363919eecdfedb928f8381", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940875, "uuid": "dff90f91-bdd2-4189-a4a7-c98ee402ebdd", "value": "T19172D0C4C129A16B8394C321BF4CCD4D4610992570AAAE87B2ADD2F3B26F647A8CD855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940875, "uuid": "8fc9dca4-fd02-4e18-bcf8-bdcb84ecdad1", "value": "384:XdNCiTvCCK45Kxk6YjUEzIsVIajPV+cr6J:nTCow+6wz5jN+0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774940875, "uuid": "f02c18e4-9f43-4d09-b30b-a0d802fbd388", "value": 16826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774940875, "uuid": "d2785dc0-639a-4992-b871-2ece4ab49423", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940875, "uuid": "8022bd5f-ab1a-4070-9173-06e03da2faf2", "value": "4ac0ba433a543bb556cdd4f0411951326570ddd28360bd6e8f448db4b5116955.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d377354-2d1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774973849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973849, "uuid": "521e78c9-f485-43ed-8ffb-ef3224434059", "comment": "Malware payload", "value": "05a5ffd183d999cc5c4a43e963840119", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "gaowvdoxh-com", "colour": "#F3DECE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973849, "uuid": "44c6377a-9a40-49e0-8256-ba8485888778", "comment": "Malware payload", "value": "4ae4199690fc83780271f7d1ed2f6214be0f70871cd949e09e94faa0b8f38534", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "gaowvdoxh-com", "colour": "#F3DECE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973849, "uuid": "5cf10d2b-91a7-42d5-99f1-79e73f27b0b3", "comment": "Malware payload", "value": "b4d8fa03cbf06223937e5f127337859fef8a6892", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "gaowvdoxh-com", "colour": "#F3DECE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973849, "uuid": "63deabef-aca8-4cad-a522-71c645c1ec93", "comment": "Malware payload", "value": "33dc97c0445c1a6eb6a0b3188bcf234d7a8f078575fb52cbb4584cc467d72d869983ba9412628051fe70c401a0347f26", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "gaowvdoxh-com", "colour": "#F3DECE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973849, "uuid": "9a07f2b3-e233-4cdf-b1e1-83526844d76f", "value": "T134B01233C0E496EEBF5FC82984151C9839000244C3148BE132C062892C4CC89C32145C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973849, "uuid": "dc20f9fd-0bea-4261-8efd-ca360e4ff263", "value": "3:VSJJFISnMcXR/JJNLNNQXLzEfOWM4uYd47ATyyN1shwdn:s8SMOBd+qV/q7ATVm8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774973849, "uuid": "6f7c27a2-c18e-4063-9c56-66a46e753e15", "value": 101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774973849, "uuid": "9d1bdb45-35c4-4fa3-a35a-ef984ad91491", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973849, "uuid": "fdcf3676-67c9-4778-b3db-5f915b86e008", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5c2192-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959402, "uuid": "c17d19b6-2e28-4804-a486-a4a4b0b277e3", "comment": "Malware payload (Mirai)", "value": "817da11e8ac66bc02027faad43381b38", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959402, "uuid": "bf6099df-4f04-4cd0-95d4-1e9efd898313", "comment": "Malware payload (Mirai)", "value": "4b1eef0b88f3859ebd6e1285870b1d3a98a1874f26e070b34118bdeafee05488", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959402, "uuid": "5af5ca6c-f8e8-4702-ba8b-8c9ad15ce92b", "comment": "Malware payload (Mirai)", "value": "bb3edfec35961c90a95a90143cca504b3a28b1a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959402, "uuid": "ef3c9308-148c-49c1-b8be-86cac47f8ee2", "comment": "Malware payload (Mirai)", "value": "084dff9addd7b00e4d225c5787d877141008ed19706053c8e772ce83c666957606d44cb9b69ed0e935aede9cdec34423", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959402, "uuid": "b03bb140-4ce1-4939-91c7-29a0b225e8cd", "value": "T1B3733923EA16AF46D14761F0A9F64E740B13FC2A8D671EFAA564EDE881439DCF1043B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959402, "uuid": "c81eefd5-b26e-45e2-9491-5de79d4155fe", "value": "1536:Opwtq/0FORx0SFXqRgljniSIjZEXnK82nG7cuGc8KCGWUzgwuI:Opv0QRxJ0WkjWXK8bTGc8KI4zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959402, "uuid": "d0e163fc-0c42-4546-9624-dd2e102b9c36", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959402, "uuid": "ea979130-cb4d-49f6-b102-aa06e9cd2f16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959402, "uuid": "6a24d1f2-790f-4d72-8323-a1efcdd97bf0", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4a9d34-2cd7-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774943917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943917, "uuid": "07f5e1e4-59a6-4f73-8ea2-a13d7a78159f", "comment": "Malware payload (AdaptixC2)", "value": "adf0540f810b65f039306c8ce405cb50", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943917, "uuid": "e3823510-6595-4f74-b31b-23c47404b188", "comment": "Malware payload (AdaptixC2)", "value": "4b467906789b3abaeeaab4483efc9a8b6b6dda044520fdd07526e71cb160b614", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943917, "uuid": "463398f8-b0af-4fc8-a4ad-432ef340a427", "comment": "Malware payload (AdaptixC2)", "value": "8bec7e055a9632562a92ecdf6062b6170b8f54d5", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943917, "uuid": "a6abf9fe-5d89-4838-a747-9382ce7c7fb3", "comment": "Malware payload (AdaptixC2)", "value": "9e85db1fcb82f747fb851efa53d0f1943ee5a99be595f2141b4bc0a9ca9fa504f958ee044df819616a90520c03421078", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943917, "uuid": "ec6a38d9-1146-4faa-b8d9-1db9d6355ce8", "value": "T1A5664957EC9414E9C1AEE23589A29553BF717C891B31A3C32F50B6293F73BD0AA79340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943917, "uuid": "dfefaa43-358b-4cd5-b809-385750e4bb7b", "value": "49152:Y6AlnbrKe4mUEt6GHVwXot4Vi2rYX6hMjMBiqnBEsQqKC/Mm9BjD1sDKlK1KyqpE:Y6AprdA6FqICXjDayDWEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774943917, "uuid": "8830e3f0-e186-4552-be2a-b65b7704a210", "value": 6709410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774943917, "uuid": "9b6730f8-027e-4dac-b448-c327462b6fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943917, "uuid": "bf9acfd9-5ea9-4e77-a497-465eb0a1d84d", "value": "agentamd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cddf4c-2cd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774944788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774944788, "uuid": "b17d7258-ccbe-4478-8afd-df5354ff9f6c", "comment": "Malware payload", "value": "6b47dd7a19752fbe91fab62eeadb6aba", "object_relation": "md5", "Tag": [ { "name": "LogMeIn", "colour": "#689C27", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774944788, "uuid": "5d8fdfb5-30af-45ce-bddb-802df2fba20f", "comment": "Malware payload", "value": "4b6d751cd5aade443ce66bbe4d454c978aefe1bff1ef7d28b4f8dbb3a468dcf0", "object_relation": "sha256", "Tag": [ { "name": "LogMeIn", "colour": "#689C27", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774944788, "uuid": "ede95fd9-8867-4927-b772-a125fcf087f5", "comment": "Malware payload", "value": "045cf7a3d6f5733e4cea9f4837e6c99dbe2e3036", "object_relation": "sha1", "Tag": [ { "name": "LogMeIn", "colour": "#689C27", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774944788, "uuid": "bdf543a0-bab3-4651-a47d-fe52529a69b4", "comment": "Malware payload", "value": "6350edc03107cb964e67b7bca25278e1687d2e2946fcafb2a42118e5949595602ace61c404f117bbe245b1f55b054944", "object_relation": "sha3-384", "Tag": [ { "name": "LogMeIn", "colour": "#689C27", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774944788, "uuid": "75b06bb5-0bc7-4df5-96c9-4c8179059483", "value": "T1B44733227A82C5F6D98911F09D7CAEE9613D9C250FB184CB73DCBE597B301D22B32916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774944788, "uuid": "31ec162b-f007-4e07-aee3-3f132813e28a", "value": "393216:r0/KoQ3Wn7iPEcBwjzT+NSmEBk81t9dsh6ily59SFZa2lR2wJhL9grZo62pw:A/KoQmn7G/BwjAskW1sh6WyOKSdJR9Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774944788, "uuid": "000caa9e-d6a5-49f5-b815-e876742f3d53", "value": 24952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774944788, "uuid": "38dbdfdc-cc91-49a2-bd9b-4db73d1c7018", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774944788, "uuid": "a5a81d64-9671-4be2-bedb-29185ba99fbb", "value": "mp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b25ed68-2d25-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774977389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977389, "uuid": "7e933b50-6683-4d4f-8249-63521c5fb07c", "comment": "Malware payload (AsyncRAT)", "value": "addb2f9bc9ffad336cbee648fdfcf138", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977389, "uuid": "fede4579-8986-4f21-ae36-1c73af7632ff", "comment": "Malware payload (AsyncRAT)", "value": "4bb4a303b8e4873401be1cea68d50bdaa454471685dc30ad61e9ef746181aa29", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977389, "uuid": "6b12fe78-524c-46b4-b6e1-2e6e1564f17d", "comment": "Malware payload (AsyncRAT)", "value": "a44be384a8c20df29544e9aa86f2a28679e3566b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977389, "uuid": "a4ce5abf-28a4-40ab-a074-20112cea9cac", "comment": "Malware payload (AsyncRAT)", "value": "1cf50ece0aa2d2c993ab2b312045c7af54df56ec6ba73c17b417ca23aed6924a18e0c043d875470ddc0a7ed900a479e0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977389, "uuid": "465977fe-6997-4d52-b14b-e755d365cf71", "value": "T10C332B003BE8812BF2BE5F789CF25145467AF2A36603DA4D2CC451D75623FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977389, "uuid": "12f5a0eb-f8b5-4e97-9af7-90babaf8a060", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977389, "uuid": "98dec54f-4ba8-4565-a35c-fcbe3fa15710", "value": "768:Hu/6ZTgoiziWUUM9rmo2qrrKjGKG6PIyzjbFgX3iUuwXPjNnKkBDZjx:Hu/6ZTgle2mKYDy3bCXSUdPjFtdjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774977389, "uuid": "8c18ce1a-fc77-467b-96b8-eb22336c82ff", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774977389, "uuid": "f8f1c0b1-11bf-448a-8fe9-897cc2e0b482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977389, "uuid": "d5d18dd5-92f1-494e-b597-8d465f1c581d", "value": "mod_Ass_shellcode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bc0c38-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928821, "uuid": "2562ee8b-460a-4b57-950f-84f0ca293a40", "comment": "Malware payload (Mirai)", "value": "cf18e2754e3eafd4df7d0c1ed3c09dea", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928821, "uuid": "a1cb0ad1-c9e0-4c00-8e50-2102f634dbe1", "comment": "Malware payload (Mirai)", "value": "4d60028b0637e3b98572d360061162ad322372b40c19947c5892fff1fd6fbffd", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928821, "uuid": "4267fe32-9909-450e-84cf-18926d77cd0a", "comment": "Malware payload (Mirai)", "value": "5b09f1cdef573f976643d99da93545c9a4f6c0f6", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928821, "uuid": "b6bd6bc9-c90a-4390-8fe5-b3654e944bcb", "comment": "Malware payload (Mirai)", "value": "ee69ce1f0d948446a8773e6e8fda5757a02b05adc180fa82fef7c2f0b6b4bddd1a731b620bea5123f8c30df6ada40b71", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928821, "uuid": "3811a448-474e-4419-b7f4-ed9eb9a58bfe", "value": "T17254C50A6BA19EF7D85FCD3302EA861110CDE45612A96F2B7274DA1CF74B94F08E3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928821, "uuid": "079af2c4-cf7c-458a-8fd4-8f262aa43441", "value": "6144:l6azH1aZ1iVgZBOEhAK138QBzXWF5chJalP1jfu8zUTz:l6a71azoqOIr3VrWF5chJalP1jfu8zUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928821, "uuid": "013347a9-df03-4063-9ada-734a65690bf7", "value": 291081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928821, "uuid": "3663ae0c-a5f7-482e-ab78-ce37baf96967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928821, "uuid": "c30b05cd-3b81-48ab-aa59-d0dac321bfe0", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab12242-2d0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774967751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967751, "uuid": "d81d1819-2240-482a-99be-346785c14786", "comment": "Malware payload (Mirai)", "value": "be40a1735a39cd815d3153b52a5d104c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967751, "uuid": "788ac341-80d3-42a5-ab33-7b00909263cc", "comment": "Malware payload (Mirai)", "value": "4e8accc6e35ac3ca33548b488fafc3297b57ab59f7fb51bc71883f5b9cb51da0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967751, "uuid": "1cc2f345-741b-48a1-bce6-ed33cc80d8b7", "comment": "Malware payload (Mirai)", "value": "512160fa1bd04aec0bbd0d5fcee0c77ed9b29344", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967751, "uuid": "0b5fbc2b-2d54-4a40-baad-3410aa8b777f", "comment": "Malware payload (Mirai)", "value": "445180f0bc92c4c78fb8b8ef51f69cc3ad8796fb1d5eb04660a835de3a9e8c6cb924099985946f95837a9706564fa104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967751, "uuid": "1a37353f-a27b-403a-88c8-21be6cfba9ea", "value": "T13FD34B46FA414F13C0D6177ABAAF42453332A7A493DB730699285FB43F8279F4E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967751, "uuid": "e5068d7e-1975-49c9-8983-7d9166f45431", "value": "3072:S6Ao5RiKR0Mj3d9VkuhReXS2CYWCLkA2/u/M/9QcEI:S6Ao5RiKR0E/BhReXS2fWHA2/mM/9pEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967751, "uuid": "04973844-1ebe-4e19-b16b-fb293cd2fa5b", "value": 139840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967751, "uuid": "70fa7426-2d21-4752-a04d-2d588dc9e190", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967751, "uuid": "3e1072fb-7c4b-437a-a3fe-b1ef471617cd", "value": "xdlol.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a72057a-2c97-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774916292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774916292, "uuid": "dab798b1-5c6c-4885-986d-bf71e2724a1f", "comment": "Malware payload (ACRStealer)", "value": "6304fb7173f9a8056532fb15045b77f8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774916292, "uuid": "ded08049-147f-4407-8b50-c3296afd44c5", "comment": "Malware payload (ACRStealer)", "value": "4e8b93c315302fd961961d214e69975718d7f3422316ad5271a2cf1d4cec0f45", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774916292, "uuid": "2d6e5ca2-2a00-408e-83d2-c90fe65b44f0", "comment": "Malware payload (ACRStealer)", "value": "f681695443bcbe5c26a137d4e9307678b87b2e98", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774916292, "uuid": "6eb0c6a1-074f-44ae-85c5-80f869ddc551", "comment": "Malware payload (ACRStealer)", "value": "a5f7bdaa70b24215b691260ea3555110f4317757ecccfa0017327d15105961a06a71c6d969152a128941288c6bf9e3d8", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774916292, "uuid": "c6980d5d-c5af-4000-938a-11a4ef714d65", "value": "T1D576B60BAC214590C5689074957F43567BB73C441F212BEF3EA9B3212FA37E46AB53AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774916292, "uuid": "c92cf513-275b-426b-9bf9-e4c6efd418ae", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774916292, "uuid": "3b5da56f-4a83-45e6-91c4-cb7fadb188dc", "value": "49152:50owT2oTJL8nTTJPuKsDcS31GZMHO2BJlZLVRj378s8k8QQclzdfpc3:50xkToMgZJz4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774916292, "uuid": "84eb4312-da21-4e7f-85af-eea4ce9d925a", "value": 7360512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774916292, "uuid": "d1914096-abdd-4d7a-b496-2be1c7c8e806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774916292, "uuid": "a4d6515c-0d65-40a7-b64f-1de91215dfe0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.73378237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5626b9fd-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958912, "uuid": "3b113622-4e71-436a-82e6-842667583b8a", "comment": "Malware payload (Mirai)", "value": "819ceb74cb4097b1cd081ec63591bde1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958912, "uuid": "d6fdc483-6ee6-4bfa-b6ce-c6cdc4b7fcc0", "comment": "Malware payload (Mirai)", "value": "4eadf80e85656f2c30bf8656cd5ea1a46cfb2557388b911b3644e659900513fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958912, "uuid": "038b3306-bfb9-4be3-872f-e9f19b22c0f9", "comment": "Malware payload (Mirai)", "value": "524982cce42d1a2ea28686758c11f66bea8c7953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958912, "uuid": "97808080-c650-4524-a23f-c4416da335e4", "comment": "Malware payload (Mirai)", "value": "41c40cd6cf104f16f20d5463fac77eeb32797ea53f1bc5901ae23587cd80fcacaf86fc352232555665c2fb63612a4fad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958912, "uuid": "195c8c46-4311-497b-af98-e730e5e8827a", "value": "T1B9A3C609BF350FF7E86BDD3709A92B05198C551A22E97B367A34C858F64B21F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958912, "uuid": "7829247e-42b3-41a1-a1ec-28ccd51fa203", "value": "1536:dkkdyTy3yryaidLVeMvW9eqzrhV2rRlspIwVzQZigcTNcZ:dkk0UMSJBWkorjqWzQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958912, "uuid": "9b9642b4-6599-4547-9f31-e8d1726b1172", "value": 101680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958912, "uuid": "6dfd4374-2133-4ce0-9a0a-810fe973428c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958912, "uuid": "8d6290a9-7291-48bc-8793-efde187cb4e7", "value": "jade.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc9f553-2d28-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774978921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978921, "uuid": "ae08e7eb-42d5-47fd-9820-63cc5ca81513", "comment": "Malware payload (ValleyRAT)", "value": "ca45d3ab9b3bd901eeacffd6376a791f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978921, "uuid": "3171bc60-cd06-4d38-ad8a-b8a565394999", "comment": "Malware payload (ValleyRAT)", "value": "5085ab3fc3b3a6b548856d59a0cae64de0d67fc5d8f5432af7acf614c4910105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978921, "uuid": "9457451b-6191-4b9f-9446-e68b146901d3", "comment": "Malware payload (ValleyRAT)", "value": "87d855ed9efb2e3baea25b423e6e1bbfc9ffa39a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978921, "uuid": "39f22994-45fc-4cdf-9fab-bd29583d8c0b", "comment": "Malware payload (ValleyRAT)", "value": "59d6d2dec9141116fd7c2d3078e4cb20fadea604eda21aac562a12a15876780543af7a2acd9712dd29998ad853a9f068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978921, "uuid": "a22d6f8c-73eb-4451-817b-da84d4dac0e9", "value": "T181747D033EE49528F1754C76B4B291B40B79EC210BA9BCD7BBE078560A765D0EB36743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978921, "uuid": "6245c08c-d3d3-4ba3-9293-a4ed162b5631", "value": "94affedd63cbfe57e879052a623643e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978921, "uuid": "7de852d1-f252-4d6b-94e8-4865f5f70449", "value": "3072:l7iMf21e3fflcvxeWiiaYt3wPqJfNAMTa1dTPbqitqqr3x/1Q0pQ2MmKZMUU/hEu:5ffuvhhaSfzaPT7s2MmWMUU/u9w0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774978921, "uuid": "9acb548e-bec8-4785-b3e0-8134992c2d9c", "value": 356840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774978921, "uuid": "5ef3af79-e0d3-462e-8361-f814c740b169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978921, "uuid": "ad4d7ea5-5463-424f-bf9f-add83534b84a", "value": "\u6fb3\u95e8\u5a31\u4e50\u7d20\u6750\u56fe\u7247\uff08200-200).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ec2494-2cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774955145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955145, "uuid": "fe897c14-9090-4727-b662-fe7cdeb3da94", "comment": "Malware payload (CoinMiner)", "value": "75c17ea2cc5ec83141a863c43383517c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955145, "uuid": "e4c64c34-c562-432b-a3d4-cec3e4924927", "comment": "Malware payload (CoinMiner)", "value": "50b6228ae0e40409c436ce6bdaf6153365a26183bc8e030d433f1ac4250b2e43", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955145, "uuid": "dbb3f257-ce56-4293-939d-d15852376ee1", "comment": "Malware payload (CoinMiner)", "value": "cc4b8ce6583a162823470bd8ad542030ad04d907", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955145, "uuid": "383c1e17-006b-4731-b68a-cf98bf8716a2", "comment": "Malware payload (CoinMiner)", "value": "c180258d63d72ea02e2b1b209dcb281282b1fd6d3f3bbd5c3ae9b9f398e0f1b5f33fe80ce808f65860d149d8cb59ee5e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955145, "uuid": "16394c5e-91ee-4234-9b76-602514d2502f", "value": "T1E322724F39560D73F64D86F069620F9E0B3C7263036438AB66377BA85A4B3786A0E1D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955145, "uuid": "0bdcd2be-aaed-4c12-b7b2-4fb278ccb579", "value": "5b2be5371d11a0901c7dd88d5d6a5803", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955145, "uuid": "37b15d5e-5d83-4242-9c98-2514adfa51db", "value": "192:EUg0Rg2gBCaZj63qdCIPFJxTEKmFhqGL:Xg07Dat6QPFwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774955145, "uuid": "8821f488-c440-4bab-8192-353a0f582684", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774955145, "uuid": "2e8d7305-ef2d-446c-acb2-faaa2fd2c0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955145, "uuid": "709d5181-db80-481c-a540-891177523548", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcefc59-2cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774960133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960133, "uuid": "3ef2c35c-960c-4f3c-9def-52d25513cb5a", "comment": "Malware payload (Vidar)", "value": "13661a07327582e1045189ff798a2b54", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960133, "uuid": "79be01ca-3cfa-4acf-88d6-a63b6a2e3c26", "comment": "Malware payload (Vidar)", "value": "512e7ccb233520f39877a006137956c96ce5b3118df5d10525f4e08fb0593d02", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960133, "uuid": "297efdd7-39a4-4c0b-8118-81f5805a4703", "comment": "Malware payload (Vidar)", "value": "368a6809ac50cfc6498327baa98e79e567c6140e", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960133, "uuid": "6d512fbd-6a78-4680-a57b-03baecc7588d", "comment": "Malware payload (Vidar)", "value": "fa4f4932f0744eae43b5e0b80365ce7e651c822474d8f984c8bfd4da19b2bab6b3c755fc3e7aac210c863e26b5f2a5c8", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960133, "uuid": "c0ef7a4c-007f-471b-a3fb-ed1b988c1f6d", "value": "T1E8754B06BCD008FAD06A633289B765A17B74FC690B3263D72E90B5B83FB66E15C75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960133, "uuid": "f8edc8e1-c667-4c36-a256-f7a3c2f643af", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960133, "uuid": "196f4955-ff0a-434d-b3ae-3120f0c23d2c", "value": "24576:l41ZQeHyq99nhfCfnpHc84IZNWrtPlMJCVxg:l4LbHyq9RhfCf284QWs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960133, "uuid": "b0523fbf-70b0-4c96-a1a3-856382d10a2a", "value": 1693824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960133, "uuid": "07ffd6d1-c306-48a4-a0a6-62c1c253fe3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960133, "uuid": "9ff18b01-9030-450f-8e23-26732db9bcfe", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48e4548-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774960010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960010, "uuid": "7812cd4d-84d4-488a-91f1-6ed82c8bfa84", "comment": "Malware payload (Mirai)", "value": "b7edddb6acbc5aa7bfadcd29ed7f93a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960010, "uuid": "345a7831-fda7-4049-b37a-cbda4c1dcc04", "comment": "Malware payload (Mirai)", "value": "515fd53de21d337301af4b1126084751b97cd893a0d0279693dec57a003ae8bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960010, "uuid": "d2af8a79-2b46-46b9-ae60-1cd9356bae39", "comment": "Malware payload (Mirai)", "value": "71ead7792d76e782a64469e762277fa961820aa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960010, "uuid": "048ce662-edb7-43be-a6d2-016969d4330e", "comment": "Malware payload (Mirai)", "value": "a7eae5d090207a1b7b5440535c292b03f49797948c1d2e0efac4cb0e8da719748ba0b401390715c760b4a88a28a1159c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960010, "uuid": "10d01a4f-b98a-4664-b876-699db9c1c9a3", "value": "T178532851B8828A23C6D0237AFA6E51CD372563E8D2DF72179D215F207BC681F0DA7E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960010, "uuid": "f187485e-428f-4285-b13a-58d9cf4c56ba", "value": "1536:eirR80MdahcXDHo9J2uNrDpBnRgTbtrrsciWt5XNZU/6:xrRvNzgnlnhbXNZU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960010, "uuid": "b160ffa0-bb61-4567-b862-28a582bd7a1e", "value": 66632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960010, "uuid": "15b629a5-0161-431d-bedd-4e4babca0453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960010, "uuid": "f7b5d6e4-e0a1-4a81-9053-55d87e2df834", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab883ab8-2d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (VENON)", "timestamp": 1774965927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774965927, "uuid": "6d9ac60e-a1b5-4bdb-b30b-06a98bf0840b", "comment": "Malware payload (VENON)", "value": "c9de4b86d83359e9b6a1f09339351303", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774965927, "uuid": "38feeeb1-ceb7-4e87-b8cd-29c65aae11d2", "comment": "Malware payload (VENON)", "value": "530e501f3e0aa8a5e3a41a06b0ba4e159ea6cea258b71c644c0578b856aebddb", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774965927, "uuid": "49622412-f47f-4bbd-ab9d-f2fc9b7a39ba", "comment": "Malware payload (VENON)", "value": "8080f6be05f67c1efde0400c61dc0a0e8cf1ed7f", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774965927, "uuid": "bd9833be-4a5a-454d-9828-0fd273306861", "comment": "Malware payload (VENON)", "value": "84b2fdd48e797f4cae133658cfb0aff72d91494696ff4f6e3a68b6e84cba69f0995276ac349b15ffe21424b6bbf74423", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774965927, "uuid": "21d422c7-8f85-4504-b3c5-f7b0f88f0b92", "value": "T1ECA69E02AB5654E8C1AAC870CB4B8A636F2134DF07B5F6BF61C515962F79BF07A2C344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774965927, "uuid": "2c35bf82-24d3-4b2d-88f7-6afa97c48885", "value": "4aceb040a1b535976549387ede600ab6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774965927, "uuid": "2d7ca3d4-ad82-48f0-8b35-ef086672b00b", "value": "98304:YVTzSBV72H8kR/KMsvT516Yurb85TkEhU84+hUFn6fdmhn+O/4s2S:QSPiB5e6IzU84AA6FmhR4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774965927, "uuid": "b63c767a-c343-42fc-8da7-c2479d19e922", "value": 9785344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774965927, "uuid": "411c3f50-3f2c-4278-80ba-0363ee8c1760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774965927, "uuid": "8b997286-0ad8-44a1-8663-3171c60445b2", "value": "530e501f3e0aa8a5e3a41a06b0ba4e159ea6cea258b71c644c0578b856aebddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcb5beb-2d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774966364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966364, "uuid": "abbbfa96-1bfd-4554-98fe-51944a354987", "comment": "Malware payload (PhantomStealer)", "value": "f0030861f00f91e732dee78b8080f2ec", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966364, "uuid": "d12a5712-e8a5-455d-83d1-9a590d328447", "comment": "Malware payload (PhantomStealer)", "value": "531e0bb4aa9fc0a61dc07fc54902f2c8d2300da9dc7abcd67845598a0b6837e6", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966364, "uuid": "3b70d690-1ab1-4a97-bf90-6b1f5607b7f3", "comment": "Malware payload (PhantomStealer)", "value": "47fccc17bc7d950600da1cf72a983d33013b7f96", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966364, "uuid": "d82fc7ef-1cb8-48e5-96c9-8c088d7a5d3b", "comment": "Malware payload (PhantomStealer)", "value": "6f451410e043ef0e622a4b1c3c246e1be17ba5a5d5336f97be39d7aaa81dec9bc29d48f3aa2eb70641b7b0dff2600402", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966364, "uuid": "6bd3d0eb-98ce-4ccc-a3cc-b3866ea5670f", "value": "T1B4A16DF53103F5FD44A44ADDBA668A3077539B418B9EB4CA07829AE43221037F5D41DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966364, "uuid": "4f920d3c-5207-41be-8a0e-fa64277d37fa", "value": "96:XXksyBDXnBEARq5U4qAREu1MZp00xydvbdWvMCk1ftnChc29D3XkV:HO2AMG4q0ESMZEdvJWvMCkVtZ29ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774966364, "uuid": "0cf2ec0f-b63b-41e9-b079-3500dc454786", "value": 4689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774966364, "uuid": "33182914-9b10-4a55-a684-8734e8aea5f8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966364, "uuid": "9c855c80-b57e-436f-82f1-7f1bd385d559", "value": "Order873126 - Ersatzteile fr Hydraulik - REGO X-Ray GmbH.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2556f13-2cf5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774957026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957026, "uuid": "7e54522c-82d6-4d85-a655-cc73cfee8ffa", "comment": "Malware payload", "value": "82a61b0fd922a7000c8aefc4ab399716", "object_relation": "md5", "Tag": [ { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957026, "uuid": "1621a5c0-403a-4a06-9517-7482e1446efb", "comment": "Malware payload", "value": "53b5c08db2c3327ea74597a2b37c32ffd4642668f8fade0e124222a16fa8a133", "object_relation": "sha256", "Tag": [ { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957026, "uuid": "77bcc084-a66e-400c-ba6b-2793a1545a6b", "comment": "Malware payload", "value": "b4209621b7a4a3730cdced670593bc12b4cf65a9", "object_relation": "sha1", "Tag": [ { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957026, "uuid": "2a739f9c-0e58-4ad9-9312-2b401bef526f", "comment": "Malware payload", "value": "24fc633e2a2f13a7cb4888566b6890f541219d3a3b8bb07b9d198c6664e3853f58272bcd62f60465a1465ee6f415db83", "object_relation": "sha3-384", "Tag": [ { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957026, "uuid": "fd578636-790c-4cea-850d-6b1513970a36", "value": "T19B274B53A9F64233DAD710B7EACA6081B23572173951A8A8FCDC53191F89E6CD3F6384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957026, "uuid": "d676f14e-3704-459c-b3a2-73681f3e9944", "value": "49152:gPm3lvXFRJsjk/rVgFBXM+XukPbUNLCPi13c3I0UwuBPOtUAFErsCsNpYXcFmJJf:XwuMmkCArHOfRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774957026, "uuid": "74231977-921a-4c47-ab9f-a621e7e2ad2c", "value": 21636608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774957026, "uuid": "d53bf416-8735-4a32-ac0f-882d39615f20", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957026, "uuid": "04a0a62d-3a82-40ea-a5ba-ccb9ad8986c5", "value": "cdk-iam-policy-builder-helper@0.0.194.jsii.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f78356c-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959223, "uuid": "4b5bec2f-ce43-40ce-a6a9-19b5e3bcb146", "comment": "Malware payload (Mirai)", "value": "3c6547ad2f28b2f570351cbcc5a96c29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959223, "uuid": "e1e835f1-0d33-421e-bad0-97d28deaf172", "comment": "Malware payload (Mirai)", "value": "57905270598eee98c589239fcea0439b87a958396c2ac4730a56dde40300ff9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959223, "uuid": "e32fc14b-8c51-4ee1-b5be-ac4fde7389c0", "comment": "Malware payload (Mirai)", "value": "b3f2896b3fd40ebf7df21d4092661d6312138446", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959223, "uuid": "76c54980-05a1-433d-a314-1c3756f697b0", "comment": "Malware payload (Mirai)", "value": "2496b15e76d9a35ad579d0c619f92d257308a5cb00822c65763525501ee1feb2dfeb0559e14562ab441312d0024a1fdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959223, "uuid": "15cd6959-b784-480e-9c41-ed14b55880b0", "value": "T12383F881B8818E26C5D813BEF53D118E336167E9E2DFB2229D105F2437C6A2B0D77E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959223, "uuid": "d1ab73ef-f297-443f-8574-7b375a4e25b3", "value": "1536:KtnLHVAsSZilAkW7+UzIsIEsPMAAUfB8OchEwuLZbcrHPSTchuI5iDRMO0ZZnUS:OVPSZiA37vz8E2MjUSbGFHRMO0ZZnUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959223, "uuid": "966b5022-2b06-4d3b-ad7f-d6ff9deb7c00", "value": 87344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959223, "uuid": "a4214511-4241-4fec-ab17-0d78b0757cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959223, "uuid": "dc9b110f-a247-49bc-9446-d01995230d39", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c499036b-2d10-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1774968546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968546, "uuid": "13340a62-5197-42ce-b794-e095df78d537", "comment": "Malware payload (Smoke Loader)", "value": "5e110b9ae483feaae545b589a68de3f1", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968546, "uuid": "ef7ad320-79b1-4096-a427-aefd4ad226b5", "comment": "Malware payload (Smoke Loader)", "value": "57a4ed505738da72242691394ce87e591deb35e7a1a7c546f70be230b89e2b44", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968546, "uuid": "1d53c40f-0b6c-429e-b23c-ad00752bf8af", "comment": "Malware payload (Smoke Loader)", "value": "bebfc256584fdc73c9d8eb73578ad5776d392bfc", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968546, "uuid": "913c34bc-4b8e-4f57-b555-d1f66530cbbb", "comment": "Malware payload (Smoke Loader)", "value": "95a9ca2c619c96d5c9fee5317abb68cc601a9894dfb7960085afcc87856999449fded49573d552f41322cb53fbbeb7e0", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968546, "uuid": "1ed3f738-7d12-4cdb-93a7-f4747489cee2", "value": "T14C75590B7CE009BAC0AA933289F652927A76FC491B3323D72A50B3783FB66D05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968546, "uuid": "b41d189d-3a44-45d7-a632-58342b56d449", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968546, "uuid": "4fa9f356-629a-45bd-a333-b742d8a1f6ef", "value": "24576:DtneLZ6a0NgaB8ea34GLUbMftGEDXT0C6:DteF6aiBU344UbMf5Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774968546, "uuid": "60d5270c-915a-472f-b11b-5b850f82aa3a", "value": 1651200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774968546, "uuid": "d129995f-473a-4042-82cc-26f80dc471fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968546, "uuid": "a5b41d5d-4b11-4027-95d3-336f4dd62405", "value": "eLaunch_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0215760d-2d0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774967790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967790, "uuid": "0f40b4a9-fd65-4373-8ec3-41f8763da250", "comment": "Malware payload", "value": "db7f4c82c732e8b107492cae419740ab", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967790, "uuid": "dd939e82-cf6e-4ca1-af20-4efa41bef595", "comment": "Malware payload", "value": "58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967790, "uuid": "1acb5d19-dbb4-43fe-b333-41a0d84729e9", "comment": "Malware payload", "value": "07d889e2dadce6f3910dcbc253317d28ca61c766", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967790, "uuid": "b41a5783-3c5e-471d-bc40-fe2f6cca96e8", "comment": "Malware payload", "value": "3a25e499a9787ab196cc1849eaba3e0b8fe56ba7ed0b827f7b5dddf53882e9139d0ad2a2ce0d5186b29db163d1d906d0", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967790, "uuid": "42991f55-34fc-47e7-abc5-9e415e0b7ac8", "value": "T1FD93027003001D84367E87DBBC86E3D849A2CFD56E177473641EA46A872D2A4CDFDA6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967790, "uuid": "e03fb98a-9e09-4a3d-b7f9-49fd935746e6", "value": "1536:uXG6U0Qn6xK9yaoMZ2NUX6KX1hkKAqFlsaPXOdV2VLbgQvMjCtVpWl+0iium82FM:uWD6MIMAiDXoL6wQg9jQVElKI82Te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967790, "uuid": "3d84bb3c-fb2e-4c5a-86b7-c51ae63e002f", "value": 89868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967790, "uuid": "4e921004-2b9c-4d29-9899-f5c31fb0e47b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967790, "uuid": "77d0df49-0824-4ea1-be3c-33c4a23f592d", "value": "plain-crypto-js-4.2.1.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a0a435-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774979680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979680, "uuid": "d81fe1f1-9642-45a1-b056-9888e8fc0d5d", "comment": "Malware payload (AsyncRAT)", "value": "a1dfce8e37a7f1a4ef5c722049521352", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979680, "uuid": "ca845983-ee2d-435a-8815-6e8fe21656fe", "comment": "Malware payload (AsyncRAT)", "value": "58d9f039ec38bbe03a1e1bf58a0102ce9c94d6efe39d2450cb44917d4a5c75af", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979680, "uuid": "49e4c6f0-ad0f-495f-923a-5df1b1a310a5", "comment": "Malware payload (AsyncRAT)", "value": "6f2509fc57bdea2642b27b00b5dbc19fc47dba21", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979680, "uuid": "ba28441f-0481-488a-b9d1-6ddcaf4bdfd6", "comment": "Malware payload (AsyncRAT)", "value": "53af41290ea5077473e31122d72bdfecbb8fb07f6c5d50267212865582ac233dde4fc8a02c6e9bd437a6fe88feca4d70", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979680, "uuid": "69905a47-0b89-4ac7-8477-a3523bd6620b", "value": "T1BF634B003B98C966E2AE47F4BCF3560106B5D27B1112DA1E3CC854DB6B5FFC60A526EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979680, "uuid": "88e733b4-0592-4b27-a164-848d92266a77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979680, "uuid": "f4a09598-fc4e-4d05-8af3-24e717b05761", "value": "768:+m0vnfEXf78awC8A+XUdJYKWZHsJeSuZ1+T4+aBGHmDbDXph0oXL2raORhRSuIdP:2EXiuJYpJxDYUbNh9L2UuIdpqKmY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979680, "uuid": "8d7891c6-0317-4d17-a9a8-d226a7afec55", "value": 70952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979680, "uuid": "e335fe20-6ca9-459d-bf30-dcc167b71f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979680, "uuid": "c66f8418-bd58-4338-a1ac-31e171440db2", "value": "mod_Ann_shellcode.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d72e57d-2d06-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774963971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963971, "uuid": "a4e7b7db-bf23-4173-ae9c-dccbb7b32d78", "comment": "Malware payload (Stealc)", "value": "b2f44272f3024184f06f69a187a9fecd", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963971, "uuid": "ad7f12a3-852c-4877-97aa-f26b3fd51158", "comment": "Malware payload (Stealc)", "value": "58f1e4a391713abbbade8712ffaa3dd692751354a2ffae91a93db19ab83736bf", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963971, "uuid": "192dea90-387d-47d4-932e-7e56a0072ddf", "comment": "Malware payload (Stealc)", "value": "0594979342af79739e3b34b7edb1de8b091d2c4c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963971, "uuid": "a900be67-55b1-4b3f-9f4f-161b5585e01e", "comment": "Malware payload (Stealc)", "value": "570311da309775c7f54a7006948421344c53b434b44f44a49cca0d675d595b4622ebc3de9ba2730dcedede48f9c27857", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963971, "uuid": "3de99e87-a72a-4484-8ffd-e425d9eb7925", "value": "T1EE958E0A7CE04AF6C679633248A291D67B7DF8191B32B7E73E5075392EB76E05A34310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963971, "uuid": "3a8c93a5-f9be-48b0-a318-4b3b1e236785", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963971, "uuid": "375bc4e4-85d5-4362-98d2-0b2f706e2908", "value": "24576:ay0XZNtlJzirue6SvebcxUYJiHsi3z3GRWdtbbXwR4:ay0pNtZivuYUHsAzHVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963971, "uuid": "c5664b6c-8ccb-4bf4-9aa7-2924d925ec68", "value": 2043904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963971, "uuid": "25e81076-a3c7-461d-9815-8bcf51caa496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963971, "uuid": "69aa4ce2-bd20-4130-9bad-9018fcdd9eeb", "value": "Licence_Version_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cfa559-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979687, "uuid": "8723f259-adbe-43f3-bf51-bc47f289d9b8", "comment": "Malware payload", "value": "e2759b5ef495bfcfad9074678497f649", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979687, "uuid": "26fe2f90-1f45-47da-9629-506d17400887", "comment": "Malware payload", "value": "59079dbdfb0346deae4efc361d78844141bf77d916adec96b23d8061e20e123c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979687, "uuid": "90d070f6-d8bb-4800-a5ad-098c31c7aac4", "comment": "Malware payload", "value": "2d85ab32e77ddc0a365985cfd287d5153216a516", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979687, "uuid": "6f42a22d-71ca-4682-9c95-125809807e0a", "comment": "Malware payload", "value": "562a9e64a5c883976d0160aa48543ec04a8f51fc2df98def31299f8b4c5fd5b3cfaaea83f8b5f7fdfc148d3d1baa519a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979687, "uuid": "60a571b9-4307-4613-b7c0-dcad53d4b6e3", "value": "T160F44C4175E3DFB2C67E0FB9C0B14C5887B04628AF67FB4618923171884B7235ADF99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979687, "uuid": "2848b1a6-8b89-459d-90b1-71d885cd6033", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979687, "uuid": "846f8059-d116-44fc-b6e0-74442f60ed01", "value": "12288:Ge+oLQF2xfPAHgRrBDLxa4Mxmx2a6uBTkPMvv:GeplRPAAnDLxatIHBTmEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979687, "uuid": "c3ada563-d5cc-481f-b45a-66fd7bf124da", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979687, "uuid": "1944e5ad-dd74-4678-b9b1-2bdd7262d272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979687, "uuid": "9965f189-4ae1-4107-af5f-ac64ea166728", "value": "Hvv_stage2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d174c7-2d39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774985911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985911, "uuid": "d1514b6e-8aec-4931-825d-a491f4bb858b", "comment": "Malware payload", "value": "20631f21a747e38508450955b26dd482", "object_relation": "md5", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985911, "uuid": "e52ce599-269a-429d-94cf-0b3080bfb1b2", "comment": "Malware payload", "value": "597de43d9bf52baf4d183d232008bba134b7dbb161f3c6c1a2acbc8c266d1916", "object_relation": "sha256", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985911, "uuid": "16a519c1-ff24-4bad-a7d1-71d933a90e43", "comment": "Malware payload", "value": "521391117fb0b90d387841720089de8b6ab222ed", "object_relation": "sha1", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985911, "uuid": "b9a39136-efa0-4c14-a0fe-4758090c6a87", "comment": "Malware payload", "value": "92bab8b6d0aed59a6bd8ab5d65a46b4e57fd23e33d08bc128e5e54ecc4cc64e3a03cb9282e9866c12e634bbea9ce350f", "object_relation": "sha3-384", "Tag": [ { "name": "167-148-195-30", "colour": "#5311A8", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vesifolf-com", "colour": "#1F3254", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985911, "uuid": "1dbd4283-dbb2-4fcd-8b2d-6c63a424abea", "value": "T171B01233C1E48AFEBB5F8C2540061C483D000384C2198BD232C056486C5DE48C331C5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985911, "uuid": "031134d2-4a80-4c6b-aba3-a6bbd915ce78", "value": "3:VSJJFISnMcXR/JJNLNNQXLzEfOWMpz6YTyyN1sh1TX:s8SMOBd+q4rTVmfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774985911, "uuid": "12efe0a2-83c3-4315-8a9e-ea8851c70ebb", "value": 100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774985911, "uuid": "4340af18-c069-4f85-a007-0f92c396b47a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985911, "uuid": "ed8fc400-4fd8-406d-926b-f886d046f6a5", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b7bc7d-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959587, "uuid": "bc1961ae-b5f9-46de-82ee-14062c1ce9ef", "comment": "Malware payload (Mirai)", "value": "999c20befe0b77c2429366b7c88f3f1d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959587, "uuid": "670f675c-c6bd-408d-8d6d-1f6fab3bdd15", "comment": "Malware payload (Mirai)", "value": "5b6399acbc07e044107ef03c275b998306324f53f5442f4c243abdc8bcb27a07", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959587, "uuid": "87d49d11-6a97-41c3-a170-3d0e9ab35c97", "comment": "Malware payload (Mirai)", "value": "92f15fcbad893f0db0f1402ca55e4721e9ebc9b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959587, "uuid": "6df30bc5-e0a3-4e1c-ae1d-0b2a478fa391", "comment": "Malware payload (Mirai)", "value": "6fc9d7fb3fdb2c8d0d27c1fe5e3b16eaa4deffaa05a93f90b16af3543c49c81bf6846b196187e300ad7a63fe0a82e20f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959587, "uuid": "27c2b0f4-f8a1-4964-8e09-e38b27b36187", "value": "T18BE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959587, "uuid": "32d36188-3de1-401a-b59b-c2d5bdb470a7", "value": "1536:p+fTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxZdbK:pYlybKpzEOfGQ+vEubTt4ouftL4FdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959587, "uuid": "651ddb4e-3b3d-45d2-9d04-badffb7d0c6c", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959587, "uuid": "440395e5-505d-4048-b4bb-4d9fc51e0ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959587, "uuid": "6876df3d-9af3-4ab3-8d5e-be763d4305a7", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4eac8ea-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959930, "uuid": "92b0781d-0646-4031-9110-057f7dd51554", "comment": "Malware payload (Mirai)", "value": "4cb046de2cc254902ea2109df7858d9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959930, "uuid": "1bd98322-bec6-4fad-bafd-6583cf0d7ece", "comment": "Malware payload (Mirai)", "value": "5bb83883e0b28002477d2e7107a7c280d40f4d4c46a88e4fa987630b4332e217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959930, "uuid": "529102d8-c588-4488-a2f3-3ffa13bd8162", "comment": "Malware payload (Mirai)", "value": "0f56b4228145182e0edc3b993ef3ff23d0643c36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959930, "uuid": "a2c54a6e-dee6-4247-856e-aa057254c24d", "comment": "Malware payload (Mirai)", "value": "cc1ed4a764002061efded6c370d7d67df929709d5d01f52ab9616744c2508d4e9f07a4cfc5a49088074c8f028d6c5679", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959930, "uuid": "50b1e66e-3714-45a4-bf6c-2f0024ef2f17", "value": "T14573F942BA47CAF3D41708F041F7B63F8E31FD3A493285A9EB65BDA2CA275C16116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959930, "uuid": "1be2f7fe-fb78-4157-812c-157721e25798", "value": "1536:t+ml11IujxuIX9GtkxBP4Hojcs/jjee/riWj8iamQuPbiXaGYjqrU9+X:t+ml16ujxVXPBP4HojcEd/3wiam/DiXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959930, "uuid": "071e54c5-da53-48d7-8219-c48c36b13ae9", "value": 80360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959930, "uuid": "4da07b64-8044-4d6c-93b6-98c878ba773a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959930, "uuid": "0e106499-9b1a-4d2d-82c6-f5a86e546769", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27239741-2d26-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774977731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977731, "uuid": "210669f9-6169-413a-b821-1ffb6ac176a1", "comment": "Malware payload (Formbook)", "value": "07869c66d798278af89ace62bdf25e7b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977731, "uuid": "af78f60d-210c-4e4d-ac0a-23cd8e194e07", "comment": "Malware payload (Formbook)", "value": "5bcbb96bb2579083817104e1e3d882b8d9e55df6974e47d2ba9ee6bc04b17f56", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977731, "uuid": "8a9b47e5-4b4d-4e45-9052-db0fa51f56c1", "comment": "Malware payload (Formbook)", "value": "0b84e5138882a96a94a9f460a49642add1fbe792", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977731, "uuid": "609d3186-062e-4dee-b728-2321744c92c7", "comment": "Malware payload (Formbook)", "value": "3c202f0ac00ce9b85b9053984159cc8cb29e52e632a895f41af802baf8f4d915ddf79830d1f5f7920144aab46b10dcf1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977731, "uuid": "11b8e831-cd16-4a46-bd52-7da405d01f2e", "value": "T1F3653397A8AEB767B50845398F3A5DC1DAC1D394006A694C23EF5CC8F623B2F6BD1071", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977731, "uuid": "89b98ddd-e779-44cd-a0c8-d1962b38249e", "value": "24576:gF/1DFNA6mBVKHDjrZN0zne/NPhWkSnEF/8JzZN2GI4AdTE7z28C6sw9YQLVj2f1:QD06mBIjxN07elxjWZ08UTE+wu8w9NF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774977731, "uuid": "3e0e2eb1-6b5d-4de5-bfc8-758fb27c3cdd", "value": 1506461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774977731, "uuid": "00080906-e6ef-4c37-a6cf-78d441daa5b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977731, "uuid": "8aa69624-557f-4064-8fa0-755250305115", "value": "Invoice BE082.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d6805a-2ce0-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1774947956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774947956, "uuid": "8e159b9f-0f35-4f4f-a7f6-173e2ccca830", "comment": "Malware payload (OffLoader)", "value": "dac9855e5cc2f31f23189c6acabc6e16", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774947956, "uuid": "13389fc7-459d-4971-87b5-0803f3d1e524", "comment": "Malware payload (OffLoader)", "value": "5c8674c16fd7cd1118f412a41e83935c251820ef1fe0e99e6e4a6bb86597658a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774947956, "uuid": "1ab8b998-a5a6-4292-943c-2d34a5b8813b", "comment": "Malware payload (OffLoader)", "value": "0383afd34bb346cfb02024f472284156ce43a957", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774947956, "uuid": "4f487e1c-687d-47e6-aabd-3dd930b75e48", "comment": "Malware payload (OffLoader)", "value": "6c0c66f1bafc632357b4b8749d38eb6abd93dd94e2391e2afab2b89199805c0e920f5f7572257b6b215ae01d3b83f543", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774947956, "uuid": "bec7006b-8991-494b-983b-c15d338325a4", "value": "T159460233B24A633EE07E163B59B6A1605D3B7A21A51F8C4696E44C4CDF7E0A01E3F653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774947956, "uuid": "e3b05529-324a-420c-9056-5e8c1a3299ef", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774947956, "uuid": "c617d375-c3ea-4c4c-bde9-11785978c98e", "value": "98304:+N66UEKTfxPWCIYlzi5hxZWPjUvTYZveJl3JcZitqXsP:+UEKjxPWCIWzirbWPjuTsGJl3MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774947956, "uuid": "61f4aa7b-267f-4ac9-8274-fda826152153", "value": 5753654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774947956, "uuid": "85f4bf61-f59b-41ed-8c7d-f46a08dadc53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774947956, "uuid": "375a5540-4036-4b9d-b596-9e02c76f7f15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397e9f4e-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954569, "uuid": "ed17b686-edd5-45d0-8540-1ac5d6732ec3", "comment": "Malware payload", "value": "6272e557fe2c2649e785faf2efe4a092", "object_relation": "md5", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "so-py", "colour": "#D9AC7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954569, "uuid": "d554e993-8e2e-43a4-aafd-d83e000477bf", "comment": "Malware payload", "value": "5cab6bf65f7836371d5c27fbfc20fe10c0c4a11784990ed1a3d2585fa5431ba6", "object_relation": "sha256", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "so-py", "colour": "#D9AC7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954569, "uuid": "885595c0-bdd3-4de7-be70-1b091cec913f", "comment": "Malware payload", "value": "4a3e8c409af83faccf39da1978ea976c7d8b24c5", "object_relation": "sha1", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "so-py", "colour": "#D9AC7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954569, "uuid": "58e7ba2d-2b09-4366-b6d3-982b47b82176", "comment": "Malware payload", "value": "d2dfd601bad611576513eb6896abc3f49980b75761e443bf6d8cf7b2f0c0aba99cbbcb17b46dc8b9ea1051a36e68a0b0", "object_relation": "sha3-384", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "so-py", "colour": "#D9AC7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954569, "uuid": "fc14531f-b269-44a9-9852-276d9ebe6996", "value": "T174422E018D4895540377AE5CDA36DC42F90A6603D9763C1AFB7C81F93F36728CEA0EA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954569, "uuid": "66cecd4b-2ab2-4bb5-a4e6-b38cdeceb2d5", "value": "192:z3uxvhI/k+BHslPKZAGVN3ukWjgjr0G/yH/slB3956uSUm6B6fIeZ7JuS3up5raN:bMgKGVN3RBf07Ul26o3FJuS3upi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954569, "uuid": "2ed43b6f-909f-4a18-8187-5a14a8d38d23", "value": 12952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954569, "uuid": "a37c07f9-5526-491d-805c-2b15eb3a3435", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954569, "uuid": "dd792c4f-9ee2-4e7e-ba65-48f36ebfabc8", "value": "so.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e5a164-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959911, "uuid": "cb7bed5a-dab0-461a-8999-1457b9df2af8", "comment": "Malware payload (Mirai)", "value": "02605b8f7f7046692c86b405561fd377", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959911, "uuid": "8e755f6f-473d-4ded-9fe5-cac2c60af8d6", "comment": "Malware payload (Mirai)", "value": "5cca438629fa19de537ad0cfa6866450f0ff7f7977ac13a9fab79b9a9fb0719a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959911, "uuid": "f2c0955e-09c5-41ac-a237-038e9eeb7f7a", "comment": "Malware payload (Mirai)", "value": "b4ddd41d447c92c60399fd12c392eb2416ef3444", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959911, "uuid": "449bf069-b2f3-4706-a693-df470382948b", "comment": "Malware payload (Mirai)", "value": "057d4a4cac083beeba5cc71f67f0b94a156831f30d86eef130cbb62e63ab3881707cd5e86cafa49041514a249431f11f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959911, "uuid": "b81d9763-6286-483e-af23-2836f459e6f4", "value": "T131D2E16EA76E9F1BC0478A7C6027C65F452FF8220B0FBA5F792C28460DD3484A47C575", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959911, "uuid": "e64cc184-93d4-4e76-81a0-a9c71b568c4b", "value": "768:+hSe8JC7OiiRK+eyeCYspR+WxmHqBZ+doGO+kVs5:gOxK+ReJgR+YmccdWRK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959911, "uuid": "090f0100-8237-475b-9f9d-89f6b25a67be", "value": 29228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959911, "uuid": "da1b8508-417f-4732-9efd-bc906fd4731e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959911, "uuid": "673b44c1-1046-40d2-b2d5-03f5954a3f14", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc44ec6-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959220, "uuid": "856ed7a7-0ede-4d67-85f7-f4b2f6552ef3", "comment": "Malware payload (Mirai)", "value": "788a4f74ee8442a36fe8f1b5b152babf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959220, "uuid": "45700aa2-d7bd-48be-a0e3-d247d6f9c74d", "comment": "Malware payload (Mirai)", "value": "5cec5ddd20f14caceec9cc0930346d195b3eb18ee86cea14c273e23647a303f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959220, "uuid": "2f502cf4-8a17-4e84-8395-3836d8639be5", "comment": "Malware payload (Mirai)", "value": "c8c5098c04eb8cbb295ac1a557ba4c20cf3135de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959220, "uuid": "f108360b-2bba-44bc-a993-086b035673ad", "comment": "Malware payload (Mirai)", "value": "6a1df3cfb2f60e28b43235a1f248117357ba16a81abd08a27a448e8f4657d899e245ba3978292399522f379c79d16a20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959220, "uuid": "09f43b5d-3cf3-48d7-8ef1-2679d4c34980", "value": "T1D763E591B8825A2BC2E0237EF5BE558E332063E9D2CB722BCD615B117AC551F0C67F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959220, "uuid": "66b2f184-e566-4d52-86e9-6d6fe0c308fe", "value": "1536:+JmVdwF6uS49glslmv/uDWgHFCCntqltoi8vQMcWR:imVdwFXbIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959220, "uuid": "0fb94fd2-cc75-45fc-a823-ab48584496ab", "value": 70876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959220, "uuid": "e02eb0e0-b116-40db-b4b3-62384f49926c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959220, "uuid": "0ca6174e-ec5c-4920-92c3-bfb02f154446", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62741ca8-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774960651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960651, "uuid": "4be2d275-0702-472e-b0d2-af110b1d3db8", "comment": "Malware payload (ConnectWise)", "value": "c2110bc14b04f7d9ab4ba76648ac834c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960651, "uuid": "4c3341cb-6e52-4ac9-98c5-0240fa4df36c", "comment": "Malware payload (ConnectWise)", "value": "5d50143699f7a6d08e8909084400d7da5166958c7f9faa3288a1e9bbda2ffc4c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960651, "uuid": "69a14fda-3d2d-4b35-be09-6e7d3f6285af", "comment": "Malware payload (ConnectWise)", "value": "894d31ef09be5fd54c3a70a13351f0ecf38a4ea3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960651, "uuid": "ebaf4910-9dd7-4807-ac23-b55f1ec5879f", "comment": "Malware payload (ConnectWise)", "value": "e1b53b406588215fafffba2d919c1834702e9a9e57a6c519ca41da6af5ad62aa36674b3d26d3417cb6c5ceb412b97d20", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960651, "uuid": "d6ec8773-40b3-4645-b479-e63aeca2e168", "value": "T1532723017BC6AAA7D43F0635987A632067B4BC414F13C36F66A47A3D1D327C06E727A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960651, "uuid": "ab2fc57a-d98f-4501-8994-21057b8a636a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960651, "uuid": "26b8f8f0-e108-4ead-84e9-0e489838f09a", "value": "393216:khmOvTi7hha62e3N11POvTi7hha62rOvTi7hha62WOvTi7hha623:khmOvje371POvjrOvjWOvj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960651, "uuid": "6fe51943-2e0c-404b-b903-cbe17dc7b13c", "value": 20511288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960651, "uuid": "a51b3e9c-030d-4b08-b7a8-ecd39384abfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960651, "uuid": "4ef41040-396c-4b25-a1a6-984ed511ae3a", "value": "ScreenConnect.ClientSetup2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4340896-2d0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774967311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967311, "uuid": "f28d4a58-da62-4a8f-a153-2440dee4839b", "comment": "Malware payload", "value": "30767275ca828ec1c9d62baccbb0cdf1", "object_relation": "md5", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967311, "uuid": "a632a5c8-078d-4505-ad40-1196a4523ea8", "comment": "Malware payload", "value": "5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c", "object_relation": "sha256", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967311, "uuid": "2769d5df-be58-448d-ba1a-4074b4e351fe", "comment": "Malware payload", "value": "eb7a51fc01b6df699b2e5033fe391e6eac2ef0fe", "object_relation": "sha1", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967311, "uuid": "8c5fe681-f027-4535-bc98-55454d3d3b15", "comment": "Malware payload", "value": "74e58ef3f2834d1000512661d440d4487de1718994d725cbd8fa28a0c493a311d35cb6658713311b75355c88920a31f0", "object_relation": "sha3-384", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967311, "uuid": "df761e71-1ee3-45c4-9598-3be78646fff2", "value": "T1A64154F5F834E830380615E9BDCF31BAAD97D75E56016850A1334C768702A59734F11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967311, "uuid": "6e13ad62-bf96-4620-bee7-a46c542868c3", "value": "48:UXav89jz4Uy0e0wBL9r6X5Kzg02LI/zIL/8uxg9+O:oJ9jzkSwBLZ5zg0yIUEuxgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967311, "uuid": "071efb8f-5518-439e-92c0-3ea0c3f7f36f", "value": 1889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967311, "uuid": "a68df329-c58b-4c91-bca3-9fc93a9001d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967311, "uuid": "cd42d47b-3f8c-4787-9dce-643962abd215", "value": "5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672e03b5-2d1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1774973543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973543, "uuid": "9c85bae4-2bee-4d5c-83c9-4138aa46d6d9", "comment": "Malware payload (Arsink)", "value": "fb20669e799720500f8f716db8c77219", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973543, "uuid": "774ee19b-1c86-4559-bafd-22ffa6ef840f", "comment": "Malware payload (Arsink)", "value": "5e48bbe1c62da18d4c0f2cca0f8855219c5a05f81c5fb64c1b4a0a6871fa8736", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973543, "uuid": "cad37e71-d534-4edf-ad4a-7d996e7942da", "comment": "Malware payload (Arsink)", "value": "c7d14da6c85110033d999c53e958284e437517b0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973543, "uuid": "b0f08ecd-1e78-44f2-b537-c4eb8f11aaed", "comment": "Malware payload (Arsink)", "value": "991ea265d95131f5663db87cf3fce78b3adbe41d21d6647f3222d5470d5df0b37e03efef6af878d530a0fe0cbf2dd851", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973543, "uuid": "070b9bd0-f1ad-4dcc-9cf0-c74daa5107cf", "value": "T152A30295CF28545DDEBAF134219E7BA37EB2EBBAA04852E7181904501CF3B722C8315E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973543, "uuid": "782a5bd1-d8b5-40e1-8400-0197f2caa7d8", "value": "3072:MDATF1ncX/2XWJK647IgmSoaorSwRsuJ9:MDucX+G/43mhlKuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774973543, "uuid": "47224830-2f46-488c-bbb1-fe742c7581ac", "value": 103094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774973543, "uuid": "0061ab51-00b9-44c4-9480-d43bc27de6ea", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973543, "uuid": "3d023f9b-396a-4a40-917b-951c5fca3230", "value": "Say.hello.To.Arthur.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b401e838-2d00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774961646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961646, "uuid": "bbfb2a0e-94c0-4e93-b583-514ce02be96e", "comment": "Malware payload", "value": "a1db89bd6a7530b5491f5759ccfb3a91", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961646, "uuid": "3a5d9f1d-5c3d-45ab-b74a-7fd6f7bfab8f", "comment": "Malware payload", "value": "5f7e51a65bec59d5d3952f66b2549cce5a407b703a73abea3f1057d13cc6859c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961646, "uuid": "226d4186-92ad-44ec-a158-2c8e76992845", "comment": "Malware payload", "value": "d01f9169946285b0f51af6cb246c4d5bb2e39d20", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961646, "uuid": "4ccc4e29-70e5-408c-9c49-409fb1a09c80", "comment": "Malware payload", "value": "c9fb0ffc07ed71e9780b6b57e54ff5c9e878b14ef77bc2f99d7f16502784b43df1559dfd12639d9eea6f480bfb847d80", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961646, "uuid": "32d48fec-eb89-48be-8f6d-5868e6c3f00b", "value": "T18C924125EDC74C6793C3DAA3C1E3D61CBEA840EC801B5EC5F5B886965871E294398F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961646, "uuid": "26c1aa9d-b6a8-433d-9577-30d1d2140058", "value": "192:9p09fiuP/CW+XOQgs/ebQcJG0NtIUt9JhWlnT+spdU5R6uqz8PpFRte+:w9ficN+XOEGbdm0h6+sc3ZqmXRo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774961646, "uuid": "885fa461-3a7d-4e9d-b52e-827b459dfe8d", "value": 19991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774961646, "uuid": "2a45293b-61ca-4d0f-ad74-b60c940a12b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961646, "uuid": "b3271446-ee21-452d-9c81-05aa712a60f7", "value": "foundation.modernService.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dd319e-2cea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1774951937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951937, "uuid": "08aab70c-eb91-4694-93a2-f204d4e437e2", "comment": "Malware payload (Phorpiex)", "value": "28ab7738983e80a61e7f2e39ab12804d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951937, "uuid": "75d875a8-7226-4a41-a119-8381201ceed5", "comment": "Malware payload (Phorpiex)", "value": "5fcbcff1557b61cacdedf23dfdabe5d303a9edafd911d0c8f7d7cecf0fa2ad2c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951937, "uuid": "ff443cf0-ead4-421e-b1d6-23aae0b6bd85", "comment": "Malware payload (Phorpiex)", "value": "b07232d0e8396878f8aedc444d8721a5fb92aedd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951937, "uuid": "48d25552-fd5a-43c9-8a5f-58437e888ece", "comment": "Malware payload (Phorpiex)", "value": "1357e2e1421e9c1d2857c62682a8879712fc65d6404fb5e6eae57a062445863b7c57ce176f7a7a8871c009c7b40e83a6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951937, "uuid": "7e37b2a7-3113-4c97-bcc7-487861386519", "value": "T120823A0FB8424326E0D110759A62867BD979947673D824EBFB904EEE1A687D1FC3324F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951937, "uuid": "2a75f5da-5b06-485d-9323-759983d78f6f", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951937, "uuid": "d9a87183-a21a-4d3f-9662-0827d8271ab6", "value": "384:kI0VxZjwvcvB0zrfbdAyD+Nhav8U9clS:uIQ0zrf5Awgha0U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774951937, "uuid": "3fc6d12c-13bd-44cd-88fa-af5b68a97112", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774951937, "uuid": "1c06c7ad-ee62-41f3-be0b-30fee5d88673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951937, "uuid": "79ba80ce-60f6-4892-951f-34950812372d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18625c30-2ce8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774951077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951077, "uuid": "99097443-2361-4214-bed1-d86e62fd1387", "comment": "Malware payload", "value": "04e3073b3cd5c5bfcde6f575ecf6e8c1", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951077, "uuid": "b720e8da-5333-491c-83aa-1394ba217e7e", "comment": "Malware payload", "value": "617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951077, "uuid": "092000a3-08d6-4f38-8575-37ab8f6af562", "comment": "Malware payload", "value": "a90c26e7cbb3440ac1cad75cf351cbedef7744a8", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951077, "uuid": "e5464441-91fe-4e4f-a133-410780ad54ef", "comment": "Malware payload", "value": "48454b6b03c7d7bfd1033434420b70813e3bbe0ade94a1d242c73fcdc9d9137b78c39a3a09a08ca7a2d1c132868c722e", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951077, "uuid": "e71b6135-1d15-4c2f-a8ce-af3b7bfdc008", "value": "T18A328410391BD02456F76329DD57E448FF26413B23651410BEEEC5D42FB096ACAB8FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951077, "uuid": "32665933-7c90-4b29-8246-f7ca4c2e0b8a", "value": "192:b9u9gG89mD+SOzuahCnGX1pybp0j5PWFmFBiMluIY26qb7cTOXAWumPTvCfuYRNI:b4KG8MwzuaEnGDPWFsBiM9Yy/LCfj7H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774951077, "uuid": "f082ad70-f8a2-43b5-bea2-a5a9bcc6a743", "value": 11042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774951077, "uuid": "e3a766b1-e388-49a9-9514-d8a54d045d5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951077, "uuid": "0665df9a-ff51-4ef3-a7a6-b5b0c52288b6", "value": "sample1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de197bed-2cff-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774961287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961287, "uuid": "f72fe6f3-3952-4170-aea1-c6147cc0ba0f", "comment": "Malware payload (QuasarRAT)", "value": "2eab70552cc744eb56257fafcd89164f", "object_relation": "md5", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961287, "uuid": "c4a75eb9-3619-441c-86ab-f7bf74905691", "comment": "Malware payload (QuasarRAT)", "value": "62422d922905d43ae0ca2917f7b6f95a539f3e477e084430aa643f0069b0054c", "object_relation": "sha256", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961287, "uuid": "ea90b698-c137-46e9-94b6-8c845bc6ba30", "comment": "Malware payload (QuasarRAT)", "value": "386e135ea435a92ad89af2bc6afbb6ffe33b53cf", "object_relation": "sha1", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961287, "uuid": "62410f03-9ff9-443c-bc2b-55c9fa0be92c", "comment": "Malware payload (QuasarRAT)", "value": "63f22e7eacc44908631c99a23fd7d33b3c39851d01938bb6cfb2ea2f0840fc9639d080225aa5c4b31a74b8b584b5813c", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961287, "uuid": "7c963954-bf05-4f26-aa4d-6cac83977a87", "value": "T1D252A92C09BDF95893D9E303EA99F7276D4A5CAFD2B975172AF28C6CA0024C045DB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961287, "uuid": "55a13c0c-8bc5-4ece-a67b-cec25067053d", "value": "384:Oln387tieGFkba2avozgOS0bEo+fZhBIcSLtI2hqUV+y0Y1oilIkSXWdAvFSWsuI:6YX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774961287, "uuid": "b36bb81d-e188-4f39-8f92-d6974fb58454", "value": 13355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774961287, "uuid": "4b23e804-1542-460d-a62d-6bd2b989a288", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961287, "uuid": "d5d7751b-a253-414a-9823-c834f5a4f7c9", "value": "test.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea888c81-2d3b-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774987078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987078, "uuid": "c577bcb7-c513-4644-b469-5db2b4cfbf85", "comment": "Malware payload (SalatStealer)", "value": "b38f2bd4e6d256b94d7d180d70274683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987078, "uuid": "e67c18c9-5802-4ea6-8b38-8469efbf9d86", "comment": "Malware payload (SalatStealer)", "value": "62426ce63b5126457a2b02865de951292b78c3d5c74bb81ab341647b87cd9ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987078, "uuid": "aecf4a2c-4eea-49dd-a31e-e0cc083017ef", "comment": "Malware payload (SalatStealer)", "value": "caf7c1fe161459e8bcd33677b5b6c2e32c95c1ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987078, "uuid": "c826f30c-45ed-4901-a6bc-07956f51878c", "comment": "Malware payload (SalatStealer)", "value": "fd7247c1799436909788d406f9bec906a916657ee98da8bbe9cec4c05caff57958ee86d33ec889f22c210dd588e359fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987078, "uuid": "e8b13fef-fd7a-47c9-880b-830fd4059813", "value": "T189D65C11FACB54F5F903583140ABB27F23315D048B38DB9BEB547B2AF87B6A1196A704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987078, "uuid": "8648f1b8-169e-4fd2-a93d-790c534aab9d", "value": "98304:Oh+R39x63rXViKFZdzsEQzglMq46G2IftE:ZxUBFjQzgiqS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774987078, "uuid": "8f2b15ea-3382-4ad1-9660-cc723ecd8d7b", "value": 12931072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774987078, "uuid": "a736464d-858b-47e8-a9ec-42788c47f15b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987078, "uuid": "c4349dab-8d60-4c1b-af05-78b525fa0e5f", "value": "Salat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59a2dcc-2cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774955207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955207, "uuid": "1815aa69-34b9-454e-871c-aa2ba109b26a", "comment": "Malware payload (RustyStealer)", "value": "33c53fb37d5b19bc8de93dd975d00c7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955207, "uuid": "067ef07e-22b7-4455-b064-0db9d655bd8d", "comment": "Malware payload (RustyStealer)", "value": "629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955207, "uuid": "de1b5800-cc93-46c8-b651-9ec5d6de5b9a", "comment": "Malware payload (RustyStealer)", "value": "b7a104e62f120f793015c78fefd1a5c4be11ec57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955207, "uuid": "ef66f6ba-0479-45cf-993b-9f96a39ff89d", "comment": "Malware payload (RustyStealer)", "value": "518a6e4ad2c6f7b5e38b0922a1298945589904d0e92208734efbc18886e44108ec15800af33a0897b48939a77f99cae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955207, "uuid": "039d1c13-2140-45cf-b3b0-faf1d08650b6", "value": "T17E844A11FB569CFCE066C474C25685636E3278DA0B22BDEF12D841393E6AAF16E3C714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955207, "uuid": "df998a49-b94e-4cd3-937f-a2f9e3f606c4", "value": "13148ba0b79ec7971d60872892734c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955207, "uuid": "ca891599-847a-4d26-906e-b7ca083eedda", "value": "6144:59vb4iX94WgxNfl0bh5rHOhMKpwp04vMwRaDRwLRlLOW:vbQanruap0BTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774955207, "uuid": "f8798088-bb2b-4d87-b3d1-430d012f75fc", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774955207, "uuid": "01fdf336-bb68-4b35-963f-ffb809805256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955207, "uuid": "c37da3b7-a5c6-4df3-87d8-c18384aa44b2", "value": "acrobat-update-service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8df85b5-2cce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774940233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940233, "uuid": "09d3acbb-34b7-4ab1-a161-2dd48f55d905", "comment": "Malware payload (Mirai)", "value": "ad7f4f3f3f4858ab87dd282c80a9f2bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940233, "uuid": "936e10fd-9223-43df-a9f3-7ff1b8a8f968", "comment": "Malware payload (Mirai)", "value": "6315f1c7256ad9519885224c89dce8582f7ecdff2a6c8de3ca51375fa6393f0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940233, "uuid": "cedea8dd-bc8c-4b8d-aa12-cff1b39bc3a2", "comment": "Malware payload (Mirai)", "value": "71ebdfb7a3171d957851d792f735d51eb9807d29", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940233, "uuid": "c061f9b5-3fcf-417b-bdd6-18cf08557c16", "comment": "Malware payload (Mirai)", "value": "03fc774a983f09943941a0f34c8a5b7553f13372e922d26f8f6a2bbf38ef5bb74b139131d6f486b9dd8ca88078e691de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940233, "uuid": "e0771fad-d1a9-4e7f-a67c-f5dc75a32409", "value": "T10F13F1CCD3FFD47862BB6266721516F621AFE473B2AC1F3C11288A04112A138C9E5B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940233, "uuid": "e2a0e181-c66d-4400-b06f-2f4f38ad777a", "value": "768:pQ4k/BAprTotghX9yUG+u4RsbsKssaaDCdGbchFp1yHPVu+Rlaq0eDH:63BARn9ju4RYVLDCYQDnyvdlaCDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774940233, "uuid": "b070cbea-df65-4d4c-96b9-b4159ec962e5", "value": 45394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774940233, "uuid": "865bee8f-5d1f-41b4-beed-42c166228124", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940233, "uuid": "f49f4618-ac37-4300-8334-86bed1d5e845", "value": "24db1fd9_naxerez_arm7.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a54aec4-2d25-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774977495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977495, "uuid": "aa90c5e2-831d-4790-9075-d23aecd9d084", "comment": "Malware payload (AsyncRAT)", "value": "fe5ef7ece1cf5525555f61fab44423f5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977495, "uuid": "31c9fa3f-9297-49fb-be90-19080761ad59", "comment": "Malware payload (AsyncRAT)", "value": "65b912304a9ea084a79024eb215644b0b3b068da5bc475e681e0f09ba66e6f65", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977495, "uuid": "83a5d5ba-9ec7-471d-9297-10605bc1430b", "comment": "Malware payload (AsyncRAT)", "value": "d844aa293cdf2c34c7ce77feeba484566f4b1a56", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977495, "uuid": "f32b5c0d-89d9-438e-8c9a-e6487c3e6da3", "comment": "Malware payload (AsyncRAT)", "value": "9f95a35d2b671480774dd46d1f4cb42e4fe9e7d4c5fd21af35279c4533a9173e73b1b105297622a10ef7a83becbc4ba9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977495, "uuid": "6190a249-1fda-4643-ac65-f60d17bfe624", "value": "T120D524E22D30F9404D2A55DFF4B7497555DD624058A4CD3E00E2BAEFCB21B88B369BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977495, "uuid": "a6cc5aa8-298a-4490-96a5-433523045518", "value": "768:EqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAqAg:fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774977495, "uuid": "f629407b-f2c3-43aa-911b-708c84235d77", "value": 2812276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774977495, "uuid": "d780095b-3c87-4092-a61d-cd43fda3bc9d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977495, "uuid": "67115a6a-0666-437e-870d-e8e286976c3c", "value": "Purchase Order_0393848_IMG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3a748b-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959219, "uuid": "c6f89ef2-8aa9-4956-80aa-b133c1eaf759", "comment": "Malware payload (Mirai)", "value": "b0fbdec136bcc877bb0a87cb678e920c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959219, "uuid": "366c205c-f54f-42a6-b7f0-b377a3e6a3b7", "comment": "Malware payload (Mirai)", "value": "6638c6aae5f21777821af608664aa93598dad45dd84510045f8aa20b7ea8f71d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959219, "uuid": "6d5fc452-805b-43a4-a30e-ea7d131b8500", "comment": "Malware payload (Mirai)", "value": "7278a641885b499ed01d82c9ffe63b4cfaf0e182", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959219, "uuid": "82d492f0-e0b2-45b2-ad4c-19e41adfb869", "comment": "Malware payload (Mirai)", "value": "bc92e9ca2c3cf530c75911d9f30732bb441c3a8b707385354df71cd1e636a74ad0efb9c9b5ff2900f96548e2fe3b4132", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959219, "uuid": "a5184f04-6a9f-4b47-a148-b7f9a88fc21f", "value": "T10EB2E10D3AA61A4FD5A5D0B9582E19DD2832F2405AFFE724333F019EF21B165EC28DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959219, "uuid": "25d2424b-1f86-4e89-9321-f098697793e4", "value": "384:MzdHFiFkEAgsHff1OPg1JZB4T9mHZP7h2s7oCyCKYxdkKyd1M+v1R8:o7ivZs/fIPg1JuUP1V7pynkdkKG1H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959219, "uuid": "3a658f33-842c-42b4-91e5-c1bcb1cd9cfb", "value": 25456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959219, "uuid": "611177c3-f1aa-4283-9b8d-7dcb2d3ebe21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959219, "uuid": "dccf7b0c-c323-492e-8190-fcb0e01304b9", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad47674f-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959917, "uuid": "aecbf3d2-b5c8-422d-b5eb-14b16d8d553b", "comment": "Malware payload (Mirai)", "value": "3d739371a3ab3ff1e506e9bd51d2e2fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959917, "uuid": "3b77eca3-1a00-4877-b684-6ddb3208f360", "comment": "Malware payload (Mirai)", "value": "66f0376af858ea10597b819d8fdd93f14ddb9b7f5acb0b7070f4ad9e2fbc4e12", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959917, "uuid": "ae05d82d-cd4a-4a90-848e-bd8e00205727", "comment": "Malware payload (Mirai)", "value": "61d0cbaa14c82d38398614c99c7819ba4b9e51b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959917, "uuid": "0504160c-a522-4bea-8345-0c6850eb9bdc", "comment": "Malware payload (Mirai)", "value": "8cb41fc2ad920191bc1b7141614750fe8e315102ae72ddd6f20608e6c4765a44d9ae408a20717358b5ede12bf8fee06d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959917, "uuid": "b23380d2-30b5-4b08-9500-3663f01620e6", "value": "T189D2CF3C690940DED57B42FCE7E10B083E911DAD3C50FD0A6450AAD6E9966F0B29F9CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959917, "uuid": "3beeb231-11fa-43c9-b299-b262f6162122", "value": "768:1oV+dOnq6bj9EGyAhsI5izUBEZBWFPewWjwXduo0iEvJgGlzDpbuR1J6:eV+dKd/ZhsIOUBqBWww8wZ0iEtVJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959917, "uuid": "929ae87d-2506-43b7-bf4a-a34e4ddb90e5", "value": 29500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959917, "uuid": "921f225a-0bfe-48d6-b338-90f2fbb83ff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959917, "uuid": "bd76e5a2-e1fe-4521-8a40-38c5cd0c9c03", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075a9c38-2ccd-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1774939452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939452, "uuid": "be23a4b3-5cbf-486c-b63c-9506db04fa13", "comment": "Malware payload (XWorm)", "value": "eb48682aeb8d1784f0a88db8a6c669ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939452, "uuid": "d1b29958-440a-43b1-95f9-f3f29be8511c", "comment": "Malware payload (XWorm)", "value": "66fb626f170a025d139e06a3217b8ac5dd002347395d231b5597a9e15af66949", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939452, "uuid": "2a2cf4a3-ee43-45f0-8a51-07de02c066bd", "comment": "Malware payload (XWorm)", "value": "7f2b8d06f13184e6fedbdee3640194bb466dd1a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939452, "uuid": "6a82e06d-17e5-4a78-a6d7-8e5b28d3429b", "comment": "Malware payload (XWorm)", "value": "bdc35bfc6ced2f28d9a57c55be91a73ac7680a4ff4642522396b649d8b5f6476257ec39585f9f508ceef94937f46f3ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939452, "uuid": "9c45ce46-7931-4efe-b167-9dbe311561c3", "value": "T16D85C0A545DF06ACDC107204A84138A6ABCFD85DBE27C47BFBC5E0D265F267E9188E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939452, "uuid": "0b91e00f-092a-4f80-88e7-7309b41c53b1", "value": "768:8R2O3yvCISRb4KSPWXpfCi5Tm6w1dqbGFLsS2Km/Wjior8zm7p+R93RLTm6w1dq2:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774939452, "uuid": "d34870c0-3a0c-454e-a957-60b48043c0bf", "value": 1793310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774939452, "uuid": "83340a80-01e0-46f3-a57f-b54b830f7b17", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939452, "uuid": "a1ecd20f-d087-4670-b06f-fe65c91dfc37", "value": "DSB confirmation of funds transfers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9958da1-2d06-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774964206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964206, "uuid": "6fcd6d7c-7f58-4d42-9c98-5f1804a84de1", "comment": "Malware payload (Vidar)", "value": "f842d9e83ae9efd7cf72d73219013d78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964206, "uuid": "23dc55f7-4588-495b-8feb-6b01e9e75ac5", "comment": "Malware payload (Vidar)", "value": "694bca134d88e0b39d65e38f7d5738d63bb93172ba722b5aa1651b1d94ce0aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964206, "uuid": "2317ac82-d251-4d11-8048-fb4303264f31", "comment": "Malware payload (Vidar)", "value": "610c0a8f5d6bbc7a4e1c226de3ec01c9683f190c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964206, "uuid": "ce29e653-80a5-4d59-828b-701a9ffd8464", "comment": "Malware payload (Vidar)", "value": "d1839ae6b19c2f9d74eae013836d29f6198af2a3f3d0f3630f2327e5cd4ba648844952444a88b197a36cc32bc6b97cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964206, "uuid": "06a936ad-dcbe-422d-9e43-15f53cae1489", "value": "T120A57C1BBD9548F6C46A973388B662917BB4BC080F3223D36E9076782F72BE45D39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964206, "uuid": "16467335-2b8e-4bc2-8e0a-a2a0ef84e21e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964206, "uuid": "529e34b8-42d8-4382-b6d1-1bdae8682c25", "value": "49152:v9iL1ieVh7u6BFarFGNsxOrW5Zu4CP8O:v94ZRLBcGmTZu4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774964206, "uuid": "44260566-27d0-4b42-9249-0e6719066d14", "value": 2215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774964206, "uuid": "8b823ebf-136e-40f7-8d09-41320ebbdad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964206, "uuid": "c63785dd-5fcb-494c-b6e5-9e62351fe85c", "value": "Sailo-BGoo[t].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4356620d-2d32-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774982932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982932, "uuid": "b6ddc60e-7a9f-437f-a71a-1f9263e82631", "comment": "Malware payload (GuLoader)", "value": "c479926ebcdd3d04713b1432b76ea636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982932, "uuid": "72881201-322b-49f7-ba24-5dea44bff918", "comment": "Malware payload (GuLoader)", "value": "6a7fcdcfef6ee8dbfdecd5b6355a45afdaca8bc22d195fe3956dff68cd7851b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982932, "uuid": "b8162ac6-7699-4d7a-8e1e-2504e04f30ec", "comment": "Malware payload (GuLoader)", "value": "1f7ddffeab4660bb48219f0f79ab7cb7d9cbe9c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774982932, "uuid": "f409e333-74fe-42ca-ad53-e80c31c2fb7c", "comment": "Malware payload (GuLoader)", "value": "76ee73aa384e3db39af458c9475ce4c55a7a693b8b2065ffc5e3a1e46115d53a653e856bc9b01253546a03695379d2b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982932, "uuid": "7ea14dc5-6af5-48c8-b07e-ddb1ec7eddf6", "value": "T186D42214FA93C88CC91C45F03EB68615D7D4AE6C2A6D091B9FC2BAD1B1FE853D62C352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982932, "uuid": "f0ddb2bd-8461-4c32-af30-77df55f65b15", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982932, "uuid": "c559a346-9982-49cf-b05b-85980fe911a7", "value": "12288:r0yeHITloKtdv/5L5TLfyUVTAGZ3LUbBLGCR2pUOos7gARuQ:MHIppN1fyArJ+2pBgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774982932, "uuid": "83caf830-90a9-46b8-8b4f-8f3dffd11c70", "value": 603417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774982932, "uuid": "81646315-550c-46cf-94bf-0e68cd4bc4b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774982932, "uuid": "6feb9d51-77e4-41f1-862a-f95c04c0449b", "value": "AWB524967.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d9d603-2ccc-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774939175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939175, "uuid": "11e20221-ef52-4d5c-87e8-bad2b5c0e2cc", "comment": "Malware payload (GuLoader)", "value": "1cedef000c6ff6f285a05cdd7aaa5da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939175, "uuid": "03b76b44-4a71-4b76-aaf6-7f48f6255700", "comment": "Malware payload (GuLoader)", "value": "6b0160f66895ab61b35d67e246d3a5855ba6788fa4416680bea57ea2d1f72de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939175, "uuid": "689f55e7-96c8-41fc-8663-8577e0c55a93", "comment": "Malware payload (GuLoader)", "value": "4319392de6b1c3fd58982da578ac89eb70c0318b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939175, "uuid": "7d5a899e-f798-438a-8755-d21d2724c5e1", "comment": "Malware payload (GuLoader)", "value": "db3cea0d35d31159b9687bb1bc051f62b6ec818171d54cf9b228d13c54a226198452fec6f8b7f62d5eefb072d6ca87a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939175, "uuid": "a5ab1579-458f-49e4-840d-f12e8e3ecff4", "value": "T12C05F1C26608A9A9DA77B3B1AE2F6EF103C339352950D3DF26C5631E45B1F23011B667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939175, "uuid": "f4148477-036a-4592-acee-8da1c2b10110", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939175, "uuid": "60d6f9c1-1884-4ba1-9225-27d26346b56c", "value": "24576:bC3lq8aYT++MISBc8Xn3o30epj77/EBboj980J:Ml2hLIN03o30ex7LObc9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774939175, "uuid": "dca37813-3b46-436f-a10f-ebae67732c78", "value": 811488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774939175, "uuid": "7f865a99-2e1f-45c3-aeb6-fabfff80642d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939175, "uuid": "a9cd12f3-8c0d-40cf-9899-42a4c4ab3cca", "value": "Drawing & specs.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dcea1f-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928820, "uuid": "59b124aa-ecd7-4f58-8394-5851e5222937", "comment": "Malware payload (Mirai)", "value": "78aeaa41a9f8afcb519066bb2dc6fb9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928820, "uuid": "0d907a16-c79a-4de2-bd2a-c6b4127e0df8", "comment": "Malware payload (Mirai)", "value": "6b284ea2f2ea14efc8d680695891ca694361ab035ea869ae0be615f5c54992f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928820, "uuid": "94e2757b-731f-4d5f-afb7-f86d38c4bc29", "comment": "Malware payload (Mirai)", "value": "585d13cf4cc763bce479f159ec1bad21b4d77baf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928820, "uuid": "3f43c6fd-71d3-4c02-bac0-155c04f5ef3d", "comment": "Malware payload (Mirai)", "value": "f5f6f0f26f5176351de9337d819c3de00eced34197543402ffb228eeb842dfaf1b937fcfa8f508756d0612826737e76d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928820, "uuid": "fdb307dc-7738-4b8b-b90a-47de229340f6", "value": "T1FFB3089BBC91EE694AC0137BFE2E418E330727B4D1DF71139D141F58B68A94F0E6A642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928820, "uuid": "7e0530ca-0a39-43b3-bbfd-5f6c7eb74970", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEa:T2s/gAWuboqsJ9xcJxspJBqQgTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928820, "uuid": "bb2a3092-e6b6-4d27-bda5-225a151d7221", "value": 118080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928820, "uuid": "14b3ec24-b51c-4e42-911a-d04f89d9758f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928820, "uuid": "9e281b91-2172-4e80-8b2e-70fccc57edb0", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933fbf79-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979630, "uuid": "00f01b86-c2bd-411b-b157-43cc9d523997", "comment": "Malware payload", "value": "796eeb0b6e9236579ea56cb7be4d3429", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979630, "uuid": "0c4933a0-9fe6-48d4-9436-a246d8f627e1", "comment": "Malware payload", "value": "6b45e1a38609b9b7f2f2508b0b38f700a75ee1ea9b6c548d1a086bd91863efc3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979630, "uuid": "2d5a3aba-273b-44ac-a0b5-81d2e7891ab3", "comment": "Malware payload", "value": "8c1ca7351a5456dcb98e63c7e51f387918f52661", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979630, "uuid": "17c46f47-2895-4947-8d0b-7c93f5e4d5b2", "comment": "Malware payload", "value": "99ec7ad98df62c87602fca9a525eb473077a22f669f8b620a7148940e24c77492095408cd0e1c02c5c931df5a20bdb8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979630, "uuid": "2ddf0706-c652-4e03-b711-782b8ec3f7e4", "value": "T1D71180432C08DA2C6CEC624160DDC88485FAD1161BF0F3E659D0AE6E0572A204D1B4BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979630, "uuid": "d8c45b48-f482-49bd-b6bd-3c9fb3b43cbb", "value": "24:7bjGkLO7mW32R6HaclDHZiXNKHHxclDHYiXNK4H8KoclDH8KTiXNJMp:/u2RsN1jnq1+K8K318Kdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979630, "uuid": "c0864a6e-8b7d-4a93-b12b-5765c7d5c35f", "value": 869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979630, "uuid": "5e608785-d34b-4bd4-9c23-cb23bf2eb340", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979630, "uuid": "8037cbab-5438-47b8-a194-33b018a53d81", "value": "UKMar30.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5892e009-2cd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774942166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942166, "uuid": "76d8bfe2-303c-424e-b48f-4ba969e30344", "comment": "Malware payload", "value": "2611a5ad80dcddf3fd6b388b7e32e1c2", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942166, "uuid": "f3dca863-b106-44ac-86d7-4323062d1c31", "comment": "Malware payload", "value": "6df062ffcb7dbeddecd3107133e13b87f59b655e0861a66a780ba57702cb4fb8", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942166, "uuid": "87c7737d-ea84-4432-ab43-d4e7061c77c4", "comment": "Malware payload", "value": "8a9a813c66d2d6e5e1793adc0019b11ecd4b3229", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942166, "uuid": "b614b713-087f-4030-a71b-fdad4beb976d", "comment": "Malware payload", "value": "e88c49bd49e69f528ce7167ae48eb8e701ebf705e126f610c29ad9927eb9468eded363e488ac9f8765e1b287c767dd75", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942166, "uuid": "887b4670-1570-4841-ae89-db0d2db5ce84", "value": "T1C1A2D0C09DECEB98CCA58B21E5FC200E73A0D1D65939DC8D57272D5DBE3A2D02BA7065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942166, "uuid": "45647ce2-caa2-4714-a4e5-9285bb98b497", "value": "384:kPsWWxuUp++bPznn2eNithb51OUtqgF+mY+0ROwLr7Rfd9E5axsojkol9Vb7Dgcz:kRUjPznZshb52gomYNXtfdJvIol9Vccz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774942166, "uuid": "af715745-10c3-4205-beb4-7eaa1b5abf71", "value": 23316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774942166, "uuid": "18c894ff-ff1d-408c-b5c4-66c32b9b2143", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942166, "uuid": "3ab89b92-ef08-4536-95ff-cb8ce23dd769", "value": "6df062ffcb7dbeddecd3107133e13b87f59b655e0861a66a780ba57702cb4fb8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c385455-2d0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774967619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967619, "uuid": "cf9a391f-3039-4693-9b17-aee3ea01a87a", "comment": "Malware payload (Gh0stRAT)", "value": "c38d4c44299900262ead7357c244029d", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967619, "uuid": "877fa431-a7cd-4836-8278-6a969f53f35c", "comment": "Malware payload (Gh0stRAT)", "value": "6e46826d1adf2d0674e91b610df825620f2eef0f17b8280a6ae9362d39354e44", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967619, "uuid": "e5e6c50c-4360-431b-8a77-fb7f83f34dd2", "comment": "Malware payload (Gh0stRAT)", "value": "30b24d635cb53b3f0bbc7ec0f39942cdeea3c873", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967619, "uuid": "6d6c447c-17c9-4099-8263-6ac80562527c", "comment": "Malware payload (Gh0stRAT)", "value": "d57a0a0e5972760190766520056d3862032a3b00d301804b7525af8ecf854def01602bbae1f509b1d20e745f06dbb472", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967619, "uuid": "3a36c684-d784-411a-949b-c8ab2a0ea499", "value": "T17BD73321759DC272F65F02B15A2ADA2BE17C3DE20B7004DB93E4F99A66314C25339F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967619, "uuid": "94da368d-d7e7-4b74-8005-998c748f5c02", "value": "1572864:nxss0JGkG9GcOdMfxtDxeR8PVl1oAxk3dqwlD3dgIiWF:nqXJ8GccMfxFER8Pj1/K3IwpN1iWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967619, "uuid": "7430830c-9f40-48ae-9c7a-46fcdcd019b5", "value": 59044864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967619, "uuid": "86ff316f-9d49-4cec-875a-9cc09650626e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967619, "uuid": "2cccf4bd-1ff0-4a7b-9c9c-2415584bf243", "value": "MSTseg-Teuier-x6.3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d53a24-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959928, "uuid": "dc34ca2b-e906-4a28-8239-fccd3884fb84", "comment": "Malware payload (Mirai)", "value": "f37a37e4b27a75cb377490f5dd2db599", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959928, "uuid": "95f4ffc1-b130-4fcc-a563-8f1187a0d79a", "comment": "Malware payload (Mirai)", "value": "6ee95d5ec5b2abb64202fe0f6fee953947e11764bc2f830ce139633d5755c63f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959928, "uuid": "a2868d34-6547-4326-913e-6ccb08936bbb", "comment": "Malware payload (Mirai)", "value": "0bd148e458755e17022316b35d6d17c27ee57c99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959928, "uuid": "a5485b4f-ac5a-411a-b5e1-9af88288dc92", "comment": "Malware payload (Mirai)", "value": "cd9abfc92302ba6d76888aa42fc52b6268ac2170711265cf61228a229eb68f7f346329158851115156e7bcedd50b11a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959928, "uuid": "26f434d4-8bdf-4ac5-9c53-ab84c76a65b2", "value": "T116C2E130D1D6ED2186E02075B33AC7D121A767F972D9B72A2B8147B8B38E6645190ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959928, "uuid": "062f12b2-39c9-494e-a3af-9d2c64a117c2", "value": "768:kUvDr4vtMf1XofdA5EfZ+Yz1K4FaIVs3UozF:kUvDrYSYlAHCaFzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959928, "uuid": "9434c291-fa67-45ab-a89e-79da87688240", "value": 27272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959928, "uuid": "50fa3c09-92c1-48c7-9688-8bb5fbc3b78e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959928, "uuid": "b547b2f1-bfd0-4d85-a640-035d5073b7c6", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fe3ddd-2d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774972122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774972122, "uuid": "c9726e79-6b96-4d06-b6b6-42b9448a7aca", "comment": "Malware payload (Mirai)", "value": "cc1df0c4ae0b3f1af0362cee2d421bbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774972122, "uuid": "2cf517cc-556e-4f8c-8dc1-9b98fd3bc419", "comment": "Malware payload (Mirai)", "value": "6f71f386d698041999d5d5435b6f6e333755680acc320a1ce5005d4cc11cc08d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774972122, "uuid": "ed3a0d84-9f44-4310-9256-d2135433ee63", "comment": "Malware payload (Mirai)", "value": "92f1d410b80d5adf3d8ebf418ed896a39e819459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774972122, "uuid": "2c72ba27-38bb-4309-a69b-1c883cad358c", "comment": "Malware payload (Mirai)", "value": "3efc74181b534607b74c8b23428d96dbf9161dce4a1ac8be9f05b776ee4265adb24b0b28cb93bc6e1cb7f51789e6c72b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774972122, "uuid": "a1645441-e60e-467c-9cc1-0364266f12cf", "value": "T1DD14B81A6E228F7EF268873447B74A259B6D23D627E1D644E1ACC1105F2039E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774972122, "uuid": "1eceda5d-eb17-4f98-a780-155e58cfe119", "value": "3072:fl+quvEVTAcFvV7kVnEtRA6T+Ig1oJGvwn:QqfVTV7gD6TS1o4vwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774972122, "uuid": "7e4da234-d3d8-49eb-aa27-4beb5335edb0", "value": 190480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774972122, "uuid": "87194efd-df24-4430-a4f5-40e2267eab00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774972122, "uuid": "d10ff035-5cfe-40f0-b15d-3c586fd7021f", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc6f821-2d0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774968209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968209, "uuid": "98e9d82e-70be-41f6-b370-10cb049a7b24", "comment": "Malware payload", "value": "cfe841e08e589d53e5b520594085d457", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968209, "uuid": "6d44c26a-f284-417d-9330-a3f90c304de3", "comment": "Malware payload", "value": "6fbb418b08f8b0511dbac05fc942676d16fc632eccb99b9c72dc5c9300f3c14b", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968209, "uuid": "51f24751-d488-4add-9ffb-70cccdac4427", "comment": "Malware payload", "value": "d3300b46bf1a905313073271f61fc5b4510e4d3c", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968209, "uuid": "d0a744b7-000d-43d8-a6f2-4c233ff9cc66", "comment": "Malware payload", "value": "955f4e6c9dc5236faee10a1230aa84f0893f3a15841c0fec008d526c33b699c2ee1ec66f2938a277ac64f37cb9331a24", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968209, "uuid": "9435f6fd-e16c-4faf-ab13-16a3b3e38619", "value": "T19022C71078BAD42057CB2139D9AEE4407D398117224C1D10BEEEC7D49F96978CEF93EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968209, "uuid": "8d005049-c51c-414f-8db1-8373ee74bd2b", "value": "192:Q9K9RDp96hJ3a2vZvg/e1ZiQSsWyoitJiCPEVsgaiZOiF9MCynQRvQEwVyfcHynK:QEXDpEj3a2Rg/YPEEiZYADcSJMwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774968209, "uuid": "afdb276c-ece8-4125-bbc2-016ee3a0d2cc", "value": 10597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774968209, "uuid": "704ff6cb-5f7a-4943-bd9c-6d0ae22d0247", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968209, "uuid": "8d102877-aaac-41ea-b8ad-a3bd5127290b", "value": "6fbb418b08f8b0511dbac05fc942676d16fc632eccb99b9c72dc5c9300f3c14b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d18c15-2cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774955309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955309, "uuid": "f1010f41-f1a8-4758-b5a2-75357ed21261", "comment": "Malware payload (RustyStealer)", "value": "1252b79b0989508b0ae287f76ce3c4bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955309, "uuid": "4535bc1c-3cf1-4fd5-bef9-cabc1aa2c268", "comment": "Malware payload (RustyStealer)", "value": "7063f9bc5a6f8f7570d5176f15d570a7e0a69bf60725feebd1ce7d642e378004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955309, "uuid": "d13bf13f-38ba-4afe-a22c-25aef2975ed4", "comment": "Malware payload (RustyStealer)", "value": "14061ef7038820fbfd15fd5dcd3a863fd85f9886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955309, "uuid": "9081487c-3630-4bff-b20a-8db7e921a61b", "comment": "Malware payload (RustyStealer)", "value": "09f75db69361217d5f22537696c519a0909d206c3814e50cf0ff674b659d9804d5cf24a0289c5da086af92e2a7ae3637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955309, "uuid": "90c8719f-4711-44ec-87b5-fad20edbd8a0", "value": "T154545C16B65654F9EC9BC07CC3468962AB3274861B22FAFF029441393F27BE56E3C714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955309, "uuid": "5a1f1d23-5e06-4738-a71d-78ba57994ee6", "value": "46cb77aad6346b712234e78603fe58f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955309, "uuid": "1feaa8d9-c6b1-409f-b113-40f9f9c193b1", "value": "6144:Y1MqwePjfFCkg0lxqOd77wwOwedhqqfXXXccccZh222jjF2oVVVVCCOvvvvUUUUa:Y1MqwePjfFCkg0lxqOd77wwOwedhqqfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774955309, "uuid": "6477d916-8167-43e8-bfcf-369e3e1d0bce", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774955309, "uuid": "e92fbe41-539f-4f85-9abc-94dd7d391ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955309, "uuid": "6c3fed57-2791-49b0-a34b-d9089148d130", "value": "acrobat-update-service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbd5884-2d0d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774967357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967357, "uuid": "4553d421-8d7b-4d62-a2c5-2cfe0faf9e4d", "comment": "Malware payload (ValleyRAT)", "value": "e48fcdbcadf50b5ec84c589dd3223504", "object_relation": "md5", "Tag": [ { "name": "192-238-180-62", "colour": "#B8BA19", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967357, "uuid": "fa5950f4-8c6d-4655-82ad-b4e39bb02742", "comment": "Malware payload (ValleyRAT)", "value": "709de7963a5ab386547882f31f113f7dd42e94bcd723a65db007d3f13dfef45f", "object_relation": "sha256", "Tag": [ { "name": "192-238-180-62", "colour": "#B8BA19", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967357, "uuid": "5a915ef3-11db-408b-a612-1af9d73d191b", "comment": "Malware payload (ValleyRAT)", "value": "46886fb1660f67da56be5cc3a7379f744da9f57f", "object_relation": "sha1", "Tag": [ { "name": "192-238-180-62", "colour": "#B8BA19", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967357, "uuid": "ab18f8e2-d6f0-4dc8-842f-8f1af0a94234", "comment": "Malware payload (ValleyRAT)", "value": "e73981b3f92b3253cf0bf8368e7ff8324b82a3cd972e1e69fb066119ddf35c32e59bc7fb1fd8e878702b2732c2daa19f", "object_relation": "sha3-384", "Tag": [ { "name": "192-238-180-62", "colour": "#B8BA19", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967357, "uuid": "c2dee547-2540-4e0d-b736-67a93bc4e585", "value": "T1A8563302F3C34878F835453D94E5C4996D06BDD806F2396A6DF8C26E5DB86C2183AA7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967357, "uuid": "eacba6ec-b550-4e88-b4c7-176bb0ffe6fa", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967357, "uuid": "3b72a37f-d604-459b-ac08-6a6afe09fcda", "value": "98304:Rgv1taxu11ILRFPwUqaO/j/I77+Tn7iKp9XMpX6fwM7cNuuRqj:ev1C8ILjPEJ/k7snx58XZMQMCqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967357, "uuid": "89335349-f91b-4c5e-96da-d5e643f3a2db", "value": 6073496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967357, "uuid": "3a29a3d2-9907-4d89-af1d-8570f6a23d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967357, "uuid": "4eae02a5-35d1-479a-90e5-d32f0e05df32", "value": "Danma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75c7250-2cf9-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774958645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958645, "uuid": "35fd71bb-c659-4636-8b03-a6cb58f42f46", "comment": "Malware payload (AdaptixC2)", "value": "5a4a549a504360bc21c60079fa2a2f60", "object_relation": "md5", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "dropped-from-AdaptixC2", "colour": "#B95E8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958645, "uuid": "48282208-3505-4786-b070-f2f0965f7bb0", "comment": "Malware payload (AdaptixC2)", "value": "7192f8dc0173afc11ee73bfa161560c712a3b26aff10c82a9c1ec3719690fd88", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "dropped-from-AdaptixC2", "colour": "#B95E8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958645, "uuid": "d4aead66-f5ad-40b5-b30c-9c78c3de7075", "comment": "Malware payload (AdaptixC2)", "value": "364b584f20ad33e5614da560cef901c4a9631e3c", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "dropped-from-AdaptixC2", "colour": "#B95E8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958645, "uuid": "392820df-c866-452e-8ba6-6604f5663046", "comment": "Malware payload (AdaptixC2)", "value": "103f2f53ed9616d4dcb1940660ff6f2b196fdde93e7e7ff89317c302b67143b3a8ed1ea5cca46b3d0b1ed686453930c3", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-11", "colour": "#BBBE5D", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "dropped-from-AdaptixC2", "colour": "#B95E8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958645, "uuid": "04caedbc-f3fb-4485-a455-712ec2eb48ed", "value": "T1AB350223F2502D7EFBC2A53FD252AB9E093BCFFA9442C7767A14E5A9A414C054D213E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958645, "uuid": "081a3f02-efc2-433f-bda6-b7cafe9a7c30", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958645, "uuid": "e590bf48-5985-4e72-b849-6440c1ae2a1b", "value": "24576:OkrLKH6AmZsd7EJ5dA/uFjF5kOjkPd/mGi:ZxpZsiJ5dCq6jPpmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958645, "uuid": "d77db6e1-7a24-4d54-9a33-2eb63e4a2e85", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958645, "uuid": "bfdc1fe4-42c4-4469-a206-4ea3e04466d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958645, "uuid": "8114a346-9e7c-450e-89e1-ba1bd514e9f0", "value": "native.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5e8524-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958867, "uuid": "5fcd6080-01f3-49e0-9763-70866209cfab", "comment": "Malware payload (Mirai)", "value": "d15f6f7b935f52663708d62331d27e26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958867, "uuid": "df5c9396-87e9-4525-af41-2834ee716504", "comment": "Malware payload (Mirai)", "value": "7211a118964998029e3336b5b8436b0d2dbc7da7fac0672a99281462f6755941", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958867, "uuid": "06e3cffe-943f-4798-8c24-2647e614414f", "comment": "Malware payload (Mirai)", "value": "74e87789621b6e51b6698f878a86374c9e96ad67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958867, "uuid": "f638e484-826e-4982-a9f1-53f2c81ca08d", "comment": "Malware payload (Mirai)", "value": "04cce0e6cf0a38e4e0de2a8114ba078807feb6d479bef3ff26d447d84f889287627639d03a03cf47fc72e2627345a7e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958867, "uuid": "b02aa248-93f2-4673-8f7c-57aba7f24742", "value": "T13443E651BC825A2AC2E053BAF9AE558D332177E8D1EB3227CC611B107BDA45F1D63F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958867, "uuid": "4b1f20b6-de40-4a04-82f9-4e83382a6cf3", "value": "1536:xnZoe9GT0GVt6+3LNt9jozoRoBuEqgAxMoh+fAfsw:xnCFdoIRNxFhYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958867, "uuid": "1e621383-4809-440a-b4b5-7fc3d79cced6", "value": 59296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958867, "uuid": "eacee1f4-bd07-4396-8ed5-6306622d9cb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958867, "uuid": "26676b47-86ec-4c42-9b1d-ea717a9d8a95", "value": "jade.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a2461a-2d2b-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774979977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979977, "uuid": "afdcad00-1a5c-4fb1-bd30-c55e97818310", "comment": "Malware payload (RustyStealer)", "value": "041dd4d8b79d5a69bf665a1111bcc089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979977, "uuid": "3101f34a-63e6-4536-9179-1e4c3a66b8d2", "comment": "Malware payload (RustyStealer)", "value": "72281fa160e399ff3c35e64da05a0bfe4d1044139391480ce66e72316f7bd5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979977, "uuid": "f558dc5a-3a3b-4f25-b3ff-cb52584f018a", "comment": "Malware payload (RustyStealer)", "value": "96a5876118b05c0aaf9a90fee210434d3445da46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979977, "uuid": "9f92dbe1-83b4-4d32-8fa5-f2a2b3f47be9", "comment": "Malware payload (RustyStealer)", "value": "34d68787ab818028765693ff8b5fd6377915988966a6adb380f7b96b0369e7000f8ceb6012df011d3f257e5a2c5a36a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979977, "uuid": "adb0d774-7a3b-4226-95f3-3ca427985da2", "value": "T1BE266B87F1A791ECC06AD070935A7233FA32784907256AFB97D087213E65BD06F39B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979977, "uuid": "1699ce5d-ceda-46b1-a51f-ee0920d1224b", "value": "bd9d18d07a19dda4789fd9da615f0652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979977, "uuid": "bb96c082-5816-49b6-ae95-bf4acdf1f260", "value": "49152:AU8wf+KPRdL3k+n7Au337sopStx/CynHbF6xMuGnSTJWlUYMEyzqlszxGu/STXFJ:fp30tkyUA2NZqlszdaSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979977, "uuid": "c46e893c-f2fc-44c1-9092-0c0c98843ffc", "value": 4729344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979977, "uuid": "dbe1fc84-bc1d-49d6-8ead-d946d618aeff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979977, "uuid": "30956f83-5348-481d-a9bb-1f97f645cc22", "value": "swiftpdf1.0.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea10f3b5-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959590, "uuid": "08151f70-beaa-4dae-b816-d0a994545fb8", "comment": "Malware payload (Mirai)", "value": "ce750fab8c32d73decd307845864d031", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959590, "uuid": "c84317db-f694-4328-a204-314e6be8d4a8", "comment": "Malware payload (Mirai)", "value": "72fc53134560249613c435b13044911019d1ea00b337f43fa539f21eb903b320", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959590, "uuid": "e7305fcb-13cb-4c71-bf46-6256e4c7bd0d", "comment": "Malware payload (Mirai)", "value": "0d50040fa3e991a479aa77b2484da24a06971e0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959590, "uuid": "3257a2cb-995f-49c2-bda8-242329af2e03", "comment": "Malware payload (Mirai)", "value": "ed2c94f98176a2cb6d38893d50faa2c554b6ac7e43cbdb447c7fb683cff7e440b5e9bb0e77560c1a2ba0623f4e30e5fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959590, "uuid": "442e7f6a-ff14-4371-9b21-2490a6aacc69", "value": "T174E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959590, "uuid": "ac38fc96-4393-446d-93ec-71b8b7e46458", "value": "3072:axjJw1Cc/0s6YAPwenUr48pzfR+JonBy:axlw1xAop0YfRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959590, "uuid": "a5e43908-a256-426c-bb33-335dccee45d6", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959590, "uuid": "bd613745-2bd7-49fb-9d32-4348b166f01c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959590, "uuid": "454aeaf7-ed41-4c4e-bc58-6737ecc1336d", "value": "boatnet.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b589e5b-2d22-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Generic)", "timestamp": 1774976208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976208, "uuid": "46574ef3-dea7-4d80-9881-c11f1519d311", "comment": "Malware payload (Adware.Generic)", "value": "897cb64756d2376b26f29ca78c3fab56", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trueconf_windows_client", "colour": "#63AB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976208, "uuid": "69056f03-0ba7-4726-b022-f23922a0f8dd", "comment": "Malware payload (Adware.Generic)", "value": "730e7bde97cbf96a282049c0430b294e2794f27773fcae9e970778d8ffe7e6a6", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trueconf_windows_client", "colour": "#63AB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976208, "uuid": "da168ecf-ec3c-4996-8462-0b4843f33995", "comment": "Malware payload (Adware.Generic)", "value": "60c79e7310fc1503e500d6ee0c28ba882461321a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trueconf_windows_client", "colour": "#63AB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976208, "uuid": "afe40ef2-901b-4141-8435-06d52e91db22", "comment": "Malware payload (Adware.Generic)", "value": "facdd5e9a9effaedf08cf9e09d7b7b938474af2328e655a2356c270ced4475aef8909d0930497c10d213865835ca2610", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trueconf_windows_client", "colour": "#63AB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976208, "uuid": "5a6e460d-ce2d-4c23-9dab-c39a8711566f", "value": "T147856C3E6B20953DC91D4DF177B2933058B7AD2094E95D4A1BF03A2DEB3BA105B2B21D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976208, "uuid": "d8568fba-36aa-4884-b031-ed6bd8dad20c", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976208, "uuid": "347fd684-a463-46e8-af8a-90466f32fc18", "value": "24576:P7FUDowAyrTVE3U5FY4FxZYfA74UO3lES2QnJjJHZMpOpuyd7u:PBuZrEU/OzES2+Jt5MpBMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774976208, "uuid": "5425610b-cde3-44ed-ab97-5d7775cad2a4", "value": 1751534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774976208, "uuid": "0d4bcba1-f212-4e50-94b2-5158ebe33adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976208, "uuid": "36d0cc5e-2036-41a3-9660-c87f3eb8b781", "value": "trueconf_windows_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf48609-2cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928563, "uuid": "f3e2e675-852c-4fe4-82c4-3d1bbf1e7833", "comment": "Malware payload (Mirai)", "value": "708ea1fee754c0504728085b8a1dc4d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928563, "uuid": "5d733212-280c-4d48-98de-785b350d5607", "comment": "Malware payload (Mirai)", "value": "750d40291a3797d818b6df83638bf7c68531e96835bd525e92ed0d02720c1f56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928563, "uuid": "29712a0b-b9b9-491a-8e8c-f6f5d2a02783", "comment": "Malware payload (Mirai)", "value": "6658ba763efa3896209e70455dd3df335e9738d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928563, "uuid": "bf67b96b-f495-4fd1-a31d-fa377ee79b62", "comment": "Malware payload (Mirai)", "value": "e2ee0566e8768dd4e64035024106eb8a96d366d2f5fa400c8bc4f47458d355993e17fc5b5024f57feddfa3634fbb340e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928563, "uuid": "4abe4d01-7d09-412a-8ecf-fd4c6b19e3f9", "value": "T1723618132761DF2EF359C13405B3C9612AE516A229E585CAA33DF23C3F60A5A741BFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928563, "uuid": "354479e7-0568-45de-b9f4-db893d6216a6", "value": "49152:fKJY6qcn1hh/vS+pL6pez3OtggqOqPn+pulv2S/cvY+mEdVERCKqnn4/5HQutWqt:f56qAh5gZ++UVenn2jXny+0k6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928563, "uuid": "6978094f-d8d2-4b6d-a45d-67d94cb36c6f", "value": 5340792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928563, "uuid": "bf8dae85-7dea-4e49-8bf5-09ab44d39364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928563, "uuid": "a771c88a-44d0-4a40-9fed-b996b8b0681a", "value": "wlan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10137e2-2ceb-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1774952729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774952729, "uuid": "d844fffa-a76c-4301-84c9-b3449857fa82", "comment": "Malware payload (Phorpiex)", "value": "b4ddda742774f96244bd31c86cb7c56a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774952729, "uuid": "f78ad166-68cc-4241-bdb1-5a18ca32b070", "comment": "Malware payload (Phorpiex)", "value": "75366843931e0c21c3f00886102618ccedd1c500a01116791ace4c4697976b49", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774952729, "uuid": "baf26343-31cb-451b-bd30-c50b14df88a6", "comment": "Malware payload (Phorpiex)", "value": "c2218a7e551c17d47d045a0a854c112a2fdc5dbc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774952729, "uuid": "b717b48a-d3c5-4dd3-a718-0ab3db0fdd55", "comment": "Malware payload (Phorpiex)", "value": "eb36200193a9f6006c76b308b6eafc19c0c7d7bbc0470b8c7fe5d5d81e51fab839bcfc864786dae4ada8deaa263a86bf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774952729, "uuid": "eb1cb7e7-33f3-4d94-a07a-54aa947e942a", "value": "T17A12290F6F4A4071E3E00CF056B58B8D8E3D866327D6A2EBF777C5990FA834494526E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774952729, "uuid": "df10975b-6bcc-4618-842f-95dfbb98ee84", "value": "5b2be5371d11a0901c7dd88d5d6a5803", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774952729, "uuid": "779549c5-1950-42de-b509-c52ca7a4eda0", "value": "96:kDWF9OBgrf3QL/B9KkjUBp/Bd0oDDSMZ+t8mL2jH2IPFJxGE9mK2FFhJC7tCESIH:NbegzgHUBpcWZ+mmPIPFJxTEKmFhqSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774952729, "uuid": "00a9a2e6-b79f-49ac-8aa2-678ce0b67301", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774952729, "uuid": "ca58b49a-c6a0-4ebd-8893-9d9440a7021a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774952729, "uuid": "0de5c205-9d92-495f-8b4b-b04d3835122b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ca556e-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928813, "uuid": "efed0c83-eed2-47c1-b358-9048195d6f7b", "comment": "Malware payload (Mirai)", "value": "ba811d2687760260192c336fd9d25a48", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928813, "uuid": "df1b1794-b496-44cc-86f1-9f8e4cf6dcd3", "comment": "Malware payload (Mirai)", "value": "755fed0394349de93868f4696d1023f676c9d94c329189023483b04791d46ef9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928813, "uuid": "634379f7-d6a6-417c-a1d8-ed6c5601593d", "comment": "Malware payload (Mirai)", "value": "7fa0e5fc7f45c2ce9e442ba6677020b0bcd8eda1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928813, "uuid": "b0739a00-f9d5-4075-b2a6-b337e4d8ca4e", "comment": "Malware payload (Mirai)", "value": "146dde258ebd701aef13f93fb95470f61edc7f42c430f7142d8ad672cc18680f612bcece1c128c99d387984e35654fdb", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928813, "uuid": "fc100846-350a-4b35-af55-aea367c1b108", "value": "T170143953A8A55FF7C191AEB165E35AB10757E8140B0B0F8AA53AEAF4070F8CDB40E774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928813, "uuid": "cd64d7b0-1bb0-4f0e-bbae-4a4174132fa3", "value": "6144:4WGImS/WCgClfePmGwPRRomDHoYBgecaL5AU4:5GImSOCpcPmGKRRomDHoYBgecaL5AU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928813, "uuid": "bc49427c-7fca-448f-a0d5-91078e9c12a8", "value": 201516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928813, "uuid": "c852773c-9074-49c3-b876-10217b63a2ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928813, "uuid": "3b13ebe0-2ce6-4309-a8d5-2efe65af77d4", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104337ab-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959224, "uuid": "5997284a-1af8-47a9-8362-442dd4cd7ccd", "comment": "Malware payload (Mirai)", "value": "4a00c198153af6a22e57c09f488b9747", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959224, "uuid": "147cf465-492b-46f5-9677-5a0f38a536e6", "comment": "Malware payload (Mirai)", "value": "757de8284ef3595bea3dbcecb1effca1a7593ba33b4f1fdfe7bdcf28b8e3a315", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959224, "uuid": "2bc152c8-90cd-4579-879a-6228858729cc", "comment": "Malware payload (Mirai)", "value": "55ad948bdb23eb6826325e9e266ddfa13604cf5f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959224, "uuid": "9d04e4c3-fe19-4fba-b25c-7a1344bd1776", "comment": "Malware payload (Mirai)", "value": "c1804ea2de8b7363579d459e4a0f10c361901743f69034c5f05ed622a0b3bfdee14057b98030104cdfa091e699354de4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959224, "uuid": "910359cf-438b-4139-9b7d-a1c48ed3c086", "value": "T1925182C592856D326CB7FA23F6B6C128308190935CEA7F99DDD8BFE4868ED247240753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959224, "uuid": "70c55883-cf36-4903-a41d-b57fa99415fd", "value": "48:vp47047N7hp4v46Gp4gn4zPp4f4KWp414oUp47147o7Up4fO43bp4E49Rp4h4cgJ:vq7/7N7hqw6Gqg4zPqgKWqeoUq7e7o7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959224, "uuid": "0c0526a3-6694-405c-8001-4d9a0326ffb2", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959224, "uuid": "6ca94a00-a2ee-40ef-869d-7e3ce22e7415", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959224, "uuid": "062dbc52-d8db-461e-86c5-b38e5d7df0c6", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b7cdc3-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959230, "uuid": "0905729f-5a45-46d7-bbd7-2b4d10f92e5f", "comment": "Malware payload (Mirai)", "value": "e02e03c421411b657998e2bd844b2e7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959230, "uuid": "49be5107-faaf-4350-84df-64d56f5c8609", "comment": "Malware payload (Mirai)", "value": "758ce6c54d5aa1ebbdcbad4b6c48d9183a5647cf853e0f90a0678e1bcb64eba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959230, "uuid": "b4b2643b-6014-4ec8-81d8-6916928110d8", "comment": "Malware payload (Mirai)", "value": "f6d6966ee3cfb8f8ec7cb3e2f0d0f7840fcccf53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959230, "uuid": "e3c317cd-ff60-4bce-957c-83909f4c6edf", "comment": "Malware payload (Mirai)", "value": "16fecfe0a0f74a4c3d78219ea2b50b891da357dcef5eff111ea30c3742553f567d4a1bc9bead5cb4a961c9fb4c64f0f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959230, "uuid": "4f89d952-dceb-4e32-b018-6fb15acd465b", "value": "T182734BC4E74BD6F0CC030AB0115EFB376A3278352264DDBBDBE0FA73ADA16529456918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959230, "uuid": "1836db30-099f-47fe-a30e-74e2ae4e5322", "value": "1536:Qhf+fpfwf+Kw0fKuSHSfGpmmr0NklpYNTSq//pV0/zFXl:0m9E+meH6GphXYdSqXHiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959230, "uuid": "45496e62-176c-4454-b0f8-307214d6778c", "value": 74328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959230, "uuid": "f81eac8e-13d8-413b-a86e-fe7e0077f70c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959230, "uuid": "f50524d7-1fc5-437d-a4e1-102baa6b1a98", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d0d219-2cd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774941515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941515, "uuid": "eb32af49-4a47-4939-bbd5-16b8974ec637", "comment": "Malware payload", "value": "758fa1f97160da11e4f80feb8e1f41e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941515, "uuid": "cfe25436-911a-4600-bf41-d17c53f4f9b0", "comment": "Malware payload", "value": "759741208cdea624fde857b509e33fbdf6616766e0cba30e3ee4b6a5b22d116f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941515, "uuid": "f441bb79-5061-4c72-a691-f90ef9be9e8a", "comment": "Malware payload", "value": "0b31bc093d3eb9f87df6e8615f2a4b71efbaddd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941515, "uuid": "ea3b472a-3cb7-48be-a2b6-11f68550c968", "comment": "Malware payload", "value": "5b223dede5cf9458479b1776e91bf5072ec1254df86ecc9092230d54a9ab5af63666ff52647ed0d3ca121fb1a41bca91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941515, "uuid": "ae9bfd92-2f23-408c-a559-dcca5aac01d3", "value": "T17CC24E04A7FC0518F2FF5F355ABA29504976BC8A2E75CA4D2E42409E0DB5BD0DEA0B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941515, "uuid": "8a2f301a-ac06-4afc-ad98-4cb9a5d98bf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941515, "uuid": "493a1746-cc1f-4342-a01b-a126245d5ef1", "value": "384:dyqJ4NAf/BQE4uCbMoYw3AFuBejKoUg3yffKmagZZjDEDtOXD8wcwS49:csf5NCbMoD3A/uCcdjDEDtOXD8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774941515, "uuid": "91641dd8-fb40-4e57-ad6f-bea57514c31d", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774941515, "uuid": "8b2ff09e-09f7-400e-9f44-8817f76ae28c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941515, "uuid": "a916358b-8bd6-4bbb-a77f-a92f1ca351c8", "value": "759741208cdea624fde857b509e33fbdf6616766e0cba30e3ee4b6a5b22d116f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3a0aa1-2ce9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774951483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951483, "uuid": "69fdcec1-3923-4d02-8dd5-8f8c2f8abae0", "comment": "Malware payload", "value": "6c170d7e9313f3679b5b800ed91ebfa6", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951483, "uuid": "de858baa-dbd5-4647-8e49-65ee026c9e9b", "comment": "Malware payload", "value": "75a4fa3e9d407a309be278be8d137c4add985cf0b1b498603bc09e2e998ad30c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951483, "uuid": "df542e93-6ff4-4c89-a9c9-cceb24af7520", "comment": "Malware payload", "value": "6cc65a184158bf6c92392f33c66248a9db134861", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951483, "uuid": "29c7961b-afda-4c6b-94e1-e769191859da", "comment": "Malware payload", "value": "08a6dd36a1dff05a359bcb8a0a5a553dbffd8546844fc477e02aa0956036d14fcff131792922532c81a2ff8c610516ad", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951483, "uuid": "42ae165b-a500-4dc4-b97c-f6c953bd6f02", "value": "T10EA48E19E7E405FDE0A7D178CE838912E776BC494761E7CF03A4A9A61F272908E3D712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951483, "uuid": "3188c543-ca17-4453-b16b-ce49db38e6ab", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951483, "uuid": "ba521bff-ee50-4082-b39c-29bb68df4a20", "value": "6144:HGRIMUcZeQiQHkOcxeieDw0hNGA3hjmq2iwXR2D5Yxjp6Rq/sHhToUAGshcd:8RZeGAfqNGA3Uq29XIDixjpyq0BVWcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774951483, "uuid": "0d4da3f3-c629-4ff8-88c3-4fbdcef04805", "value": 488142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774951483, "uuid": "577e0b2e-5fca-4fc8-84e5-85fd8b7d8dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951483, "uuid": "75738203-98c5-4318-9b74-2db568feb59c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f71cdef-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959384, "uuid": "838acda6-781a-4061-ac5c-0027df0c1715", "comment": "Malware payload (Mirai)", "value": "92402a950220b67e6ce82ecf733742a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959384, "uuid": "2b171aa5-ee92-4341-8f0b-ab8a1a460345", "comment": "Malware payload (Mirai)", "value": "769a028cd6a9c914b816e08dcaa80cc159767d9bc8a6c13a98b36f247e3e27af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959384, "uuid": "0e2b4af6-4088-4f79-8269-60e612954b66", "comment": "Malware payload (Mirai)", "value": "21d7c299f4b7fa52e89666f349781186937a3b0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959384, "uuid": "204dcf44-4cee-40ca-b70a-5f1ade9721c3", "comment": "Malware payload (Mirai)", "value": "5d429e9e494bb38a169a9b97737502274349d7abe2b19ede6f30275964ecfcb2d9c748f5275cce81b4fefd9af1d98186", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959384, "uuid": "1416338d-f44a-4846-9760-a535f1a44a79", "value": "T1B5932845E393E5F1D80705B001ABF77A4930FD331624D96ADBA4FFE2AE315C2A196329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959384, "uuid": "34d7bc20-b017-4b9f-a19f-437b60d097b4", "value": "1536:NJaUfdQD/bb2sBBI3eQYmUC3100x7u/oVLuAasxJrI:NJNYn2SBIr6kpYApf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959384, "uuid": "a288bca2-c806-443d-a2a5-e3bb39465087", "value": 90476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959384, "uuid": "bbcd434f-ff3e-443c-b169-b4abca6288f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959384, "uuid": "bef036bd-51e6-4a65-9ced-81a3740922b7", "value": "manji.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9cade8-2cf5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774957017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957017, "uuid": "1085412b-604e-4430-932e-94610fbfbef3", "comment": "Malware payload", "value": "4eda7721ac6cfefd291dce331e98fc65", "object_relation": "md5", "Tag": [ { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957017, "uuid": "508b1905-7e0d-4456-895e-64aeb1315c8e", "comment": "Malware payload", "value": "77a4942c8954017763626dd2bc73861ba81c8296df92c3ac8e017d59aeceec5a", "object_relation": "sha256", "Tag": [ { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957017, "uuid": "8cd814ab-debb-4a94-98eb-6b98982d1966", "comment": "Malware payload", "value": "0cbc514212b2a312648f9ba7ee4dc4ddb2d76038", "object_relation": "sha1", "Tag": [ { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957017, "uuid": "f54e4ff5-be81-422c-9d78-ac23d8930056", "comment": "Malware payload", "value": "01f354ad371e8f344d276c96ac9469535d5edecbbe07ac691d25a85e53ebd1a98a94366690608d9b7dd3271bb53d8523", "object_relation": "sha3-384", "Tag": [ { "name": "jjrawlins-cdk-iam-policy-builder-helper", "colour": "#18CC20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957017, "uuid": "6d1b07e9-8213-4f13-918c-ac72d145e121", "value": "T156E5333F1792152EE2147D92BFB50898EA04F180F53EDDA8237852514C58D8AFB68EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957017, "uuid": "7efb2758-86d3-4449-944e-5436c726487c", "value": "49152:ys6SiU9BIFa/Q3P9pSMNfO74A0WnxLgyyZHDPrC+Z3suEKZt2HlBOkKzSxE:TD9BzkPax74ATxLgyyZHDP+EBX2Hlwd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774957017, "uuid": "90808bd1-a311-4358-9d76-2d504bdc2739", "value": 3035930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774957017, "uuid": "a32dbd4a-f704-4665-94e8-2a1f6c66fae0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957017, "uuid": "7538a99b-6635-4ff6-8165-5d1c3e7be511", "value": "jjrawlins_cdk_iam_policy_builder_helper-0.0.194-py3-none-any.whl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce65ce31-2cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774960402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960402, "uuid": "ae1c6f02-e8c1-4464-b176-4b9ebc590998", "comment": "Malware payload (ACRStealer)", "value": "05d3ce6a30a6e6a7a6b2f791030a0f2b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960402, "uuid": "ee523cae-d76b-4d9e-8351-a175a270862b", "comment": "Malware payload (ACRStealer)", "value": "77bea4e7b27f3cd78b984b718fd1a69b953ecc105078f0044362c0cc5a2fa251", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960402, "uuid": "1a0d3855-7b30-4ab1-ad6f-acd50c275777", "comment": "Malware payload (ACRStealer)", "value": "d34f1fdc9501756385e7509a618f438b43f366f6", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960402, "uuid": "69bd347c-d1a9-4d33-9860-a5df886da9a7", "comment": "Malware payload (ACRStealer)", "value": "065d624c8bd3ff5eb501b3ba527c8a630111a18b6f3679dc6d565bc54012c06bc823c42adf1ba70d4d731198810cf942", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960402, "uuid": "1b3c5457-b368-4f13-b08b-37ef52beb432", "value": "T1E81733C78AA5231F64379635E5F1F052A4D9CE4BCE1586F96AF226C4FC43B38274DA08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960402, "uuid": "d2a05bb1-88be-458d-b6f5-da1f5fc78b5b", "value": "393216:mSWoTs1+Y/L/zoXBfLqqrOjVAEQL25v1Ybh0m85w7DpWG:mlz1+Y70RzqqrOhQ4uCwsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960402, "uuid": "d5da426e-f179-49d5-9540-f32081bbac76", "value": 20213137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960402, "uuid": "18653c1f-b763-471d-88b4-50217e0227f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960402, "uuid": "f7095b5e-75e9-4f46-b23b-0635667008f0", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29401bf6-2cb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774929201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929201, "uuid": "8cac6893-8721-4a4c-b6d6-f3d743d0af46", "comment": "Malware payload (Mirai)", "value": "c6b3ff946eae15f66e1960b2eb8a03db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929201, "uuid": "665a99a3-e714-4d8c-b8ff-b1387c7c04ed", "comment": "Malware payload (Mirai)", "value": "77e6390a8c4fd3df1d4b905183bd1736601c89691e24d2d1e436918a494041da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929201, "uuid": "1500e947-01d2-43b9-b89e-838981457f0c", "comment": "Malware payload (Mirai)", "value": "c870b1da6cb1e98b838ac88ed067037446334835", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929201, "uuid": "fbed5c79-ff9d-4bb3-af3c-b82e78b20f6b", "comment": "Malware payload (Mirai)", "value": "c63a7089e3b53e825360a9b4dfb89ed104a9cfb2911c25fc1598f3f4aa0349ca741e53813ea0092df614dd79d639409e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929201, "uuid": "5db56ee5-e773-4fb8-9455-3c06d7dcf275", "value": "T136067C41BA14392FF4151DFB8107CF26A6169B65C542263FC32CB8A7BD702B03B9BE56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929201, "uuid": "4e876b26-9fb0-485e-879f-6385d4e11e91", "value": "49152:wf/O9UKp99NnEgWFDBvOZpq8yx18+RQYRTaslf9W9oRamuyLuz1/bC6S:bUKp9TEgWF8Z54QYw99BySz1+6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774929201, "uuid": "ef0c87e7-200f-4aa7-ba53-add1a7f3f2e5", "value": 3795340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774929201, "uuid": "c7c1ca76-475f-4484-be02-c08823bb2821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929201, "uuid": "6fec044d-7345-47cc-91ba-9720566b59fc", "value": "wlan.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cae006-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959205, "uuid": "16b5d015-57d5-4627-82f7-f3ce499a1f43", "comment": "Malware payload (Mirai)", "value": "14dcd7065fef86fb0bc2178a12f59ff3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959205, "uuid": "71d7b88a-a697-4995-a6d6-1aa5b5202475", "comment": "Malware payload (Mirai)", "value": "782606738079703fc7ae546f5cd5904e530e318d19a48e4a64309a93c4c623d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959205, "uuid": "4ca42161-ced9-40ce-9507-538eea61b5a5", "comment": "Malware payload (Mirai)", "value": "4168acf9c4929e27b64ab0999cd17e06af438f74", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959205, "uuid": "648b00ea-6f19-4dd0-b719-55015849d4a5", "comment": "Malware payload (Mirai)", "value": "234ae9fef6cad633bf3b035ff97cdaac4e40c8964349e55401b04c0ea34a2f9739b113d233ce9aca4021a69ead946236", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959205, "uuid": "c57728f7-00f3-42bb-bcd8-104a349b7047", "value": "T1E8B2D094DD459ED8FF63DA709095F3F6BB610B5AB321DEE220885F40400367B6648DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959205, "uuid": "7f3fe33c-4e56-4cf0-98c1-f01fcca3b9fe", "value": "768:4HkIFvF76E/faq0WmsZmwT4F4uVcqgw09x:4EUF7TLTDcF4u+qgw09x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959205, "uuid": "a32a4dc6-cbc3-4451-9403-d65f021f1b93", "value": 24808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959205, "uuid": "dbbc0087-d7f7-4279-90c7-d9f86434156a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959205, "uuid": "9ee3192f-40bf-4e20-9dc9-1360aa3a927b", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ff9847-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959200, "uuid": "8030c514-c973-450f-ad91-f16959587c23", "comment": "Malware payload (Mirai)", "value": "6b42876f1879f2f884676979208df912", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959200, "uuid": "3dda41e2-610b-44d4-a725-865edc9a186e", "comment": "Malware payload (Mirai)", "value": "78471120e4d5bd409a59d2f12d1f7c5cea94c1f818fd92db8d3bf5647ebc5da2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959200, "uuid": "2ef3b9b4-1dfb-4800-a520-797847996548", "comment": "Malware payload (Mirai)", "value": "2ef4e21961f874c238338f26ecc858ec8c128e79", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959200, "uuid": "ff44461c-0788-43a1-a8f3-d7d2a9df6d7b", "comment": "Malware payload (Mirai)", "value": "7c9bb04f49426092a8aaaa1f382e4d576b05a24903737acd4cf60840de535ae465d2973fef5051a8bf6468bc7ba289d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959200, "uuid": "da897074-63fc-40f0-86ae-8461571e539c", "value": "T128631B99B8024E3CFA0BD9FD54164F09ED612391A2830F2B56ABFDD36E731666D02DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959200, "uuid": "6c5a4749-be63-4c09-b2f2-f7b30b62efda", "value": "768:Re+HZ2k4RgkS82IiAh9q3gdsnpF7VuXhZnvH+Kvr5a9p8IA4QS2v+3fhL9EA2TbB:RqZ0WSm+3fxCAib8s6MFkPQXTARZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959200, "uuid": "e79546ef-26c8-49a6-8119-c0c1ffce5157", "value": 72828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959200, "uuid": "bc0e5963-d055-413f-9411-28a14d583fe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959200, "uuid": "e07e52d7-45c2-4573-be52-258dd8083c4a", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79722f1-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979664, "uuid": "92a07920-d0e5-4b62-a366-cc4ebf187fd4", "comment": "Malware payload", "value": "9f86a884cebd86930639306fd741284f", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979664, "uuid": "8c5b148c-b59f-420d-bd69-45311efc8cd2", "comment": "Malware payload", "value": "7979e37d787aa4ffabfafa406948b37cfd972793135bc0625b6c37e673f49570", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979664, "uuid": "411f4f70-c223-4e7d-9ff2-51cf5bcf0008", "comment": "Malware payload", "value": "a5c5557498029ced5a5c931f8bfabe4e5e878ecf", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979664, "uuid": "da8e7143-a103-4d32-8cf1-f553ef48d220", "comment": "Malware payload", "value": "7bff1d1d91f007c46efade09dfa7cb011d9246a44ad088f88bfecdea1aab92f5fa8e5fcbee6e0e4846ae26501608b8dc", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979664, "uuid": "1f136112-0c2a-4600-a9d7-616c16530b33", "value": "T117556C2E44C71FA0AA17D3BAFE59F7B500C258FA77B075D8E166AD670833329E449087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979664, "uuid": "1e0118f1-3502-4308-ad2c-0a6729c06bf1", "value": "384:uoVGRhJbszZRTrOVg5vb/y+sIuJFTQqglc3+gt6pFCQA1epBIAoG0xA2mooPQfiU:uAGvJIzZRTrOVGbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979664, "uuid": "61de8179-9522-45ba-8324-caff51416023", "value": 1300811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979664, "uuid": "ff2bcb5c-6d1b-4f04-a45a-b6b488b37319", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979664, "uuid": "ce2325dc-7654-482b-ad5b-735b47a1231e", "value": "1SMAR30_Annnnnn-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ce1143-2cd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774941470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941470, "uuid": "b1230531-88b9-41d7-9bc0-bd36fe680201", "comment": "Malware payload", "value": "5468364e644d98fc0ca7096fd8eb7b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941470, "uuid": "ec5b9b79-76a5-4255-8ee1-b3a85a3a5d98", "comment": "Malware payload", "value": "79854685bd265c09de355bfef8682f9c12e3c69db7e34ddced3bf8e9c690551a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941470, "uuid": "7e247349-138d-4796-8717-5dd07eae2c9e", "comment": "Malware payload", "value": "aca1529f6e09dfe77d89d9544d9e81a67b9f2355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941470, "uuid": "dd94925f-e801-4e59-a75b-9358fdec8318", "comment": "Malware payload", "value": "cfa84ed00f8b6d47222667b7e4483229edb80cb0590f5693d8096bec6034d0f5deb58d7616ea428047d170c74c136b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941470, "uuid": "36cb5c0a-0953-4dde-a00c-d87fd46247c9", "value": "T1ECB4120D33AC0A25E15A0B3CAAB349D15B36B515CDA6F71E6AD421592B35B88CE307F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941470, "uuid": "4bec59c5-d353-4bfa-9933-0992f3bd4c1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941470, "uuid": "aa56edb6-bed6-4a0e-8cb0-63aa9db6a9a3", "value": "12288:I0rCjZwFwwkbhlCSt4zBs/5JxyFot2wkda7EHC:I0r4wStESt49shyFoBkkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774941470, "uuid": "8655db12-428b-4bfd-b266-403c9c988b63", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774941470, "uuid": "a4c2d593-5ff4-416e-a23d-3b4b2c70ddd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941470, "uuid": "63cfc3c0-1e25-4ee8-a559-bf3456454ead", "value": "79854685bd265c09de355bfef8682f9c12e3c69db7e34ddced3bf8e9c690551a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9405060-2d28-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774978942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978942, "uuid": "994df47d-3e5b-45a5-8df8-e308eb4c07bb", "comment": "Malware payload (SalatStealer)", "value": "e6f71318f8713bf952d4c5645929e7c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978942, "uuid": "994d25e6-aa21-4a61-bed5-59aad596cd40", "comment": "Malware payload (SalatStealer)", "value": "79acdc4c9e264c93f226088d227489f7e42917f70b0cd6869515b9bcfc4545b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978942, "uuid": "bf21bc91-f401-4ac2-9f17-a5cf0c5a322c", "comment": "Malware payload (SalatStealer)", "value": "791337afccf80d428bbb7726fbc8b2e6ece5f845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978942, "uuid": "362d2167-312f-4cf8-b531-392deacc10a5", "comment": "Malware payload (SalatStealer)", "value": "682cc6015a1a339dbe890424a6631493ab6ff053034f4fcb9fe63994405c37927153e6dfb7e8bfb94e63fad2ebcdb2c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978942, "uuid": "f2543458-5651-4fef-afa7-175c9cb610d0", "value": "T152C65C11FACB54F1F903583140ABB27F23315D048B28CBDBEB547B6AF87B6A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978942, "uuid": "a29da6a6-ec5f-4440-81ea-c83caa141d9e", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978942, "uuid": "bc6b1a03-2632-47b1-9de0-47bea97cea01", "value": "98304:Gh+R39x63rXViKFZdzsEQzglMq46G2If0Eq:xxUBFjQzgiqSFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774978942, "uuid": "87157597-7830-497d-a9c4-2465a23a4066", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774978942, "uuid": "6ac09f4a-045d-49e5-876f-eedf2fcfdc38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978942, "uuid": "d612dd95-3023-4dbd-966f-496e680c3747", "value": "memesense.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e12bd33-2cf9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774958415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958415, "uuid": "1ce40552-5b0a-4af7-ad9a-d4fe24a8de17", "comment": "Malware payload (PhantomStealer)", "value": "818708abf1518f3c1f05d40be36e33c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958415, "uuid": "69cb118b-9aad-4fd0-954b-3f7450cd5939", "comment": "Malware payload (PhantomStealer)", "value": "7a20955b6e9ae2b45b06be3b7ae4db3e4b8946a18739a4d7cdad73155cd90bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958415, "uuid": "672fae74-dc88-433c-9028-d96799382792", "comment": "Malware payload (PhantomStealer)", "value": "fc5fe7850b0e7a8a3f0fb3c420007275cb434c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958415, "uuid": "b2240e62-8d6c-47f8-bfc9-303968181faa", "comment": "Malware payload (PhantomStealer)", "value": "48b555c51721f71fdd6262be6febf6934600335392de9963734580a85011c2e3ca6e701873f15387b20f97ca0fe5000b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958415, "uuid": "fdfa6ebf-33f4-48d4-87f6-15f66d47fed0", "value": "T1E67512841215EA07D5D21FB05E70E3B447B54E89BC02C3479BFAEEEBB93D64678092D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958415, "uuid": "e22b0dda-5dcf-441b-84f4-c8f97181ad27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958415, "uuid": "c273b17a-7284-4961-bbae-c500f050806d", "value": "24576:9hnOAShku/dLBtzi3yMITnwuq+27XZkKvjeTj87R0pBfJynJi+lwxIt:9hnFShB9i3Qhq+KnbT0pBfJ4J9iIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958415, "uuid": "adcbb11c-ab9a-4a58-88e4-b75b4183c732", "value": 1601544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958415, "uuid": "1a355471-aadf-456a-8df4-acd79fe6aff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958415, "uuid": "6a44da82-2ca1-45ce-a61c-ab033e142b2a", "value": "rUMx5WTsF60SQ2aQ.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03186c16-2d04-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1774963068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963068, "uuid": "96290558-bac9-4710-a251-e106f60fdf85", "comment": "Malware payload (PureHVNC)", "value": "bbcb23acb89e803dd2146e94194ac8db", "object_relation": "md5", "Tag": [ { "name": "94-103-1-28", "colour": "#62DA67", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dal-usa-com", "colour": "#97823D", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "vault88x-secure-efficient2-su", "colour": "#02D64D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963068, "uuid": "290dc590-bf17-47e1-8126-56ab822227b3", "comment": "Malware payload (PureHVNC)", "value": "7a2cb732e58e653ebc09553930861bc08d76875cb8d2d1b0c87565282e74eaa5", "object_relation": "sha256", "Tag": [ { "name": "94-103-1-28", "colour": "#62DA67", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dal-usa-com", "colour": "#97823D", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "vault88x-secure-efficient2-su", "colour": "#02D64D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963068, "uuid": "8ace88b9-66c8-478b-ac47-0bded9dadca3", "comment": "Malware payload (PureHVNC)", "value": "d5855f80a202b82e6374a372f30a152b46227909", "object_relation": "sha1", "Tag": [ { "name": "94-103-1-28", "colour": "#62DA67", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dal-usa-com", "colour": "#97823D", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "vault88x-secure-efficient2-su", "colour": "#02D64D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963068, "uuid": "f92b6536-a82e-45eb-89e3-aac2c9d47167", "comment": "Malware payload (PureHVNC)", "value": "32443ff413c9c16ac736c6fa2d138a48c7cc90983011f93991d426234442f27ca3b2a8ba00a22226abadcf0f5e99d5d6", "object_relation": "sha3-384", "Tag": [ { "name": "94-103-1-28", "colour": "#62DA67", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dal-usa-com", "colour": "#97823D", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "vault88x-secure-efficient2-su", "colour": "#02D64D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963068, "uuid": "363260e7-0a7d-498a-ba23-0e31521f8c4f", "value": "T196C45C3195FB412238D6287E19CF9533B56AFB580E676B70B40115EF079EB063DE6B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963068, "uuid": "ef70c7b1-c4ee-481d-8f97-adc39066804a", "value": "12288:HUUUULUUUUoUUUUoUUUUoUUUU+UUUUlUUUU7UUUUyUUUULUUUUoUUUUfUUUUoUUR:HUUUULUUUUoUUUUoUUUUoUUUU+UUUUlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963068, "uuid": "efd0fd7d-d460-4d98-a821-7616168e5bbc", "value": 568158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963068, "uuid": "348c9b9c-ccb9-4404-b32a-9e55d6128fbf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963068, "uuid": "b2493737-a8d2-4070-8f50-fd1eeb114064", "value": "inv.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438c1bd3-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928816, "uuid": "5db234ce-f751-414d-b394-79aee23485bc", "comment": "Malware payload (Mirai)", "value": "045b4694ca0c80e4721292c71b0338d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928816, "uuid": "7854cb35-d085-422f-86f2-68aef8816978", "comment": "Malware payload (Mirai)", "value": "7b45422b404dc00fa906b3899a82e57ceac07e3aba6182aa13269f9c27389e80", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928816, "uuid": "09da3a07-0b1d-47a0-9a51-db5e3cd9f5ee", "comment": "Malware payload (Mirai)", "value": "454faa9b972f69d885039d7283e5ac7fd710c65a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928816, "uuid": "b4f79751-f342-4504-aff9-69220aabf9bf", "comment": "Malware payload (Mirai)", "value": "1abe81465110996321ccf6360766f5a9f90748dcc608b01ec820cfce8295f43c18eddb30d5635acf0d6c6569c13c0fbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928816, "uuid": "5d9e180d-f281-4576-9e7a-31b3c0ebae9e", "value": "T134343C93B904DEF7F40AE73604D307257231BB661A535A32B2177979EE3A2C4282BF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928816, "uuid": "4ef0e3b0-bd4e-478c-9ba9-60bfc64b4f35", "value": "6144:ZXdoYAIqtbZkhPLPOCUytN6rKXv4JDsoY85eeaL57Uc:ktbv2yKXv4JDsoY85eeaL57Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928816, "uuid": "7c690cd8-601d-4945-b32c-fcca59728ebe", "value": 232214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928816, "uuid": "fdfd2752-81ce-4ae1-a0f6-85f73c4dff58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928816, "uuid": "38a9cf21-1708-469f-89cb-a28c4174fe55", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65787830-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774960656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960656, "uuid": "2316df5d-557d-484f-ab94-0a64fd492a25", "comment": "Malware payload (ConnectWise)", "value": "b5640f840f712db64ab8677c99c00bd2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960656, "uuid": "5419097c-24c2-4b6f-9a17-d16324b3f666", "comment": "Malware payload (ConnectWise)", "value": "7bceab0532e3fd8cbad41641df36ac9f3769aae79ebe943eba45380e72d8a017", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960656, "uuid": "1e0cbe6c-668a-4279-958f-977c1499311a", "comment": "Malware payload (ConnectWise)", "value": "138d68a9ba0bfc2e01a6d01546c87c32697cd951", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960656, "uuid": "336f34b1-6bdf-468c-a327-89c84f7a58eb", "comment": "Malware payload (ConnectWise)", "value": "41ef96268bae35d3a6f57c17c6de96db87baa109edbecadfe68d73c3f20065935957ca985fab3bb0db74cab3def910cb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960656, "uuid": "9b8cd28b-aeb9-4740-9851-74221734a1da", "value": "T1EFF633102BE8A5AAF2735B38EC7B26B00579BD51CE13D02F4319B81E5531D94AAB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960656, "uuid": "b9d7f06b-2b4a-44d2-be0b-924244751d97", "value": "393216:nOvTi7hha62Z3N11MOvTi7hha62rOvTi7hha62sOvTi7hha62:nOvjZ371MOvjrOvjsOvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960656, "uuid": "8ccbe8ec-10de-4f07-acac-14d957601ace", "value": 16723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960656, "uuid": "c5a40245-3a74-4055-b4cc-7aaa724cbeac", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960656, "uuid": "2aa77aa4-8914-4ada-9152-8fd4cc1900d1", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cc9767-2cbc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774932276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932276, "uuid": "96090f15-7bfa-4848-b95e-b9101f24b86d", "comment": "Malware payload", "value": "532e74fe6d9679522c1e9179db6a0e09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932276, "uuid": "fcf5d15a-bd96-4082-927b-72e8319783bf", "comment": "Malware payload", "value": "7bda0cfd6a599e099f8c628ab75609ed5827bc2f268501e41be148359a43f061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932276, "uuid": "5dcb748b-ff8d-4854-9310-3749b2623b05", "comment": "Malware payload", "value": "9eee7faefdb173ab4ce23767ea658a5983e051a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932276, "uuid": "1092779e-bc86-422d-a90b-4e8afc92e1de", "comment": "Malware payload", "value": "59c9ef4f4e525a148147199829e519046c0ee6101fb271eb7bf3e71cc0362ea11c6242ba1a5dd52842dde381e5fb9645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932276, "uuid": "cfae4c3e-e0a0-4726-8357-b054ff395da5", "value": "T144463395A2356B42CBF592748D2ABC5D8CE5DEDCF7CB96C61583D82B00BB7103A074AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932276, "uuid": "b1bd526f-f13a-48bc-a8aa-34c54483bbe4", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932276, "uuid": "28c35bd6-7e45-48b7-9c4a-f6669c139f5a", "value": "98304:MjjIHl/qCNyRgxDc2x3OXV/XVXIIxcQg0pmW8PxJV0Rn14XgCLgr9Zd2:MjcF/WRgNP0/rxcmsn6v4vgJZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774932276, "uuid": "793e28e8-f80f-469d-99dd-3dad13683691", "value": 5468160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774932276, "uuid": "cacaa253-6551-4f4b-8a9e-696a11a01434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932276, "uuid": "94296b23-8ca1-455b-bded-1c883dadeccd", "value": "7bda0cfd6a599e099f8c628ab75609ed5827bc2f268501e41be148359a43f061.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4f27c2-2d3e-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774988318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988318, "uuid": "0c6037e2-9d17-43f2-ab90-65851a3e46c4", "comment": "Malware payload (NetSupport)", "value": "97bc731cef959bb6809e47ed905ffc03", "object_relation": "md5", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988318, "uuid": "2adf9c5a-81a2-4c7e-8d24-ade7c5df3a05", "comment": "Malware payload (NetSupport)", "value": "7d655d022c6c8eb5c9acf334f3cb648cde9ff620aaad6a844bfc8cfa605e6904", "object_relation": "sha256", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988318, "uuid": "2a011999-a4d0-4d98-90c7-4365356cf9b4", "comment": "Malware payload (NetSupport)", "value": "e413aba28b4b0c1bab3273b953a474541e87cba3", "object_relation": "sha1", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988318, "uuid": "3315e211-75e0-433d-b011-84d62c67cab1", "comment": "Malware payload (NetSupport)", "value": "173bf24ec8278bec8b83ea7d05a052bfca95bf5a4245287ca3cb864e105c3cb5d6056d7edb63033eb073ee0321af823e", "object_relation": "sha3-384", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774988318, "uuid": "1fde6694-fcc6-4d5e-9c51-e64518c7ed44", "value": "T162967CB88784975EBE6E1A07E078571E67F37F26D09271FC5A62370B226FD086239C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774988318, "uuid": "3fb1dce9-7188-4692-be81-f2616d7341e1", "value": "49152:GOi3+k6B9wiLXTKKuaRGw66Q7b0AI/saq14VpEUCOg3a5:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774988318, "uuid": "df1b5cfb-38d8-42aa-84f1-b14d542d4355", "value": 9411000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774988318, "uuid": "d8e37345-70c8-42c4-b714-4e68a922a8b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774988318, "uuid": "f194cac4-459c-4c55-95fa-288415fc44eb", "value": "tta.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c4c4b5-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959233, "uuid": "928386f6-45d1-43c9-a51c-cda1c681b91e", "comment": "Malware payload (Mirai)", "value": "908e11072c7779344b29ab03a6fee706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959233, "uuid": "fe1f7b69-4f05-40a5-8482-ad4761f5e7e4", "comment": "Malware payload (Mirai)", "value": "7e25482cc086c0429c97a9d9d3da11a58f77c060e14027ede4fb459aee15c5e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959233, "uuid": "5d6a0af6-3dd8-47bd-94bb-9d705f571ba1", "comment": "Malware payload (Mirai)", "value": "b28577229f459bc669e18c27b4501a4ea74d53b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959233, "uuid": "fd2e8bcf-e16b-4750-951a-8c03224ba6e1", "comment": "Malware payload (Mirai)", "value": "e6c9056447f15fbcc1166b544cfaefbeba1b55e9399c56149da6c352a99f41830b152aef83cc97234ccdac8dc0dac78d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959233, "uuid": "2f4a4e71-fd70-43e7-a245-bd50782c13d4", "value": "T1E773E5C1F84B85F5C40B4D3050A3F63FCE31E5A541B1966EEFADAF32DAAB542810299D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959233, "uuid": "c3a6203a-e25d-4be9-b2c2-95eeb571c3f9", "value": "1536:EBiIvA+gdA+XIEHEFCWkmkH20U6qy38c82/JVV141p1TMhM4:EBBvA+gdA+4EHEFCWkmK20U6q88c88Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959233, "uuid": "41f74b8f-3dfd-46a7-8135-dae036a57e69", "value": 75760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959233, "uuid": "771b4c7c-27ef-47d6-8040-eae82f8a0ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959233, "uuid": "a6b85fc3-5093-4021-ae71-99740bc9f8fd", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72636bd-2d04-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774963370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963370, "uuid": "341c3523-9538-4adc-95d7-cbb14fbc3179", "comment": "Malware payload (Vidar)", "value": "38911430e097181aa24c41f0157e20c8", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gratisexpert-com", "colour": "#14DE21", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963370, "uuid": "bdbab4a2-b701-43a2-94b2-40cbb0137cd3", "comment": "Malware payload (Vidar)", "value": "7e645a6143a2ce1ce7db369dab07f24095485fcccbe345033f604f1a524b974f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gratisexpert-com", "colour": "#14DE21", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963370, "uuid": "4faaf536-4d71-4528-a796-4423d303e232", "comment": "Malware payload (Vidar)", "value": "4bbaf7eab926ca4f97f44efd4b4dd31bc699436a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gratisexpert-com", "colour": "#14DE21", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963370, "uuid": "893afef0-58c6-4bca-b6a5-cd62a858530d", "comment": "Malware payload (Vidar)", "value": "f6bfc04e5c962c51b59b781a29252059873d3c4748b6a4c31efcc17bef16a044092784470695afe38e44825b991dc522", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gratisexpert-com", "colour": "#14DE21", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963370, "uuid": "c8c27bed-a62e-4de3-af19-19a0bfd5fd62", "value": "T11B27331814E189C18CF27283E2774F5F50ECB4673FFD6925CEBE645468ED8E08AE6129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963370, "uuid": "2ce278d8-889b-4904-86f6-07ebe7927c6d", "value": "393216:U2nqjnv8ToWdyFvr8P8XBKacS31YB9rmyVpC42LSUc1o:U2ninv898R892YLrbyzLSUYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963370, "uuid": "ae717fd0-6075-4552-941a-a0df8a6b8e58", "value": 20536494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963370, "uuid": "6df0482a-84dc-495e-a34c-7f065dc8f3d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963370, "uuid": "39d64782-cf90-47c7-8c25-58e73a73acfe", "value": "Autom\u00e1ticosWin-lnstaIIer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4bad5c-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979649, "uuid": "e6cfcb59-8e2a-432f-985f-96342e296446", "comment": "Malware payload", "value": "c923a78e3d3da6be010578dbd7c126d1", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979649, "uuid": "4177b2cf-6109-4320-b752-3f10d27580ed", "comment": "Malware payload", "value": "7fe42426794ca9703e5fe5f080428058d8ada7b0c78913e44f5da74a9debf305", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979649, "uuid": "666d0878-3797-4e92-bd39-15457fec9126", "comment": "Malware payload", "value": "a0d97806f4f452fc5ea16bec9cfc37befe5d1309", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979649, "uuid": "4e226f20-d03c-4585-8b70-96e2c996b40b", "comment": "Malware payload", "value": "7e4fd01b8a5d056bfbfd13c07fc1ee02dfcc847125a3b1cc74c83c22cedbc3fa5e206ac524ace07d5970c161cda79f86", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979649, "uuid": "24693cbb-56db-495a-81eb-c8b7b07dc08f", "value": "T14B258E2731A1941F6E65D2CBDF80BC6A4FC7DCD0E5A1A9EB28872ECC94C10D95CBD648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979649, "uuid": "54ebaf0a-2148-403c-a11e-e11e4ebfe74f", "value": "3072:ur8rBsnRwLynfx4ZCgYp53k/6/gBLix30An4QGUW77Zsv78M07M6un05LyODnvr5:u2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979649, "uuid": "413af0e1-45cc-4fbf-a229-834df7461c37", "value": 1013802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979649, "uuid": "891aa31d-9bf3-4434-b219-b1735f2bef0c", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979649, "uuid": "aa47a46c-0541-4084-b2d3-db1e1cb6a129", "value": "1MAR30_Annnnnnnnnnnnn-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d43bb28-2cef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954226, "uuid": "ecebb68e-0af3-44ca-b1d5-739de5204737", "comment": "Malware payload", "value": "a529d079a389edb9b7a4abb95cadb0fc", "object_relation": "md5", "Tag": [ { "name": "AutoColor", "colour": "#FDEA06", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954226, "uuid": "fc5f57f4-0458-4890-83ee-f44bb5321ef7", "comment": "Malware payload", "value": "807d9162bc1eaf01ab9e4f5301f370991a70d80761141f08e43b2af7c343510c", "object_relation": "sha256", "Tag": [ { "name": "AutoColor", "colour": "#FDEA06", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954226, "uuid": "4ddd465d-9eca-43fc-8ab1-06a6b08536df", "comment": "Malware payload", "value": "9b8a8b1164736c30f2365f51d0df213a9434da1f", "object_relation": "sha1", "Tag": [ { "name": "AutoColor", "colour": "#FDEA06", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954226, "uuid": "d61721e5-5dfb-4f4a-8894-d65fa818aa38", "comment": "Malware payload", "value": "52521f7cf24ac6a60557332507fa9820b56875736ca4e988fa5f0d55f8cef75efef7e44e55b8af8df91a8aef762e6cd5", "object_relation": "sha3-384", "Tag": [ { "name": "AutoColor", "colour": "#FDEA06", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954226, "uuid": "b8f754f8-c2c6-4d69-bc68-791ec2f918ab", "value": "T16324180BB6B1597DD09BF0348ACBD6B26870B4F42331752F37829D732D67E850B686A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954226, "uuid": "18a8a7d3-e52e-41e8-a1bc-817d685594cd", "value": "3072:k99fsZ/gw3IIdyN92ZR9M9qzwuKNBoHpxC/4Nq4G3CpiCHiBxm0BQ:k99fsXENwR94upC/PypiCHiBxm0BQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954226, "uuid": "e43e9a82-0f2b-4fd3-9c5a-8ccae31305fe", "value": 220968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954226, "uuid": "7d78bd82-cf69-461a-bb5a-79ab9d9b9e21", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954226, "uuid": "bdccfbae-9dd4-42d9-9105-275a1b5e01b2", "value": "fufufufu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cab795-2cdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774946691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774946691, "uuid": "f7008df5-cf95-4648-861a-3fe3d738428c", "comment": "Malware payload", "value": "95f694b15ef886e397b38616be8583ad", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Tedy!MTB", "colour": "#1EBAF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774946691, "uuid": "d0312013-e4fd-4441-95b3-fd2898d2a4c3", "comment": "Malware payload", "value": "808895347cc2f5a0ad9564055bc78e8842a228314068638ff159a7b3eb443fe9", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Tedy!MTB", "colour": "#1EBAF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774946691, "uuid": "20d09ffb-246b-4346-a381-1e5f6c57b877", "comment": "Malware payload", "value": "e93202f251d32f9f014cea70da0e45849a41030d", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Tedy!MTB", "colour": "#1EBAF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774946691, "uuid": "0a6a0d85-6375-4e2a-b6e6-024be397517b", "comment": "Malware payload", "value": "62b54dc3aa7c47f676aa57e311d5ae3e407960e25fe970437fdf0dfce3ce28b6ae77fd336a7d4937811aa08ca9bee0ab", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Tedy!MTB", "colour": "#1EBAF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774946691, "uuid": "08cf284d-209b-469e-88ba-2989252a499d", "value": "T10E548D19B7B508BAE1B7C53ECD134905EBF27C5647A0E68F03E04A9A2F237A1963D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774946691, "uuid": "65801b48-5f4b-48e2-be0d-657a53989470", "value": "baffc83cd397d235acf7a2795a87a792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774946691, "uuid": "5315bb0b-bad9-451f-bffd-d25215b646bc", "value": "3072:cB3nawZBQVM/EkuACGtDZxzpUgk2mIudxx9rPTatuD/J3dgsPp4b7Eh7Nupr4:u3nXM1ACWrB0FPTacdZmDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774946691, "uuid": "5f38621b-6e07-4ff3-b835-cf83629e4db9", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774946691, "uuid": "cd28de24-8228-4f8b-8483-6bc331442ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774946691, "uuid": "29d9c640-aa58-4e56-bbd3-84d5c145e544", "value": "808895347c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a29cf1-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959198, "uuid": "6b9758ad-05cf-40ea-926a-c7c4ae9dd492", "comment": "Malware payload (Mirai)", "value": "83be5abb8743e98b2a9cce66a499e6e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959198, "uuid": "32f75b68-dcaf-4e56-8c9d-c6f9e5d30e3f", "comment": "Malware payload (Mirai)", "value": "81624654cd84695cb1c881a0c5eec8ec6d7e2df2d515f9ffb08c72e522a64a69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959198, "uuid": "ea86276c-c048-41a6-9279-70796d95d44d", "comment": "Malware payload (Mirai)", "value": "90f7ad4fdff2bdf154b457e78dc70a3ba22906ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959198, "uuid": "5d91d6ec-5f6d-4b42-9ede-de189342333a", "comment": "Malware payload (Mirai)", "value": "97adc076c56c584610b98fcbf145db83ed2c5234fed2bbfeb0e8d361f828ad1a1f3b36eb4ba36ea5ccc2b5fc8bcb193a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959198, "uuid": "76f787d8-0735-46a4-9cfb-63e1ce3f4697", "value": "T183C2E10C0B22527BCDB49936A37E6E6B589C5C92A33E03159F59ACEB506C427B7074CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959198, "uuid": "6fc19ab3-89f1-4e5c-a6b6-b3a0e8ed862f", "value": "768:1EJmFYSeL48otg+0UJCxOAL+9mQ6uvyseyrA:1EJKYSs48FBWoOg+nxv8y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959198, "uuid": "191baeef-f8d4-4150-8c48-64e1040980b3", "value": 26888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959198, "uuid": "6aba72f3-288c-4692-a3bb-af12c654e540", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959198, "uuid": "a53b6bbf-8e8c-4937-bf50-134e5001150e", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a46f9a-2cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1774945571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945571, "uuid": "7d94575a-9263-4c4b-b393-7d8607efa53f", "comment": "Malware payload (MassLogger)", "value": "893f7523844cfb54071ee1b43b74673c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945571, "uuid": "67d1298f-7dcc-47af-846c-9c0c218823dc", "comment": "Malware payload (MassLogger)", "value": "83417bc16a7958a548395b36634b974b4e90dea3f94a1685a33c27c6c72db24d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945571, "uuid": "89cb4f75-0e59-43e5-9c1c-5ea52ac35532", "comment": "Malware payload (MassLogger)", "value": "529ed2e13e65a3c58c1c981f272f0d31ebbbca06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945571, "uuid": "5e2e597f-7acc-4e16-9b09-9f59a30f4eb8", "comment": "Malware payload (MassLogger)", "value": "fd29b79eb53c39e42e8c131c7458b483982cd3b1a0ea4d3e9b53ab88424337bc23ec2423ff58332e7eb6c5356b5c059a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945571, "uuid": "5bdb78ce-79eb-48e0-b0c8-a79fddcda22d", "value": "T1C515E0442369E902D0A75FF00970E3B417B86D956821D3178FFABDEBBD3A79158092E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945571, "uuid": "9c373e4c-5caf-444a-a8f8-54bf99cfe917", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945571, "uuid": "668d85f9-dc71-43a5-8102-602883acf9ad", "value": "24576:s/BOAScf+X3QRa4rk/vER68H7jF76uj2SB:uFSNLoR6C7jFXj2SB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774945571, "uuid": "f4343745-0efb-42c4-a2ed-ad960aedc62c", "value": 932864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774945571, "uuid": "dd057b39-06ca-4e79-bd03-a0fbe221a22d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945571, "uuid": "f4046fa3-7107-4b40-a6d5-0dc965d3ef77", "value": "SecuriteInfo.com.Win32.MalwareX-gen.31488122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7847daa8-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959399, "uuid": "364dc828-a122-4b9f-8595-591ad92d168d", "comment": "Malware payload (Mirai)", "value": "38309992b01179070b5ae5acadfe3f10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959399, "uuid": "b1f37a3b-c4a0-4c13-9848-b301d9253452", "comment": "Malware payload (Mirai)", "value": "838bcee5cda38a12b60b05fc92e6b21dc69b7139aac82cc6a89ee0236c2eeb94", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959399, "uuid": "2924e204-3d72-4394-9d62-64c153c1ccb4", "comment": "Malware payload (Mirai)", "value": "869f173ab67826a69618f7e798d641ebdba89bc9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959399, "uuid": "d6dd65ef-bf0c-4b08-9fdb-ec5883547297", "comment": "Malware payload (Mirai)", "value": "5764cf8230cf6da71d97933477caf7db69b3c87f222d5f389613c0af5333224ff921e274260c3caaaf61876cc9056d6c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959399, "uuid": "d1aa20a6-a6f7-4bcf-812f-3d32da4c0f80", "value": "T1C393090377094F07D06318F426BB5BF187A6BD6218F9B284751AFEC99271DF26142F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959399, "uuid": "f780edd2-e040-4021-9e42-c5f54b6ebb96", "value": "1536:GLM+0jysRh/6YwSKc4bS6WtPIw7zPVzo7q+gQVq7QlxnrsevVhgc:GOPRIYkTWIIPyVq74rDac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959399, "uuid": "ab4ef97c-0223-439f-aa52-73e2f7d2d9b9", "value": 88812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959399, "uuid": "ad5e3d91-e518-4765-baa7-1a4efcc77992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959399, "uuid": "67f73bb6-af1d-4484-9682-4f604bc07cda", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4937b7f6-2cb6-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774929684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929684, "uuid": "37dab211-7488-4472-ba9a-f472b90022f0", "comment": "Malware payload (RustyStealer)", "value": "1bbad5aa8890e8a471808726151a4ba6", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929684, "uuid": "57d5a7a5-2b95-4751-888c-9a1c02d60271", "comment": "Malware payload (RustyStealer)", "value": "8409ef6c3e9a54453ec5514dedf0d5e18f1dd96b32a83f7f3d5e1040b3701b10", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929684, "uuid": "fb6fcfa9-6a78-40fa-ba39-01d6a18015ba", "comment": "Malware payload (RustyStealer)", "value": "3f7574f88b9c1c5177bc7bf0d43a9168b6cc2b5f", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929684, "uuid": "8c435d95-cc71-4907-a28f-e1e6e9d87785", "comment": "Malware payload (RustyStealer)", "value": "db4036b7e3e02a4718ff7c9816707de9cab71fd2b4e7c98628542a01e22804cfa6b082c9ef9ee91019ea39873b1e03c3", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929684, "uuid": "b14ec46b-4bd1-4903-9994-aab4d36d6b12", "value": "T19166AEB9751068ABB62F43BBD6563DE9033227334787ACCDA064B3D216536B5FE16C08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929684, "uuid": "b400281a-9d6f-4728-8946-51d2f7df81e0", "value": "618b256a7b0eee7389c54e98caf9ad6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929684, "uuid": "954a1ee3-c111-4bbc-bab2-81948edf4489", "value": "24576:DwEKQzg+xjF5cQ0ty24gz1OD1vU7pGOWdEpLcEZI+5yBxVMCJoP0EvwpxP9Eaw17:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774929684, "uuid": "3dbb3a57-24d0-44d2-a4a5-22fa477d5cba", "value": 6938112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774929684, "uuid": "12a84ede-6fa4-4973-9169-ce6562bcd3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929684, "uuid": "8157ab5d-5bea-41ac-bc64-a2b5ea883c7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0a3642-2cc0-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774934123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934123, "uuid": "c5fe8c57-4087-48b0-bd6b-6aac8dea32f1", "comment": "Malware payload (SalatStealer)", "value": "742a68061c8cb2b1a9caa7061e7fb3f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934123, "uuid": "1db57cd2-34cb-4cd4-bb9d-c032bbb2f907", "comment": "Malware payload (SalatStealer)", "value": "855114d5fa06f19fc2f57845a24e9bf73c5b50fed04a9e4a04da40115c2916a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934123, "uuid": "92ce762f-99b7-46fe-a6da-73c64b579c40", "comment": "Malware payload (SalatStealer)", "value": "9eb4d7d86f47762af6ba1b9759e37f0ce9c601bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934123, "uuid": "5f0e8c2a-4759-4a2e-b471-3ab3a66134d3", "comment": "Malware payload (SalatStealer)", "value": "667ce82cd52263abe1bd251d0f8d442d92c097e1fc0ae01ef1c24e79af21d94a73d0c26a0d42652d59cb5956bf38c813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934123, "uuid": "e2b0cb1e-1e25-4c56-bfbf-f0fec3c73231", "value": "T13EC66B11FADB95F2E9035831016BB37F23315D048B28DB9BEB547B2AF87B6A10D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934123, "uuid": "6468eebe-e047-4a51-b1ed-a6c685588de6", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934123, "uuid": "1ad202de-a53c-4f7d-8c09-529604c21776", "value": "98304:vctGBzHr9HCXFCDTjppAgi5sv4aG20CME/:lBNiFWppAr4OM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774934123, "uuid": "e6fd7429-4f1e-4b97-aff4-fb6e367dc256", "value": 12572672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774934123, "uuid": "df1efbbd-9109-4e02-b502-f4cd4092489a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934123, "uuid": "be8ab62e-4959-4a3a-95ca-9b8939e0d1ed", "value": "b6e3fe7402b50f33ff58c45c62a6ba4ba5688dfa4620e9d2f64162bfc865aa04.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2502f1e-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959926, "uuid": "516c9e97-d439-4388-ab3a-d771fe35e31f", "comment": "Malware payload (Mirai)", "value": "015f4aae60b7da7f88038ba158f2836f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959926, "uuid": "f419c1cd-1fb6-4537-9782-8362f4f692f0", "comment": "Malware payload (Mirai)", "value": "85e754197e6b0f1dc42a3254032f082c978890bd7d39e30aa6623c330dc5d4d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959926, "uuid": "af068d83-9912-4f62-bb2c-612916a0060b", "comment": "Malware payload (Mirai)", "value": "1628fdae2c299fd5ee1e7451998cd4514a44ab74", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959926, "uuid": "aae7f62d-518f-4d95-9f7c-4393b5b972ed", "comment": "Malware payload (Mirai)", "value": "dfb7d838543ccb50f0d0044101a27dd3b8f4156d5f86c629499cdf553cc41e2791f4100d98cc3c0fd83bce7ac4466446", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959926, "uuid": "6d5299cf-281c-4b22-b7e3-9b85ac5a3cfa", "value": "T183C2D07473CE25D5C1F589B5AFAC48CA33D337BC54A871A60A508F9DAAC4C8672742CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959926, "uuid": "88e68bac-18c6-429d-8d22-118e5a3579fc", "value": "384:ELX2+fjlHzVMZk7sb+0bhNBAP7A9ZRpmYalyArdqaJA5wr8hhymdGUop5hguJ:ozpwoSJhy7A9ZPmRd5M6ws3UozyuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959926, "uuid": "0790691d-a506-4377-be95-1f8259904f85", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959926, "uuid": "dc2be236-5e68-487b-8cab-0e9690a4ebe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959926, "uuid": "6ee45fa5-181c-4157-bba8-b8bd15b4646a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe57757d-2d0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1774968214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968214, "uuid": "c0178cb8-f3a3-45a3-98b6-999425c0617a", "comment": "Malware payload (Amadey)", "value": "52003f6626751c2c2a6b8fec0beedd83", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968214, "uuid": "9c67a47d-f53a-4d28-81cc-ca15d2b54d05", "comment": "Malware payload (Amadey)", "value": "88313d63ba997c3cc9279cb5b1f8450517d08a06c8a074c42e733a8468b42c31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968214, "uuid": "57e19d46-72e7-4ca1-8cbc-285ee450e8b2", "comment": "Malware payload (Amadey)", "value": "eb5299e0c872e866d7a9e16f853dfbeec041106d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968214, "uuid": "84dbc190-fdf0-4486-a6d8-cf9c41054183", "comment": "Malware payload (Amadey)", "value": "d90ba3b6ce85fbc0d843a9a503eb727c2420eb92cf52ba80f3555d27b602c65345710646dd6f3ade4ed5ad45f6c04b46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968214, "uuid": "74f6780d-7968-4346-83af-fc73f481d9af", "value": "T100359D16B941C071D49401706269BFF2593CAA35672145DBFBD02EB2AD305F3BE3AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968214, "uuid": "c91d6d6d-3231-414f-b079-cb8a7fb20677", "value": "a252cd53ebc44617e8418747345d10c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968214, "uuid": "7dab51d4-e11e-4416-9e04-06e61eb94f9e", "value": "24576:zLCrua2InCFeiwzFJEUoBmx4I1bzNEhzcJZ4J:z+ruaRnC0iwzFgI4oJZ4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774968214, "uuid": "655c0271-7c38-47cf-80fa-cd67a10b3c06", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774968214, "uuid": "b07ac0a2-530e-4a8f-9227-a76f4286b662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968214, "uuid": "3d1eb8e4-9183-45fc-8732-9db0a7f1eb9c", "value": "cred.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f621db-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959660, "uuid": "1d58be23-c306-4f1b-9cd0-fe6a40719d06", "comment": "Malware payload (Mirai)", "value": "2269684e7950087b4bc1d1d698e52b92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959660, "uuid": "07823036-0e63-41f1-9269-451b0b6dba1f", "comment": "Malware payload (Mirai)", "value": "8839a4789baf701456b6caf9e945876ab8129c4b158480004f891bb546fe9696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959660, "uuid": "6aa7d3b5-294a-4362-a7d6-4df4ffca54cf", "comment": "Malware payload (Mirai)", "value": "a4b4fa5d2ce4aada2c967357b2585f5c8df76c9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959660, "uuid": "208dc321-2f6d-48b1-9c10-c93abfbcdd98", "comment": "Malware payload (Mirai)", "value": "5e731674ad319154d337600f84870347d09b5cd71ed666c8e575af492ef3088eec549f763369c50ae15592a309a992ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959660, "uuid": "1bcd7e4f-d660-44cb-8bf1-0b89da13d5ce", "value": "T11FC35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959660, "uuid": "ce1c4b56-c8fb-4786-b05a-773cc9fe6292", "value": "1536:UrAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3f:UEFmSmviqS1Bs0+Nd6lAqktNMxSNbmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959660, "uuid": "53a15b2f-e56c-484f-a1e9-4df78af41129", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959660, "uuid": "29e6d4b7-386b-4b00-8a57-dee00197f853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959660, "uuid": "45254e9f-0afa-4851-954b-81c5bde97ccd", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec270f40-2d12-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774969471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969471, "uuid": "f5ae4f57-08d7-4f26-938a-46b938660fb2", "comment": "Malware payload (QuasarRAT)", "value": "bb1df94080cfd1c1c58656d8a850bc3d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969471, "uuid": "e288659b-de3c-4524-b5cb-b35bcb1bfccc", "comment": "Malware payload (QuasarRAT)", "value": "8853de0df86223a9a810815f82167dd9970b934d7c0ef6b53b6d913c9fbc43ec", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969471, "uuid": "c9dc9012-5801-4c55-9a2a-8797a0ca5062", "comment": "Malware payload (QuasarRAT)", "value": "9893c717856097fa5bc91d0171f140f192c5e62c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969471, "uuid": "a5aac769-b5c9-4ea0-a900-4a661a26b193", "comment": "Malware payload (QuasarRAT)", "value": "d86cb94e465c7578d2a13ec8c0b485faba3dc3ca0d51423045b7e8b47fc6920fd4146ca72de9a6e3b8f1ebc74d979c43", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969471, "uuid": "2d91ad93-505c-4787-99a9-4770be9bf5c0", "value": "T1544502B123D26FBBFDA88A1463B8798D19F25F9F06801F1F66723A403B499C61036D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969471, "uuid": "b5ee43e3-d5e9-4b1b-9a9a-14a259a0a078", "value": "24576:34ZGzNkeJTlDC6/2rRrTGjKJWtllfEI06n:Fnx2utME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774969471, "uuid": "6c8fb0f5-09ca-4cae-b4d7-80fd05ab2721", "value": 1224766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774969471, "uuid": "58dc3906-857f-456c-9fb6-cf6fa5677761", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969471, "uuid": "f8a0821f-eb83-45df-be69-cff5ac1bfef2", "value": "8853de0df86223a9a810815f82167dd9970b934d7c0ef6b53b6d913c9fbc43ec.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76044ec9-2d47-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1774992037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992037, "uuid": "4a59e27c-c00f-41fa-8794-6e33c6ea9801", "comment": "Malware payload (RatonRAT)", "value": "fd6f0e5526a869a495c99a41127f70af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992037, "uuid": "fce8fb2d-d7db-4efa-ba93-20256bf4f730", "comment": "Malware payload (RatonRAT)", "value": "88d541eceb31d21c154521bf785d8647db4871d8c5d460d96cffaa6f4995ddd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992037, "uuid": "e7b41ff2-0cf4-4331-a574-4b122f33b7b0", "comment": "Malware payload (RatonRAT)", "value": "b023e0e4e18529aca9a4c73a1904374064449366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992037, "uuid": "3edf43f9-1a39-409b-9ac5-728171765f70", "comment": "Malware payload (RatonRAT)", "value": "4e46889547196d5ca960305eabac8bc03f8e2e42a23273ef6ecc4837a9ca686b43d35c6b9d45ad3e63bba7f32b2eb909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992037, "uuid": "a5830c61-5b9c-465c-8180-d96dfc81aa8e", "value": "T129936D0033ED651AEAFF8F7D6CB520004A737A1BAD71E64D4C86519D09B2B81DE24F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992037, "uuid": "c8230f72-8d29-45b2-a50f-86e91430dc1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992037, "uuid": "26e827de-9ea4-4f29-a8ae-cbb29ae14a70", "value": "1536:Tr/cgnkn0lEjeb4ApJfTsqa4tsi5qQf+1LGyamlbTKhCjpmsYw:TDcjOvpAX4tncQWRG9mlbTK8jpmVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774992037, "uuid": "32b4c0a8-c954-4a1c-a20b-24db4d3de6a7", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774992037, "uuid": "62d0b62d-c745-4ffe-a1f5-db3e028c9e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992037, "uuid": "b5d402e5-6718-49cb-ad8d-efb8460004d0", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0ec0de-2cf2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774955759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955759, "uuid": "6705bf59-561e-44c3-9bb4-85c5bb892e11", "comment": "Malware payload", "value": "6fe88be2c0fc0bc14ded6bdf6c71a2d8", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955759, "uuid": "65580169-4f37-4a50-a9b7-76f5d2d6c3bd", "comment": "Malware payload", "value": "899a461c8a9fdef19c89c4a83e44a0d56097c1c856299584ac4e164394741362", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955759, "uuid": "60323712-a83d-49d3-966f-dc616e804f09", "comment": "Malware payload", "value": "f507b761fee9d69735f36eaa44a3a2c51e1ef20c", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955759, "uuid": "2ebfcf2d-c0a8-469b-aed7-4ae1e919dcc0", "comment": "Malware payload", "value": "97109d101eaef741f2bea0dfa6a793578854e99696aaabceff38458173525758fce1dbff285f62d647890af0d8e5e7ef", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955759, "uuid": "47799160-97e3-4cae-81dd-be11e7f2344b", "value": "T176573321A28BC131E55E4477D83AEE1E917A7DA7033041C7A3F475AF2D724C29A3EB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955759, "uuid": "1e0bda05-3958-435e-aed8-f529d0a2deaa", "value": "786432:0GvjWfWxaRrOL678enXopCsi6dhR8uHKQ+w:0GvjSqaRyLRyo8sBdrz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774955759, "uuid": "3922bdca-7480-425f-9fe4-636f66afdbaa", "value": 28591616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774955759, "uuid": "fb3b74be-2a39-425f-b916-061726c2f31a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955759, "uuid": "d1f43866-1f56-41e6-a42e-9a7ab4c99ab3", "value": "glqchoiding.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336c43e0-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959283, "uuid": "0665baff-d289-4db7-9232-8a9245832db3", "comment": "Malware payload (Mirai)", "value": "0bb1afd9bee89cb8879bf6908a2725f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959283, "uuid": "1765ce7c-a8b0-4206-980e-e07081e9277a", "comment": "Malware payload (Mirai)", "value": "8a8aa0fe224f9dd7221e1538ee8c337a923a55c0407c60d12b208da9b25a199f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959283, "uuid": "30e53ee8-e2b4-4268-812b-c8f4cdf050d2", "comment": "Malware payload (Mirai)", "value": "57324a0098165f656c7ed1a3d7c5f05f48e5d2a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959283, "uuid": "515463a6-7100-4add-9e26-862d3add7d31", "comment": "Malware payload (Mirai)", "value": "88b79d93578a845541aec07300e9155cdabd0db2fd34838c5e0007bbcf71922c1a954d321c0f18082e5756ae7451fa33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959283, "uuid": "d116b9b1-bc1d-46b0-b2ec-8283b4fc1697", "value": "T100A3E705BB640FB7EC97CC370AA56B0129DC661A21FA7B36B930D848B55B21F25E7C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959283, "uuid": "3cd3c009-81a2-41b9-a68e-4e935aeb7439", "value": "1536:z4kKxp+p7KJyfteflX5tM/et47fZ4IqIlX:z1Kxp+ZKJyfto47fhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959283, "uuid": "cc8b078c-dfed-4bde-8260-354afc537425", "value": 101820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959283, "uuid": "e3aed58f-34de-4c53-bdf8-0bcd741cbe6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959283, "uuid": "cce47f1c-666a-452c-b5e7-eec602483c0b", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4847d289-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928824, "uuid": "4b64566e-e4bc-4662-8c67-745fd6488955", "comment": "Malware payload (Mirai)", "value": "bbea3d56949aca349495d5a8bfc6220b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928824, "uuid": "99dd8c97-3a4b-472e-a87b-8753a55ae137", "comment": "Malware payload (Mirai)", "value": "8b32b32951c101b304f6def90ed002f99a58fca7d2958699f9f3a35704624a0a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928824, "uuid": "f7c289c5-3b3c-493e-813f-2b8e1ccb91f9", "comment": "Malware payload (Mirai)", "value": "04c5425d287d0987b9ad109147722a5f0a715bbe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928824, "uuid": "dfe01902-6de3-49d6-bc5e-62f7eb416775", "comment": "Malware payload (Mirai)", "value": "d0529fa274279752834143fd06c97d313cace3f3300d395e5096db8c1b61ec697a66059cf5429ec9b871ad337d735a82", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928824, "uuid": "af4623d4-caab-4236-88aa-45fbfa3fc617", "value": "T1151301D1136117888361EB7538AE701A8538252B32E51E403D97A64EF60F715987BEBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928824, "uuid": "01d478b0-42e4-476a-a663-350a8ed06f48", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTGZ:87vbq1lGAXSEYQjbChaAU2yU23MA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928824, "uuid": "fd00c342-a010-4cbd-b417-1b256c18b3e6", "value": 41960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928824, "uuid": "ef4a613f-e876-4f2f-ab5d-42adf1b29150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928824, "uuid": "0cb8f38f-ce31-4bae-a35f-2930ac448e3e", "value": "mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88209a5-2cd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774941521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941521, "uuid": "1f6bbb9d-f853-463a-b90f-1dc0c7369599", "comment": "Malware payload", "value": "57965274ec01057d19cb2e08582962a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941521, "uuid": "865ae898-d333-4101-a4d8-d33770e8e2cb", "comment": "Malware payload", "value": "8b3794b98f89eadff0c9a41ee8bd8aa62e6782014ca53e417f1abdc3ab2eb7c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941521, "uuid": "18ae65f5-cfd5-4561-8c7e-4e1901357ba5", "comment": "Malware payload", "value": "2e8f0e1ad53cf6a1b444df4fa4c53eda1bc44a3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941521, "uuid": "d3236d0d-d117-4a68-bc94-a356dda12b41", "comment": "Malware payload", "value": "4e305f492ce99fd218a6cc8d7ca7271b6b7b4beafcca3d5b3ee39241f40be94efa3f1b501ad325a67b858f9ff317b24b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941521, "uuid": "3cd922cd-3348-4b3b-b08e-7dc88087ccf7", "value": "T13EC25E04A7FC0518F2FF5F355ABA29504976BC8A2E75CA4D2E42409E0DB5BD0DEA0B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941521, "uuid": "38b4642c-4277-4866-b800-8563049e743c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941521, "uuid": "43c44273-acc8-4537-9ac7-f044d66026e5", "value": "384:gyqJ4NAf/BQE4uCbMoYw3AFuBejSoUs3yffKmagZZjDEDtOXD8wcwS49:7sf5NCbMoD3A/GOcdjDEDtOXD8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774941521, "uuid": "76d0d176-1c29-455e-999d-ce74d290467f", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774941521, "uuid": "aa1bd5cc-aa1e-4e30-b0b1-34f8e6803c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941521, "uuid": "2790eff3-222a-490a-b78e-8a0e01f8b5aa", "value": "8b3794b98f89eadff0c9a41ee8bd8aa62e6782014ca53e417f1abdc3ab2eb7c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3b9276-2ccd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774939707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939707, "uuid": "798cc529-e926-4e27-82c3-88db56de6cd7", "comment": "Malware payload (AgentTesla)", "value": "43025fd695c379acd3efbe459a99e8c9", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939707, "uuid": "4fc2d8ef-4beb-47e6-8287-4d2d65c03599", "comment": "Malware payload (AgentTesla)", "value": "8bfb1cfd0b05ffac2f9d4236c8decdc8681bce52b2839332aa1e38bcde43462f", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939707, "uuid": "1af96b9d-d607-4861-851b-a33c1ccff583", "comment": "Malware payload (AgentTesla)", "value": "3884ea86a5e084c7dc4e9beabcf50de0165164e9", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939707, "uuid": "35429bfd-a5e1-4a4b-9962-235a36be7163", "comment": "Malware payload (AgentTesla)", "value": "408f52e479aee7a473f4761e31fa1525f760bbefd5c650d3786aae4b8c281403b74b8ae0a295e9c282fa723cdfb2a01f", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939707, "uuid": "87ec7bdc-a2c9-4285-898d-83ede5baffad", "value": "T1EA253313D2FFB740EB5B6357396C3795A5AAE21DD0B8C9C1A33C9D895ECA901BC60D08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939707, "uuid": "18445641-5b99-47a3-81f5-a9340f44265c", "value": "24576:9IoGgrIMzLrxF4HtCKxSGh/hYGMqG99fYjxIOsa:95Bn3bYtCKxvMjH9qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774939707, "uuid": "ba4de493-c7b4-4d30-ac52-affc86e12f47", "value": 1002883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774939707, "uuid": "94c1a370-e8ec-4ec2-ba6f-7d4272c8ff1d", "value": "application/x-ace-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939707, "uuid": "cadd6023-ebd9-4b51-b4a3-7c7b87438b7d", "value": "Invoice No. 9296.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f38d64-2d10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774968357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968357, "uuid": "af899b0a-78bc-415f-adc5-3037fa062a90", "comment": "Malware payload", "value": "cffe67da05e2c61f7653d360c652995b", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968357, "uuid": "8fc00d75-b917-46f3-8330-8efc45863ffc", "comment": "Malware payload", "value": "8c8f5f095d65d3f33ce89a77dfbe84a79bb29d2e0073a57a23dcc014d0683c2e", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968357, "uuid": "c3e17c52-e906-4fc3-ab58-aefbdccbb566", "comment": "Malware payload", "value": "3b28f21fce62464b2b9da544ee389d4f04d8213e", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968357, "uuid": "de590a34-e57c-4a18-8a62-7adb23e75c98", "comment": "Malware payload", "value": "dce754ec63800e25aca2778e18aac17296d7d65b824fdfde925eabab8f4fb58df0af707a97309def571cf86010769b82", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968357, "uuid": "53bf4670-4fa2-4a1d-af11-9f337be40e56", "value": "T1F6328310391BD02456F76329DE57E448FF26413B23651410BEEEC6D42FB096AC6B8FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968357, "uuid": "cc02b24b-c8f1-47d4-bd34-7cc024e4550a", "value": "192:b9u9gG89mD+SOzuahCnGX1pybp0j5PWFmFBiMluIY26qb7cTOXQWumPTvCfuYRN9:b4KG8MwzuaEnGjPWFMBiM9Yy/LCfj7Hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774968357, "uuid": "070e488e-70eb-4eff-92c0-3d6f06842275", "value": 11019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774968357, "uuid": "70fe6c62-0bc0-4abd-80cf-04b5571d47ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968357, "uuid": "c7632020-4f77-4bb6-81d3-074406a66eb4", "value": "8c8f5f095d65d3f33ce89a77dfbe84a79bb29d2e0073a57a23dcc014d0683c2e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7689903d-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959396, "uuid": "3412a703-6bb6-43a9-bb26-636c9541c3a9", "comment": "Malware payload (Mirai)", "value": "be15b8888d46be9b12a719416b961af7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959396, "uuid": "29e433ae-c3b2-489b-af06-a887fcc11df9", "comment": "Malware payload (Mirai)", "value": "8c98ae6639806e4f9536988eeee729061fc3ed92d267cf3cffbed0fbec8f026b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959396, "uuid": "6cacc707-5d39-49d1-9dab-5f976e33b303", "comment": "Malware payload (Mirai)", "value": "ac84d3eaad6d885825f8bbc1edc9c1e00170369e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959396, "uuid": "a77b3176-ee0f-468b-8406-38b915f07cee", "comment": "Malware payload (Mirai)", "value": "41dd38ee830ae6a6bd6a49337de596f01dd593ec24e043cc02da1305160323bb40cb9b8ed5eb47c5a4667ec28ad748e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959396, "uuid": "de0bc8ea-8521-4932-9cf7-2c14f86796b6", "value": "T16A83180377090F43C16329F026BB1BF097AABDA519F5B284752EBEC59271EF12181F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959396, "uuid": "3ebe82eb-c8fb-4048-b2cb-fe18e77e0154", "value": "1536:VLblgTewtHfOoA4171kBcyQDeWKDDqIiSmJXSZf2ikBIH3j8JF4:Vy/WoJ7em+vm3ikcg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959396, "uuid": "0a9118b8-ffd2-4055-8163-b5806ee453ad", "value": 88732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959396, "uuid": "8934c334-d708-482a-a2e4-04304d1af8bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959396, "uuid": "8bb566a5-6b4c-4ab9-84df-2e97a3a001b6", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6211ac3-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979689, "uuid": "749b558c-20b6-4d14-9bf0-60970b8d6fd3", "comment": "Malware payload", "value": "403f1a3b591c6da42efd290ec3094cdd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979689, "uuid": "075d7849-be77-494e-a8cb-a2b55277f94c", "comment": "Malware payload", "value": "8cda591f526a09954c7a60337daa767be7948367ee52accebc30061be1dc581a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979689, "uuid": "b1e89ddb-061e-4e53-a1e4-24bee4be70fc", "comment": "Malware payload", "value": "89b06bbc0b2a85578ed8b48937aa5146d98543b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979689, "uuid": "232491bb-5946-43be-9495-4d42806c24dc", "comment": "Malware payload", "value": "cde83520526adcdfd91b490b7cfb68e521627f2f6d91d55031a410c53b2a6b83a04c4ac4aae3b0bc20ed184cc2599c37", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979689, "uuid": "d4ac4331-ed90-48f1-882a-d26c4a5043de", "value": "T12663A5C536778872D27FAE7AE7C7624B6DB54073A901D1450CD276E36A01E82C90ACF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979689, "uuid": "1b6a3bd4-085f-4734-8a67-e02bdc2d41bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979689, "uuid": "89c00489-da42-4a9b-b486-392cc4efca82", "value": "768:d30kL9ZAugqwomzrZSjO/fp+jevD9bqR1YdpAGk3Rs+z:dbL9JgqwomXZxXL9bqRSUG2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979689, "uuid": "63349926-9594-4334-b559-37e10f3e5c2b", "value": 71464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979689, "uuid": "29588fb9-ec44-4c37-bde3-590ebddd1565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979689, "uuid": "e60c546d-c7a0-4f60-aa1c-b28f817ce75e", "value": "mod_Vio_shellcode.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484a8ae8-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954594, "uuid": "ce8cbb22-4b8d-4d18-a9ac-3397eafd0989", "comment": "Malware payload", "value": "104317d08b05497cc1301654675f4b00", "object_relation": "md5", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "so-py", "colour": "#D9AC7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954594, "uuid": "3db8cbb8-b598-4b44-bb51-38b8676ddea3", "comment": "Malware payload", "value": "8ce121438e2ea688aa3e7b34cf42bff778978e4a32c378b702177289555fa28b", "object_relation": "sha256", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "so-py", "colour": "#D9AC7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954594, "uuid": "5fd5cf33-6eda-46e0-ba71-07c1206e5798", "comment": "Malware payload", "value": "b29a5158a44ff1451f32abb300e6308573651cb4", "object_relation": "sha1", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "so-py", "colour": "#D9AC7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954594, "uuid": "cf029b5f-c184-4ae9-b5e7-bb9412a69ae2", "comment": "Malware payload", "value": "cf2205745e853e57503a5218861e48c77c9ab748f7f54bb2bfbc069445c8a5c6b31210a3cd4fa9f9e462136b3e591e1f", "object_relation": "sha3-384", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "so-py", "colour": "#D9AC7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954594, "uuid": "f37039a6-9cd9-45d9-9354-7be9d25a0a8c", "value": "T1DC713C5DACBE058AD1F073BB1C4FB3F9FC0506DCE774A4CA93D830529569A3546A9064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954594, "uuid": "31c9d31c-fe68-4d35-b9bb-6c977f7ea0a7", "value": "48:9LKIv+71q/jR3deYH2tohnfYNo/EOZA7+tDAIC/s5JIdbISwjlrFueyYb2ZlA7Jk:8N62toRYCERSDbnIdbISfKbIl0x6SCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954594, "uuid": "eba5b4e0-f3e1-408e-a30f-1ef057c16710", "value": 3550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954594, "uuid": "001a8e26-d807-414d-8e29-7c9fe9f523f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954594, "uuid": "6c8919de-1177-464c-afdb-668074ef682c", "value": "so.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9e05d8-2d00-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1774961605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961605, "uuid": "255800f2-ebd0-4aa9-a43c-ad34deabc359", "comment": "Malware payload (CountLoader)", "value": "13c856b52973503167b553e795d97b68", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961605, "uuid": "7b8275fe-7508-4920-a405-2b35d2ffb2f1", "comment": "Malware payload (CountLoader)", "value": "8f0f6b0559b24fddb8519ce29171ce5a465d83a5ab8827a1ab715e7290aa7270", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961605, "uuid": "f928af1e-db1b-46aa-9794-5fb26929f862", "comment": "Malware payload (CountLoader)", "value": "4aa1d5aec9cccfd24d9baa8dc4cb87efb0c5ca66", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961605, "uuid": "49a539f1-9baf-4870-815b-f4d0b9a22dfa", "comment": "Malware payload (CountLoader)", "value": "182021efb8112172844ee6f01190ea1f4abe57d6e42c9f3cc8066af22772a502533eac5c6e67c5df426a942946409c5b", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961605, "uuid": "e2c07380-31da-427e-ace6-f8ae51bfd75e", "value": "T1EAC371CA9EDF86F8D71BB424859F9C6399E5C207020DC652BB9FD9903F26C29707A1D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961605, "uuid": "d3d476ed-65d0-4974-a83d-0ef096ed4d0e", "value": "1536:LIWU1YntWvFf4lgh3XG0R8S8tZ1l02uEYrFcer2wr:e1XFHiKDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774961605, "uuid": "fe42c923-e707-4a6c-89fd-78ee3c0105a6", "value": 128342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774961605, "uuid": "08a56ccf-6266-411a-b03b-eee7a7059bff", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961605, "uuid": "95c76baa-2609-479d-9763-1ae9be2147b3", "value": "Report_Asia__15.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da4d655-2cef-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774954307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954307, "uuid": "39a3cbcf-0409-465b-82de-11374c258e1f", "comment": "Malware payload (AgentTesla)", "value": "601df52bcd22a3704e774dd142868fb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954307, "uuid": "ed6bedc3-3bc4-435b-8654-8be49ac1729d", "comment": "Malware payload (AgentTesla)", "value": "8fcb8407c06073b871dc26339a59c98b3df02777f173dc2c648df015ca754e12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954307, "uuid": "066adb21-6e2f-45c0-903c-bed48c90ced9", "comment": "Malware payload (AgentTesla)", "value": "994b63f6d8b5e743fa16a3cd58ea481fb87b9d84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954307, "uuid": "4cb123ec-8684-44b1-9cf7-45182630b9d6", "comment": "Malware payload (AgentTesla)", "value": "e70f3a90649303917772bbfe18dcf496cc06d50ec6f3cd8f279fb521fa599419a6d78ae6fab945658c1beda1a024fc64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954307, "uuid": "50e44aa6-b80d-4154-9e2e-b61509b9934a", "value": "T14A645D60ED3516674DE327EDBDA85960C9BEC919912740F6F7C8030E61016ECD7BE22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954307, "uuid": "a6a42bcd-7a6d-4690-b5e1-ca3ba0a2c159", "value": "6144:24OwWgD7GHJhjYyZqI209Eay9w7MW1gPBO:24OwWgD7GHJhjYyZqI209Eay9w7MW1gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954307, "uuid": "8d0f2f92-969b-43da-a28c-4965fd68c9d8", "value": 317324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954307, "uuid": "dce88f29-cd1b-4256-b431-324257ee1ba2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954307, "uuid": "3d0a4224-77f9-461b-bbe7-c19d6917f72c", "value": "IMG31032026-00316.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557e985f-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774960629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960629, "uuid": "88544485-298a-47f9-b614-86a9b9bc4df8", "comment": "Malware payload", "value": "ce76c023ea3ad6d53edb3125269dab50", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960629, "uuid": "47a6ef26-af16-408e-8aef-8cc3d3d26cc8", "comment": "Malware payload", "value": "9020f5502fb3d72da1073e125552ea8eb335f3b74a12f0c0b575c0490ee92dcc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960629, "uuid": "08caf561-54cd-4654-8031-00a7ed228f37", "comment": "Malware payload", "value": "0381ec5d229e34985889baeeb6690098f71a7c1b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960629, "uuid": "03770d26-2093-400a-80c7-73d2e7c855fc", "comment": "Malware payload", "value": "94829a26d1220dd19fd51317a1cdaddf9e4d60a136010ca26bb014aec4839ee0dde8f0d57ded7a8f3d9e6a09dd288734", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960629, "uuid": "404a49ff-344a-40b7-acd3-3c8a6fa250ec", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960629, "uuid": "f8d390a8-6fa6-4b7a-8be5-da1eea852b1e", "value": "3::", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960629, "uuid": "f0224602-8320-4dee-a982-4217ec4989d6", "value": 22282240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960629, "uuid": "22e94223-edb5-44d7-a3c7-932b23b799af", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960629, "uuid": "7977ead3-809b-47cd-88a9-54817b09743a", "value": "RSVP_INVITATION_2025 (1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5e4a58-2cf9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774958525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958525, "uuid": "59c6e189-36bc-471f-9697-a9de5ad9708b", "comment": "Malware payload", "value": "c273121923f5a58be2dd24d7ba339b46", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958525, "uuid": "a8d1da01-9d99-43cb-92ba-5562ecb08335", "comment": "Malware payload", "value": "908fe9b3187ed47ebefa1e61019ff08ffc07655302f3feb2c86bf8723e64c7fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958525, "uuid": "8c3417d7-5554-48da-a23e-f006a4ed8515", "comment": "Malware payload", "value": "68758052b12067648b02582708ffc8c4c08a33bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958525, "uuid": "d2198e66-88b5-4b1a-8a28-f505d8eb390e", "comment": "Malware payload", "value": "b6f6293b33a1c6444e18e1f274364ab769d48551b6937a5774fd9438d743f6f733dd6a7f811b332f2361d6e5ff0c33f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958525, "uuid": "fcd60dfa-33be-4c8d-9206-fa0607cb8801", "value": "T1AC27BE77814338E9E5A98DB4D41025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958525, "uuid": "c8ae07af-55b6-475a-995e-527b8ab3477e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQq:cqYUQuVDt0TZEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958525, "uuid": "fb71ca19-3d85-4aae-ac53-55540baa9d1e", "value": 20578304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958525, "uuid": "016014d6-c334-4e48-a17e-8293a0a061f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958525, "uuid": "e5790340-8cc2-4dac-b958-3e9ef9b19bc5", "value": "panchan.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587cd54b-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774960634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960634, "uuid": "42a65d67-1203-4e1b-9f85-48638f21adea", "comment": "Malware payload (ConnectWise)", "value": "2ff2b8159a56bc89b8253ecaa9a6e333", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960634, "uuid": "67889778-ee3d-478a-8c66-c0c405389643", "comment": "Malware payload (ConnectWise)", "value": "90a4a456c7dafc0fbbc5bd9b6655ebc070c0101a1640dd54ca00a0f6af3e9c45", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960634, "uuid": "1c1b67f7-6c38-413e-8531-bc91d5b378c9", "comment": "Malware payload (ConnectWise)", "value": "b7534a55c4b83a8fdbbaeb5b97b08a8ec9473adc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960634, "uuid": "94f7e6df-8a6e-4f25-a015-4333c3e9cb81", "comment": "Malware payload (ConnectWise)", "value": "c0e1d584707d7a9e5e229186f949048f50d6443e6ae1bcefa2f1fd8677af869bb6dbe6b57ec8510a6fc5e7f0e525f7d1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960634, "uuid": "2e47780b-3b68-416d-ae83-41918e618076", "value": "T1ABD61201B3E69574D0BB0A38D87A9266AA31BD005716C7BF5794B92D2D33BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960634, "uuid": "6ca6f425-9867-459f-89fb-ce2376aa2cd2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960634, "uuid": "a8d37457-a2b7-457d-96ff-b42ed34c8bef", "value": "196608:jfefPBBn2hg5kEWmXhcfKjSVJh7vGesBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhce:MgdEEijCDGhgdEEijsgdEEijGgdEEiji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960634, "uuid": "fc8091f8-7fdf-4457-8c09-3bd62ea5e9b0", "value": 12637240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960634, "uuid": "7406dbf3-5f90-47bd-ba58-857db02b8872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960634, "uuid": "a62f8e83-07e0-4af8-877f-bc4f982994a6", "value": "ScreenConnect.ClientSetup3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b87b9b8-2d1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774973900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973900, "uuid": "470a05bf-7d01-41de-8e73-c1850fa1d12d", "comment": "Malware payload", "value": "975aee01effce31ddb212ef254f18cee", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "gaowvdoxh-com", "colour": "#F3DECE", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973900, "uuid": "c2b0551f-d51e-4d7c-816d-f2aab6163665", "comment": "Malware payload", "value": "911320677000b0c063912074729644699d29981cdbb2f5e5772a962aa7128cc2", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "gaowvdoxh-com", "colour": "#F3DECE", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973900, "uuid": "23222c4b-c4c2-467b-bcb2-0e0100c4b6eb", "comment": "Malware payload", "value": "d27d0b054e1cf9594fa31cc58cde03ce428cfc6b", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "gaowvdoxh-com", "colour": "#F3DECE", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973900, "uuid": "2c157629-f0b3-4aa3-a247-d5de6a6e1ef5", "comment": "Malware payload", "value": "15f4d62f7e91ca540dd33ec4440a4eedbad8fe299f55be7ea28c963d778f3f037d322a5dba0881693c6da325769bfb08", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "gaowvdoxh-com", "colour": "#F3DECE", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973900, "uuid": "952e1dbe-97ae-4671-aee9-d8aa1d4c6d5f", "value": "T15E92A616A6B300226957C0A867E7EB4A37314007C745CE6D3FAC52909F8ADD5ADB37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973900, "uuid": "d5fef0c1-f2b1-4e57-9863-0d68688ea165", "value": "384:U5jpC+rwTFuFMLsiMQWZdGm0EQVk4ifiFibi/iOk4ibk4ink4i9nvk4i0k4izyk8:UZw+rwTFuFMoAm0EQVkVa0+6OkVbkVn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774973900, "uuid": "069f4db6-6e54-4639-8036-4d4d2bf5bfa2", "value": 20152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774973900, "uuid": "49be63b2-8ed9-41bf-b98b-d9300786f5a4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973900, "uuid": "c469b072-6e61-4230-85d3-7275d317e800", "value": "911320677000b0c063912074729644699d29981cdbb2f5e5772a962aa7128cc2.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdd2d0f-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959277, "uuid": "801869ac-bf4d-47bc-aa57-79ed3f345bce", "comment": "Malware payload (Mirai)", "value": "411af9f29a3a27356373a8f6ed1611f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959277, "uuid": "224b0447-02c3-440b-bbb5-872a141d3afa", "comment": "Malware payload (Mirai)", "value": "916c8eb8e05cc3235293a2931675adc240fcc86b56d5d93c384ddfb53c40352a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959277, "uuid": "0b82d837-355b-4ad0-823b-9e9c3f5a82a3", "comment": "Malware payload (Mirai)", "value": "38f96971d41a38dfdc49dd661bed2881de5a85a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959277, "uuid": "7c64d756-ad2e-4df3-bcc5-132e2bf91c8f", "comment": "Malware payload (Mirai)", "value": "dcaa0602d5013da5ccae14a7d5fed744f0fba6ea5da52095b13253982228316a9e2fbb98ef40a48b7fc0a0a0121536d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959277, "uuid": "0d468d0f-de55-47fc-b272-876f55546131", "value": "T10CA3941F7E258F7DFB96863447BB8E175648378A3795C582E19CEA012D6034E340BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959277, "uuid": "c29b7d0e-6a87-439e-bf28-e6f6c4150b52", "value": "1536:K6ngnRu0S04+8g6/D37OPT8LUPRZV0HsaQFi3xe1:Hou09ID3KvPV0MaQ03xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959277, "uuid": "771101bb-0bdc-417f-8e93-7484c5b20e9d", "value": 97724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959277, "uuid": "458c87c4-d92d-4511-973d-96dd7bbff6f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959277, "uuid": "72d42b4a-1f38-4079-9042-53efe9742198", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7e3c17-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958894, "uuid": "9c5e9784-0fda-4f75-a061-23aa26c8b89d", "comment": "Malware payload (Mirai)", "value": "b1c96a45ad9211a849c82356209f0a1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958894, "uuid": "a03b4459-c767-4360-9762-eb64ccbb2e39", "comment": "Malware payload (Mirai)", "value": "9267c307b97d7bbbf3124a86386843c3d904b7c2faf207830195177033da2c8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958894, "uuid": "dd4bd294-6ba6-489e-9c96-54ce23414c39", "comment": "Malware payload (Mirai)", "value": "b9c49b85cca6e48b1c93c4e3eb34ec9204bb1beb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958894, "uuid": "451c800f-8d05-45ab-8ca1-953e8f25ef98", "comment": "Malware payload (Mirai)", "value": "aadf5c7c817a7fa5550e051bebcd3bdea6779f87fa59b8a6f2573505725a743e5813499b32a15987054ddf9bf45d9023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958894, "uuid": "10e2ab51-b096-44a1-a316-f329eb3b5b9d", "value": "T187732991B8C29A22C6E0137BF96E458D372563E8E2DF3217DC252F6477C641F0D67A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958894, "uuid": "b3f4cc5d-efd1-4bcb-ac95-caeddb1bfff2", "value": "1536:Z0lfkUBLAtJQ36bwTru4Op18gTdIDg3ahWnUripX5WzEF35mBi:qlROkguDgqhoVXV3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958894, "uuid": "da4be755-73f2-4057-a73e-53a6d98d6a6f", "value": 79256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958894, "uuid": "a3bb1afd-b6b3-4ef7-8b4d-b5b50998ae35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958894, "uuid": "27390e49-fe2e-41ed-9cde-c8f15d1d7f53", "value": "jade.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff8e246-2ce8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774951090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951090, "uuid": "a58c2f24-a24e-4c7a-b21d-da2b233c2537", "comment": "Malware payload", "value": "7a9ddef00f69477b96252ca234fcbeeb", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951090, "uuid": "c75601e1-5250-40ae-a3c5-aaf18df11d70", "comment": "Malware payload", "value": "92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951090, "uuid": "80904fc7-ff6c-4808-9e53-07f182a0af98", "comment": "Malware payload", "value": "13ab317c5dcab9af2d1bdb22118b9f09f8a4038e", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951090, "uuid": "0949fc0e-2686-4c02-85b4-69059cf9a1bd", "comment": "Malware payload", "value": "a0f958bb27cfc8894e7721312b9ae3cf685946863f42b852ae814edc9d9b7c4e0dfedb0e96cd629a4be3240aa0e5aa9a", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951090, "uuid": "d5aa3930-7194-49c8-ba4f-4b21996e3f93", "value": "T1F4E40953678F2D03C98A23F8AA7B135DE220FD119C6267EBF59190515EF53902F2EB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951090, "uuid": "867ab66d-44a4-4f77-8a3d-91ef3c4a3761", "value": "6144:xjazCtUlrLxJnzsOOAx2Y+AktJgRESAtxVZS63vYdCzsbAkuNjepym:xjazCtyJcYKgRESAT93AdUjepym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774951090, "uuid": "ee0021b9-4096-40c9-8d21-ebca94038eb5", "value": 657424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774951090, "uuid": "69e3cdf8-17da-4182-a6a7-30d40247d501", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951090, "uuid": "c83d8454-fb59-40a1-a15d-deb64b6242ab", "value": "com.apple.act.mond", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39298ff4-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958863, "uuid": "f09d8710-aa82-46f5-9b1e-56871c23db65", "comment": "Malware payload (Mirai)", "value": "9bda7bd9a7d90cb047c503fe5e9c8ea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958863, "uuid": "3230be2f-a8c9-47d4-9e82-5518e4f41dc4", "comment": "Malware payload (Mirai)", "value": "93046bc18af4e0421eda881fa291e5976a080f2bdb090add27779eda12fbfdc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958863, "uuid": "5727731b-69a7-41bd-b85b-0f08cfa3d578", "comment": "Malware payload (Mirai)", "value": "00ba0163a2dd70bde35f7d0c02a2cf938261ed15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958863, "uuid": "a24e7540-4b5f-440b-b804-98e30611cc59", "comment": "Malware payload (Mirai)", "value": "d893ac912d3dee54a3c5b8af204955371820f42d789986a216c5e1863d496f04149a01c50581fd89347829ce57778146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958863, "uuid": "44137478-e1ee-45bb-a3ee-7e047aa16637", "value": "T1AB830A95BC818A15C5D412BAF92E008E331267ECE3DFB2139D205F6477CA92B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958863, "uuid": "b655c2bc-a52e-491c-9643-55d173f1453b", "value": "1536:6on/g5FvCSgnUN/5ePCEmXMkQ0lXTw6P1Cfgwc85uv/5PfOcMI1iXTs+3GUhuD:sFaLP3KMk7ljXPc7vqcg+3GUhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958863, "uuid": "b1b8b809-be40-415f-8726-692c79eb5ce2", "value": 87968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958863, "uuid": "1a0f8fbe-f10f-41bb-a678-09e7cae0eafa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958863, "uuid": "4fc37407-7f71-43b1-b041-0259b0209e8a", "value": "jade.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0ff0e8-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774960667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960667, "uuid": "ce42c408-98ec-4f3e-a4b6-10814bd74046", "comment": "Malware payload (ACRStealer)", "value": "c7dd3f7ce0d5e1a7b7b5a52693754acd", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960667, "uuid": "8323a1d4-e7b2-4d1c-bdb0-e24e975b6514", "comment": "Malware payload (ACRStealer)", "value": "93dfded0692b2bd345ebf6c869bf7261c563b5b3950141ff9c4e190011ff39d6", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960667, "uuid": "b1a40bc1-a773-487b-85cc-61f0a3db7ddf", "comment": "Malware payload (ACRStealer)", "value": "06e43f6a6a70566491305a986296a6631bca5611", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960667, "uuid": "c2c23787-26ec-4a41-b9ad-2cbc497ba993", "comment": "Malware payload (ACRStealer)", "value": "3fbd68f59ae6ab937dec608f2accee1f301841b53674da2dc8914da2b826899e7fa08debad5aed2bf235c6437068656f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960667, "uuid": "5058e64f-c407-466e-89a2-7d1d1f5137c1", "value": "T136173308A5A3C9E82D509E37C861DE49EF9D5C20D5C6894AA13CF5E72F307CA9EC4DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960667, "uuid": "dce55a2a-d68b-4415-8a98-fdc056cbae3f", "value": "393216:OqjTQroB7jvXNGpOpUQShH8P8gK9H0zuVzRr0GkqPJ1MGVqFH:OqYUB7T9GphQSh80gKeyjomMHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960667, "uuid": "acc5806e-5bf9-4880-acfb-2a951061e6dc", "value": 18627271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960667, "uuid": "318ee3d2-3814-4817-8155-f078ec9a94a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960667, "uuid": "a3333633-e017-4f60-a9d7-26ea9239c9b6", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbad014-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774989283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989283, "uuid": "bac12b3d-60ac-462b-bb80-06a8454964cd", "comment": "Malware payload (Mirai)", "value": "5caf1949d48db6c45c3e5857ef6396cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989283, "uuid": "ab38dda7-3703-41d1-8297-432bb4526c5b", "comment": "Malware payload (Mirai)", "value": "94603f5b09656b6c6793416828e9cc7d18f35b449bfc2a250f198e2b26796c81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989283, "uuid": "b08ac4a8-cb61-4454-9299-284c07058612", "comment": "Malware payload (Mirai)", "value": "153f11c1b9fc8f5898f812a2a9480dfb5add993b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989283, "uuid": "f8b83b0c-894a-47fd-9422-8378e228b6a1", "comment": "Malware payload (Mirai)", "value": "8c7d245a7409f4aff20ed593e68dc32f75f723857cf2b3329da0cfbda1234138b311f0a2f5239b82f207da5868a5da3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989283, "uuid": "c0df4ab1-e42a-43e8-a394-f272f7761bec", "value": "T183138CB7C449ADD4C14947B4AA208E3823A3F50083671FFA5E8685A99007EFCF21D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989283, "uuid": "983b6235-5d04-42ae-9547-48b06ca2e557", "value": "768:RYXNhfPu+8r2ePDoLbxOME0ClBsoXYkrxCCo:RYXNh++EoLbxPE0MokrxCCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989283, "uuid": "125c8251-b195-4164-9c75-ca01178619e7", "value": 42676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989283, "uuid": "cc92a151-c029-4325-8773-50a766024ed9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989283, "uuid": "58805278-607f-4e84-b774-afa117965903", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dba6cc5-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959381, "uuid": "decbe1ab-47c4-484c-84fe-9043d2b588bb", "comment": "Malware payload (Mirai)", "value": "1476e7aaa652d4eca8185f20a86bab01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959381, "uuid": "1deb7185-5fb4-4317-8181-00d6694e250a", "comment": "Malware payload (Mirai)", "value": "96aab64881eb23c35d327524b7713f1ef70fd9f36732ccee56c699a7f15fbd1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959381, "uuid": "fe4752e5-6a0a-4478-82a2-86ed086c12de", "comment": "Malware payload (Mirai)", "value": "0dee8f4a9a5ff441a5976b5744b22757728f0f64", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959381, "uuid": "33ac5d76-e275-4cf7-b982-96204c91df0e", "comment": "Malware payload (Mirai)", "value": "5fdb385ffaf731863949199fa67138824e6a6906ff78f3c7fbb4b69a8b6ff66996d10db7ec47b413b53d632fc628601a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959381, "uuid": "c7ee46ea-2160-4e6e-af1f-bb4cc0fc2ac6", "value": "T1F383E942BD429F13C1C221F6FBAF059837266B79D6EB3242D931BF9023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959381, "uuid": "3015cdd3-9e11-4b99-b96f-07ed96829db3", "value": "1536:/KDLhQ3BlLywjmConIxqPONH62KBJw3m12PKPrzetGgcImGj0AnSbfuba:/KDqXjmConIxq2F62K5UPQrzeiASiba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959381, "uuid": "ec848393-44c8-4837-9649-1ab85de03a73", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959381, "uuid": "ae3d0758-a7e4-41ab-9777-2f3e3d57f4db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959381, "uuid": "33c3a4e3-6d6b-4a5b-bcbf-dc0eafc469d7", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97e65b1-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959186, "uuid": "70fc5b53-8250-4536-b445-9622244fa9c9", "comment": "Malware payload (Mirai)", "value": "9128c97d3d14cc6c843d544e66bd62c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959186, "uuid": "c22078e5-7348-4a77-8c6b-b9757bf0bf59", "comment": "Malware payload (Mirai)", "value": "9779011a3f6b3fd45fc0fac60aad08cf3db37689ac3a5595c4d2a725b8d99e53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959186, "uuid": "d64d8a07-c701-4797-85ef-9568f10ca7a8", "comment": "Malware payload (Mirai)", "value": "e671d096961a3d1e0e37899a339a2b206db73965", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959186, "uuid": "038630e1-b133-4146-9d67-b395d3b08324", "comment": "Malware payload (Mirai)", "value": "1dcaabfb0bd38b540b4d76ea748c124c0faec7c56118d4b164007ae013784054d5f776ece73b930fe96ba527e82c68a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959186, "uuid": "618977dc-c86e-4582-9133-5bfbf7598b63", "value": "T14CB2D0B01603DCB4DA2F6836ECF2524A3BB3B6F9E6E173924C12D564A8C950529F4B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959186, "uuid": "2d62cbc4-bd5a-4d3c-bec6-cba2a67477bc", "value": "384:+YvkQe8o/4AYoU1BHZufxTJqaSuvzLXK7Du8sTD2Lf3P/+NGhymdGUop5hV:jS/t/q5OTguvK7XsT4/+NGs3UozD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959186, "uuid": "2e955bf8-5cb0-4297-ad95-8aa744a9e843", "value": 25708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959186, "uuid": "cef6529f-0b8d-4518-97c6-93855960be47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959186, "uuid": "cf9ab64e-49fb-4280-ab6c-adbbb71ca624", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44681dea-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928817, "uuid": "498fcbec-6049-414a-9659-07786eb73fe0", "comment": "Malware payload (Mirai)", "value": "2d23339ed09251a71fe59308573c4243", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928817, "uuid": "0e47bc31-5790-4c9e-8ee7-8754b5b6c467", "comment": "Malware payload (Mirai)", "value": "9910c74e00625f80c7e55f2a46850b5fcd418495e1ff32642c0add7c3707630b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928817, "uuid": "ed2e80bf-6d3d-4a69-a46c-5e98887e94a0", "comment": "Malware payload (Mirai)", "value": "c51628769b90688fa706e17037740250cbd3d3e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928817, "uuid": "f16ed859-698b-41df-b0a1-bccbcc15b060", "comment": "Malware payload (Mirai)", "value": "886ac5151a76f9e43eb48779d613d640b9ada6a13ae7bf2dd656cd1fb898e7fdeee1facc7bee8f365fad7a14012a0d04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928817, "uuid": "e8c94cf4-e462-47ce-b861-ad3f37a7f1c4", "value": "T1E8342A05E9504F67C6C32BBBF79E429D3B325B2497DB3301A9196EB02F8678D1E39211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928817, "uuid": "770eb4c4-1399-4aef-b91e-528fa52abcd5", "value": "6144:E/MRyMfD4MEo4aKclGyiwf+4Jy/gZ3/j20vGysGc:E/yD4MEN+7f+4Jy/gF/j20vGysGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928817, "uuid": "37e424de-4201-49f1-803d-2a4e1fc5d083", "value": 230486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928817, "uuid": "745ccf5d-5eb6-4c3c-8327-fc3aaf8fc378", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928817, "uuid": "c1f5ade2-bd21-4117-b8fa-8748baa9133d", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ad2787-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774960809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960809, "uuid": "2c46e03e-cd11-4937-abcc-a34864cc0216", "comment": "Malware payload", "value": "1d46fc9ad7990547fed0c8b2b2139d71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960809, "uuid": "696533a1-0b06-4cea-bbab-ec0f27dcd802", "comment": "Malware payload", "value": "9912ea00544a4b1bef8b02a36749d696c95316183b0bf36fbabf793f46c16bd9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960809, "uuid": "cf3fe93a-6e6a-4739-847a-7c8a27d57ad2", "comment": "Malware payload", "value": "596ec55bf98e81e6d5d2a10594a684bdbf577b23", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960809, "uuid": "21712b8f-b660-45fa-8c6f-f1ca8cb6b8cb", "comment": "Malware payload", "value": "526134a230d1c58a0e455b3139fd9366f1d109294d9ddf3512c383dcb95b65c12aff58b13f5da5b20ea6c79c21661e60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960809, "uuid": "99023e01-cd29-433a-9634-94b1c829c812", "value": "T183745A03A3FA510CF1F34F486A7A54614A7BBE6A1D39C02D11A9185E1AF3A14DCB67F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960809, "uuid": "541b9803-c996-48b4-92f2-d7bb2238d040", "value": "6144:B36mjqBna/mHkfQ0dikce5oRj0Cxvl9BSpxPRUWYSfvLqyeGPXbbBUV6hc1i+KcP:F6mjUna/mEQ055oGCxtGXPaWY+LxeIXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960809, "uuid": "21385ca7-997b-4cfe-aa36-935818ec87b9", "value": 368810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960809, "uuid": "52f3c0a6-358f-4935-93f4-63110a0a20e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960809, "uuid": "03053083-5c60-4a2a-ac79-41d85b6384ba", "value": "Statement of account2025.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0159c715-2cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1774935577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935577, "uuid": "32a54ee5-2d01-46d3-804b-a57e88c7dea8", "comment": "Malware payload (SnappyClient)", "value": "ba8b389cf372a06188ab92ac1a0c9f6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935577, "uuid": "fcc2c383-b85b-4092-992b-f645dbea5bb0", "comment": "Malware payload (SnappyClient)", "value": "9980462da93da1eac2f57119df0e7b94bc0552179c2353748886ba43dc37467d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935577, "uuid": "9d5c6bfa-8b47-4646-a9e7-80a3d989708f", "comment": "Malware payload (SnappyClient)", "value": "dd836e0ca047ed22f04f483791cf6bac0da8cd27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935577, "uuid": "e3513806-3b46-4a22-adbd-0a012851565c", "comment": "Malware payload (SnappyClient)", "value": "315d7908fc05277590697514ea4c51d42b2201f842ca2705bb661f2a58447110a42ad41f581afd2b846645e90e69d7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935577, "uuid": "03f8999c-2c22-482a-831e-fe0af8b8468d", "value": "T18956F12391285E3FDBB94AB2FA2E7576A814B8043CE424CB5F9CDDF0A9F8601D735506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935577, "uuid": "3223646e-8d42-4057-8b19-a5cffc3656f1", "value": "71713e2f4d9b6d74d9b62ced96db4532", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935577, "uuid": "c455cb46-a928-4de6-beea-a2ecc7f22049", "value": "98304:fkzmxVBvu5w2mPXCGpoBt5RUvQvizpRBgXkemtd9mhygSCB8mI:80Bvui2rGpa5Ruq0/j4ySB8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774935577, "uuid": "836f1801-f613-44db-be36-7acae710154b", "value": 6131712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774935577, "uuid": "9ce10a1d-2fbb-4bd1-b3fa-ebf391a02ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935577, "uuid": "87eb0c2b-73e1-4516-a2cb-e4eb54fa44e3", "value": "ba8b389cf372a06188ab92ac1a0c9f6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fb8ec9-2ccd-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774939740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939740, "uuid": "dc00ae57-2600-440a-ac0c-9a0c1ab71d2b", "comment": "Malware payload (PhantomStealer)", "value": "67fc8ad42d5a539471a6070dda1e4828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939740, "uuid": "357548bc-701a-4ad4-95ed-0cc1d4e24537", "comment": "Malware payload (PhantomStealer)", "value": "99c04e506e0bfa4ca0bbd3aa52020a7274c036769e95fa34573eb24e88530313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939740, "uuid": "3a04e02a-afda-4ffc-bf6c-9e518b7b3073", "comment": "Malware payload (PhantomStealer)", "value": "bceeab3e2a5a89f7f1b7bf9770c5f528e855acf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939740, "uuid": "e0b5cfbb-c656-4028-bbe0-95d598d5f3e5", "comment": "Malware payload (PhantomStealer)", "value": "fc246a2e19f2ef09922992227450674ab1346c7866f5956ec3b3bacc6142495b9f112e05702fd5f0df2ba274f3dc3321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939740, "uuid": "084a7478-94be-40ba-a159-3936e4e9388a", "value": "T17BB2953DC6E5ACC0C7AF12F074AFBBC502AAE717BD2B4B6CB4C814461E60654AB74748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939740, "uuid": "08bd5ed6-1f4a-4aaa-86e4-5bb3e38482dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939740, "uuid": "5b0b052a-ec28-4cb3-b700-ba2e142153c9", "value": "384:vz57Ngy0RmSJ4b1Pk5YS0CKmos0VzN7GOqHymZh7/ac5UqoQE4vaG5LCMThNH4qt:vz57Ngy0RbKbF7S0U/0VBDUH+qoYv4sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774939740, "uuid": "767afc61-7c1c-47a9-8124-50b89f21d187", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774939740, "uuid": "bcf40d08-1518-4441-a249-222221cf04d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939740, "uuid": "cdbedf61-2265-4c24-b6c5-538cc5b9c866", "value": "Fiyat Teklifi Talebi Rfq083891_Tekstil Madencilik Ticaret ve Sanayi Anonim \u015eirketi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5894f1-2d29-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979349, "uuid": "bce0729c-4fc9-4a5f-9acc-3bae3c9bb85d", "comment": "Malware payload", "value": "ee76aee884e7df12d86919e177862850", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979349, "uuid": "5ea436c1-3893-44ff-92cb-b29c3d28f1c7", "comment": "Malware payload", "value": "9a034b10d244f41a515a0e1a0ed2f734c3e614118c3a0f1934b87da95f809817", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979349, "uuid": "339b496c-2837-4267-9c3b-0cad64b79874", "comment": "Malware payload", "value": "8043fe1b8ed86157a5a958417b66a50ece22024a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979349, "uuid": "10716f69-0aa3-4d99-b2fe-c40075e361d8", "comment": "Malware payload", "value": "79ad0e542468c1c74d78f5257438951f9498d538cb65e504e034cd0499d61ac9ef7d9142f064a3598d9225202b2092ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979349, "uuid": "e1c042df-3c65-4a38-ab19-c939422debd4", "value": "T16112C484E689E053621575F35A360015F81F8AD3F2CC45D0D76A7CB6BE1E312B259FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979349, "uuid": "f4a0ec64-0a24-4bca-9b69-e322fdb60ff6", "value": "192:LM9QWY64BJ9cWtR3uTPb+LxLXJ95jEfaIVZp0jWdKNXyakJXsc0fB/9MeBdWZn:LM9QWYPBJ9cWtR3uTbaxL59FEfaIVYji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979349, "uuid": "07079f5f-ce6a-4380-a4e3-7c983c54548f", "value": 9514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979349, "uuid": "807ff8fb-c4b1-486f-af53-8071f2252a46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979349, "uuid": "52aa57ef-5076-46ce-9b7a-41c8c7e6cf78", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63e41f3-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959959, "uuid": "5bf4a103-fffb-43b3-836e-bd79259e3326", "comment": "Malware payload (Mirai)", "value": "4d5393c8e1280ab8be8b6485d5dcf9d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959959, "uuid": "b856d64d-85f8-4f38-87db-15206356b5fa", "comment": "Malware payload (Mirai)", "value": "9a87bda0158d30cc154993838919e12234f50abe3433955d79063b9be5a730b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959959, "uuid": "9294ed03-a898-45bb-9590-54afb83acc55", "comment": "Malware payload (Mirai)", "value": "b8a6c96a8bc4e5a20af1d5e859b6073f8ea71476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959959, "uuid": "5d187da0-cb45-4cc8-bf01-27debde4c15f", "comment": "Malware payload (Mirai)", "value": "36ade96a36d6acd9af749aad4fadc06c86a596bc781e9b4760d062d3e019bbc80dd33b5fa53573646dc74c9cfda3abbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959959, "uuid": "324d0551-3bc9-4e61-8f2d-0ad40629c576", "value": "T1E693FA59BB210FF7EC9BCC3745E92B01288C655A22E96B36B970C418B54B34F2AD3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959959, "uuid": "97ed668e-255d-4df9-a843-e68bf26465e2", "value": "1536:wYF1biR97vp0PIINJDCGFlKjxH/MUZP4uzt6:wYF1biR9zpjINm/MUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959959, "uuid": "00284249-da94-4a16-a3f6-116c03d18842", "value": 88852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959959, "uuid": "600e79b5-7fe5-459b-86c0-1a2dd0f211c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959959, "uuid": "f52f40a9-2d98-4efd-97e5-1e53ccc49503", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a980676e-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979668, "uuid": "cf200e8e-f956-4834-97fd-6762319241f4", "comment": "Malware payload", "value": "6e29be23608814b597e2de66d8d4d2ee", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979668, "uuid": "7b864965-10dd-4ebf-ae15-8501b90f7bd7", "comment": "Malware payload", "value": "9b410fadb743ad73ed70646b10c4c95e6882f96621e8b55345955fd3f4051f7f", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979668, "uuid": "d847dd9d-6430-49f6-abcf-df8c1d4253d7", "comment": "Malware payload", "value": "30d6f899ebfc0f26697932a5a2d3b1d80bdeddef", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979668, "uuid": "11eab76f-e6b6-4387-98c1-a3fdced3310b", "comment": "Malware payload", "value": "e745d8059129a60648f44a0cd6693c7da8c5c6c15d4f89e9a5b81f13774f3db473d34962adcd1a7eee2cf657da984108", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979668, "uuid": "8923bf7e-9ced-498e-9e67-5650a96b15db", "value": "T12635FEDE6C94E72DC64BEB03CFB2AC7AC2218805700B67966764FDA17318F70E4B6546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979668, "uuid": "ce11d26e-448a-43e8-8cd6-2ed2737f33ad", "value": "768:tgPIZzwoY0GS9Qb8of7OdwYZWid6wIPezLuEdA3cgXy6C6dd8VP08QqSlbxAwmh9:tnZzwoY0P6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979668, "uuid": "0b0fe478-a0a5-448e-96e4-56ee04760a22", "value": 1079668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979668, "uuid": "5a82927e-dfc4-4099-acd0-651695ad9770", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979668, "uuid": "a6ec7112-d2d9-476c-8d42-c9015071febc", "value": "1SMAR30_Asssssssssssssssssssss-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbfab79-2d26-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774977740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977740, "uuid": "1e3b37cf-f9ae-4dee-8c62-d86e4b4fdd77", "comment": "Malware payload (Formbook)", "value": "2cf1da1184ca1593cf48f2f8f64d8df2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977740, "uuid": "0178687f-651b-4038-96b3-72ae32c75720", "comment": "Malware payload (Formbook)", "value": "9d34ab59070b5c6465dd79ecc955fdd07e49da020eb1bc0fe099661017a4f035", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977740, "uuid": "c71add28-619f-40b0-b425-569293bc0e9c", "comment": "Malware payload (Formbook)", "value": "13de663f8f1ed4598678232a990d861cdfd82039", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977740, "uuid": "77790e2b-14d5-44a5-a540-9d9216277c3e", "comment": "Malware payload (Formbook)", "value": "06ce17ed91c57de8d198a4dccbe2cfb06b3e695bab29744ddf39018225ab79e0ee8c2923e0e082537d4d38c8d6788f4b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977740, "uuid": "e12db3d3-54b2-4450-8158-a10add31cc57", "value": "T1E6A5021149C42FF9CFAC571C50FE1A1EA3F04B8B9416798AEB33BE47AFA79045207199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977740, "uuid": "7b7f7543-c625-4826-964d-2af4cded6bf8", "value": "24576:4RHNcIO05s66ezJhBK1c/MxF/r+A/chpscRbaHj2y+UuFb7NHtOiA133/eMNx8+9:gNXO+RNK1c0jHlauHjmHtXLu0kwrK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774977740, "uuid": "14d75932-80ab-43f6-808b-e3cced7c1f3d", "value": 2097865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774977740, "uuid": "ffc3b04b-ad9c-42a2-be21-3ecb790d1b70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977740, "uuid": "9cca2587-ad7c-479c-8aa9-4a8d881690bd", "value": "Invoice BE082.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ed5dc6-2ca2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774921223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774921223, "uuid": "69485f6f-8008-48c4-8c6e-9aa9330ae734", "comment": "Malware payload (Mirai)", "value": "85604c0d89ff7696a4e6d11ad2cad99b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774921223, "uuid": "db0a1291-cbe2-4f80-8131-f9bbb782e399", "comment": "Malware payload (Mirai)", "value": "9fb82cabe4aa41f42f90e4a96a8c18f5f4a7ca964591298d37ea1e55cfb9b497", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774921223, "uuid": "1bfa23f6-584b-485d-8cb8-f8ac86c07882", "comment": "Malware payload (Mirai)", "value": "c2de978649135bbb1835cf78ef0df0f9f139d039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774921223, "uuid": "232782e4-acab-4978-9425-b5f20da00112", "comment": "Malware payload (Mirai)", "value": "9db5c2a80cbeeb755b3194aa33bb12c3528a44a986f32eea5960f718cbbd354729e42cf0a62223281c6d485c04d9c856", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774921223, "uuid": "9d91179f-69a0-4f36-a82d-8d5305dcbe59", "value": "T130363B02AF449EF7C8EBCD315E3DC38304ADAC97658C6666797CCA5C3A6650A1EC34D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774921223, "uuid": "294ab9f5-dbff-45fa-a70b-1fba7beedb67", "value": "98304:q/H0qQQIwbaH2iNYyE5RLYqXI7ZbuqklQrR8unET8mX6EonH:qvCMqNc0Z2QrRZRQ6Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774921223, "uuid": "b5f0fec5-3cca-4191-af95-8f1d7adbe407", "value": 5340792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774921223, "uuid": "ec8f24f7-a992-4bff-b755-0f411c908981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774921223, "uuid": "cd320c4d-cd74-42a4-8a76-ea490a1e8d63", "value": "wlan.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160cc821-2d12-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1774969112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969112, "uuid": "0104b2e5-97d8-4c5d-a18b-471e8f02b66c", "comment": "Malware payload (Arsink)", "value": "eb45982ceb6563e0992485207384fd23", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969112, "uuid": "4692ec5b-9631-47ec-aef2-284d5aefd35f", "comment": "Malware payload (Arsink)", "value": "9fb8a940492ee6095a24b4a34ecfa252a515fb681f16636a8f00b1e0e7d47fe2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969112, "uuid": "7f6ff5b7-a112-41cd-860d-cc980f709f4b", "comment": "Malware payload (Arsink)", "value": "c311870acb833ff8efb15feaff4ed0f506daacc1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969112, "uuid": "ebd4beb2-25f4-4fa2-9e03-d3c1fe082b65", "comment": "Malware payload (Arsink)", "value": "bf542411b093ec8903841eace619a8af30d385e0d1703d6d39b6cde60534b74a4b7134c026e6f51c3a489967562d884c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969112, "uuid": "ebbe2cb3-b9c8-40c6-b879-117507fd8869", "value": "T1CEF423A3DE488885F11DAE30B14BDE36D6689E9178C493C29C0337D287B7B546F46AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969112, "uuid": "9c6b7d52-5d54-4f78-ae03-974e21be09d5", "value": "12288:rP+G/4WwQMdT2kz+yqVUD7Wmt5TUfL6AWfe1K5HlN2uHRW8vl1a5k/xFWbI:rPv4rl+Jc19UfLWR5HlICs2rb/xFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774969112, "uuid": "22ba1da7-aa2b-473a-82e0-2df95d7a0e57", "value": 780761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774969112, "uuid": "4da36139-c8b1-4c44-b081-21ef1c60d1a8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969112, "uuid": "f1018cd5-97ea-4065-b7c6-2a7c2610bd0a", "value": "gen_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ca1033-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979661, "uuid": "8cdc5f92-65c7-4d0d-9b44-a87b02df1817", "comment": "Malware payload", "value": "d328d1463688d130aac31ae7bc3d49a8", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979661, "uuid": "8afb22b1-be5d-48fe-af32-b7b91fa9e819", "comment": "Malware payload", "value": "a03194700cdc2f128438eb81775174df2d7f634a796f8b89ee95bbc327835c1d", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979661, "uuid": "3b71573b-22d8-41e7-a610-969f43bfd869", "comment": "Malware payload", "value": "e2af99d12030b64d4d6a2bec0d2a6f80a7759750", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979661, "uuid": "230810d7-a38e-4576-9f89-6f8d5bbc81cc", "comment": "Malware payload", "value": "24755dd82056d14ed0424b18da63e9eb0750c2f159acc8ccfea01b2af38b992f0254ff8ed2fd0e3afdb4807a6a32eac1", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979661, "uuid": "8e749b49-cf90-4c87-ae4c-e6cdc1b65c7c", "value": "T13486A97590F53509DBE17CA2C56CE6E270ABD7892B4309EBD2C9DAF4C05413AA3217CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979661, "uuid": "77b50b2e-36f3-4200-883d-056b06d95a02", "value": "192:2oUA5BBoOsjZIZ1dhLfh5bGRnWRpan9+Qa88SdjbLsDu3jGsBGeeCK+X3puSO1oP:xpzBlZ1/fhVGRnOpQ/b8S9b4M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979661, "uuid": "b7c84946-37d1-442b-a083-416fdff9fcdd", "value": 7867706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979661, "uuid": "c8953006-7936-44c5-83d4-eca9bc8dca6d", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979661, "uuid": "bfbfe92e-9879-46ed-89bc-71012dbe6bed", "value": "2LazMAR30_hvvvvvvvvvvvvvvvv.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a7d625-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959280, "uuid": "ff162f1e-fc19-46c9-9a3b-3bc9c3e0be79", "comment": "Malware payload (Mirai)", "value": "ab99282be4d7cabfbbdc36b9627fb296", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959280, "uuid": "474b9eea-9af1-4725-8a14-26a6f8ee6593", "comment": "Malware payload (Mirai)", "value": "a0b0c97c71d0bc2993c79e27cd492fa677a2f345d8d16e9911b22b7472aca20f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959280, "uuid": "8c39b63a-e70f-4bc8-bfb8-794aa265052e", "comment": "Malware payload (Mirai)", "value": "8fb8c223a7a2520ee86cf5c7b13c89f7906e8f6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959280, "uuid": "303d13c8-80a4-42e3-b8df-6556b2468237", "comment": "Malware payload (Mirai)", "value": "9549c22642a796ad5ed228a0f946f5785ed08ac6791f5b92fe638de9664869147bcd05b6c2e68d3877277b2d298afec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959280, "uuid": "d7abea9a-b387-4443-b639-bb595a2f819c", "value": "T17F633B02312C0F17C9A356742D2E4BE087FEEAD125E4F689565F87668A34E7B1085FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959280, "uuid": "809bb961-88d0-4cb2-911e-f8702e058a2b", "value": "1536:iU9Y2OpoYOK1cqxADwJcdYbDwray4ngIFYC:eeT1dYbUaZgIuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959280, "uuid": "f3c8785b-ca57-46d1-8855-d5104d7b40cd", "value": 72596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959280, "uuid": "194f9130-a56e-4d67-925b-6a3de7ecf7ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959280, "uuid": "f28b4372-6a59-4fcb-9705-9ee853c492bb", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b837aa26-2cff-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774961224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961224, "uuid": "4fee9c23-0410-40bc-8e44-d9f5046f25f7", "comment": "Malware payload (QuasarRAT)", "value": "bb9622608fd681fe6f0fc48d25dc52e6", "object_relation": "md5", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961224, "uuid": "90f5fa2a-0fd3-4840-94c2-32eff9e5c148", "comment": "Malware payload (QuasarRAT)", "value": "a0dfd88d6209e14c971713ccee2c6b4dd1dfd5eae40fd894e43917c41f456103", "object_relation": "sha256", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961224, "uuid": "d0d0c632-ac0d-4cf2-9957-6bcf859579b3", "comment": "Malware payload (QuasarRAT)", "value": "4d8a9603838ab327e269a61ae6abd51b881bc76b", "object_relation": "sha1", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961224, "uuid": "e8acc937-e4c1-4e89-baaf-aa69d7802f31", "comment": "Malware payload (QuasarRAT)", "value": "55988e1aad7edfecb8f18f4bdea66111f7f9a340e8402a0db718202a3bbd2c43c33d9ac460ab3d9e08affb1db2ebb72a", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961224, "uuid": "8f40b044-56b6-4ea8-8f74-2083024dfa2c", "value": "T106528A2C19BDFA5993D9E213EA99F7236D461CAFD1B876172AF38C6CA0024C045DB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961224, "uuid": "0ecde878-2c88-41a0-a52a-09cf5c104fc0", "value": "384:+vcnjKfi7tdbJGFkzW3/Dy59AzZnX0BP+8MJcfmy1knN3r0arkjiIF58U1N/eyY2:wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774961224, "uuid": "935402e3-55d2-4c2f-9867-7f6771d64ba6", "value": 13416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774961224, "uuid": "b475c5d8-3872-4c2a-a861-2d85d4426d91", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961224, "uuid": "af0c5b25-9ae6-4a72-be59-ccd64411dd4b", "value": "aisurubotnetsucksfr.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c10582f-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959217, "uuid": "7ce8bb14-1759-47ab-a29d-ae156e3ef66c", "comment": "Malware payload (Mirai)", "value": "600a0d9bb8a00e3b5a26e67c11c27cc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959217, "uuid": "7d1338c6-382e-4dcc-8845-7dc970eea0c5", "comment": "Malware payload (Mirai)", "value": "a344fc502150a475e96a4d10bcfdc60664565803f89805a12c3d27918d9ba968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959217, "uuid": "ab36ef8e-f4a2-4bcf-a289-cb41ceb4985a", "comment": "Malware payload (Mirai)", "value": "c32363f827d0eb360eae3f3c129017386804b651", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959217, "uuid": "8ca90f90-1f6d-4a7d-a41b-fba2eddcd565", "comment": "Malware payload (Mirai)", "value": "374c7f83e1a074ca9c283f3c9e9864b69d929abe64e4a7675ac2502c9624bf008c55af483b2d857f88771d16cfae6809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959217, "uuid": "754fd4d5-6165-4644-9993-a9ccaac56172", "value": "T129730781B8819A22C5E4137EF6AE408D372567E8D2CF722BCD225F1137C991F0C6BB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959217, "uuid": "deffd848-32f5-4868-94d8-0f9a180cc13f", "value": "1536:I8JxivDDrFBrzzfmY9lRZEBJe5kBLEwcAU0pQHb+ykC:I8bivDDPR8/wrkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959217, "uuid": "40dea43a-7ab4-40d0-9d86-e5f72c81a786", "value": 79172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959217, "uuid": "b73f68e0-2c39-4695-b144-e073d8633b06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959217, "uuid": "86f937b8-914f-4520-8581-98a9c33ec706", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ba72e5-2cd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774943590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943590, "uuid": "1c64ad8d-72a4-4940-b64c-8be7c5c378fa", "comment": "Malware payload (Formbook)", "value": "0db39a295a63ccf9c079a690b8d0bbfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943590, "uuid": "95f9bbf6-194a-4ac1-8bb8-2f24bb687493", "comment": "Malware payload (Formbook)", "value": "a3b7863069e3b8a76d536fbb45cc7f11f4bff56dda07f8ceb8f82aafae72e1f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943590, "uuid": "edc10db3-33f4-468d-8d15-b8ff96b0cf82", "comment": "Malware payload (Formbook)", "value": "e778b26ee220461738075f38f04bd095e402aadb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943590, "uuid": "b8495836-36f4-4442-a3b9-a52c56fdaa6f", "comment": "Malware payload (Formbook)", "value": "227497fd5f2fdf58f5115b228a8e9ad8e607497f39e672e2abdf477b890d9ba9bc78aa2e0895fa3e48a72477ec9d019d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943590, "uuid": "1cf85d96-58f1-47a6-bfe3-50f27d6f9ca1", "value": "T1E75423A6185767BCC00A113C0F8FDA660D0070D7A876EFAAB69C05B36D27EFC65453B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943590, "uuid": "25bcd69c-ed99-4e49-8e23-2241d28d56e0", "value": "6144:pSQx6AVj4vVNN58pk3EWlpFDtdmPMnQRuNvE/X0mhZ0bmf9:pXx6E+VNspC3X7yuFYXZ5f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774943590, "uuid": "844f9289-6894-4d9b-9c26-722f1de3d69c", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774943590, "uuid": "82aada24-ad85-434d-82b3-0b62fda57b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943590, "uuid": "614f4517-0e93-4012-a9cd-b3f11fb69f6c", "value": "a3b7863069e3b8a76d536fbb45cc7f11f4bff56dda07f8ceb8f82aafae72e1f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c58809a-2d10-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1774968398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968398, "uuid": "5711cdca-bd04-4e53-87f6-9a381bd23006", "comment": "Malware payload (Amadey)", "value": "07efd816a182a5f8e3533b5479126b67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968398, "uuid": "41bb8644-7062-41e9-9c7a-6a7d8b958093", "comment": "Malware payload (Amadey)", "value": "a410c89db9140ed9dff55bff00b0338fbdffcc709490782c7b28e8a10c11eb3b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968398, "uuid": "e5f9463c-ceb9-4745-b206-311b215572e6", "comment": "Malware payload (Amadey)", "value": "0aca41982db2140f9b4bf8a6fcfe3949856642fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968398, "uuid": "bf374d9a-d730-4265-a257-d59a9d767817", "comment": "Malware payload (Amadey)", "value": "043173a231fcebd3e56f459ca54f8078240ab9841a35bbcc8aa31045b0568792cd71a4825f3469b9b4d4efe636b7ad4c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968398, "uuid": "7be01114-5842-4eef-9a54-9ce9312770c6", "value": "T199557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968398, "uuid": "9f256c62-c44d-4195-94ef-4cb44d66e346", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968398, "uuid": "f7c90e4a-98d5-4dbc-b4be-fe4dfb09bb2a", "value": "24576:DrR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRVhOnW:DkHmiyCkhh2Bamituw+U7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774968398, "uuid": "e49068a0-ba8c-4abc-a739-abb90edab38c", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774968398, "uuid": "d604c9d5-5f23-4eff-ac2f-6b12df1d264a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968398, "uuid": "9a220073-f829-4614-9b84-61a6318226b7", "value": "cred64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea1def9-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959221, "uuid": "7d648015-ab67-44d9-a605-258106d52e72", "comment": "Malware payload (Mirai)", "value": "556e453a00ad2dc741c90af763e25098", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959221, "uuid": "44548e28-70fb-4801-8cb9-6b57fe047cbd", "comment": "Malware payload (Mirai)", "value": "a55f39dc610ec4dd3918dbba2997644d710ae61c2c5bc1e987b5e64a6db82baa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959221, "uuid": "1ca959c6-14ff-422f-a634-57ddc8715ee8", "comment": "Malware payload (Mirai)", "value": "e56331dabffbe71fff5d67a8147a6d0097cf8f26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959221, "uuid": "c9987f6b-6a32-491f-84dd-67bbbdcb8fa6", "comment": "Malware payload (Mirai)", "value": "84a96a456a965978c3adb50a04799e0ea5d4dff4947a03c097129658ebbede003b24a11513b67961353e68c374d66bf7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959221, "uuid": "faca25f6-3913-47bc-b85a-f2a13f9181bb", "value": "T134C2D0B791B7FBBAE8B2F1BA6A6D3194BC6534131459072F46B8A1EF0C72E4C0D13560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959221, "uuid": "65c7abb9-ab6d-45a0-862f-5d7a6dcb1b45", "value": "768:8Dkm0M2dvdG8f18JkYw2vTtzCzSPdFvWIVx0vT:wkG2dFHukYw+TWSPdF5ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959221, "uuid": "0d15d3b9-0288-435f-a69e-3fa29d1fee26", "value": 27780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959221, "uuid": "6c65bc96-141e-4b43-813d-9a07eb03c6fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959221, "uuid": "db54fb2f-85bb-4767-94e8-d8cd9640dd91", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289bb9de-2cf6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774957118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957118, "uuid": "9dca8e19-a00f-49af-8aa5-79ba1a8d79d7", "comment": "Malware payload (Gafgyt)", "value": "f127b13f148bf7dc2888162c6ce6ec1c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957118, "uuid": "f3149452-bb5a-482c-84de-f7c166950500", "comment": "Malware payload (Gafgyt)", "value": "a573140330ce756b9fa400cc883463ed3433dba8195909d38bbac719e763ecbd", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957118, "uuid": "1d139cd7-5721-4b92-9543-b0689863a356", "comment": "Malware payload (Gafgyt)", "value": "e3872e9373cd0cbb78846741990c756cab6c486c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774957118, "uuid": "bbe77470-4d4d-4c02-ae80-ae2602c9dcb3", "comment": "Malware payload (Gafgyt)", "value": "e2b2ff02635d897f350549aad32d6b331866c8a418af0f5fb947c3cea5d70699f9df90b7c30ae6989ced8e48439af62b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957118, "uuid": "61165520-fbcc-4db3-b947-68d548c78ebd", "value": "T12B44180A7F541DB3C42BCD3B46A61A0A30CC641762953B3B7934E624BE5BA4F59E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957118, "uuid": "f3ea5dee-4f28-4845-b676-52d79939eb35", "value": "6144:dCItyCaFG26gwKBnenxKxDSjzhKHgq5jX:xseDxfz0Aq1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774957118, "uuid": "a959da0f-60cd-4d7a-b20a-14c5eb269f8d", "value": 276216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774957118, "uuid": "5e7fe11b-4df4-4e27-b66f-1d06846a7b84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774957118, "uuid": "b61252f0-0736-42ea-a68a-aaa39ce24fd6", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3daac6ae-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958871, "uuid": "5e6b7a8c-020c-4237-83d9-55b9b66e43ee", "comment": "Malware payload (Mirai)", "value": "c1819edea3b1fe4a6443ce7cdee917b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958871, "uuid": "300568b9-0e9b-427c-ad17-ff03cc483ab5", "comment": "Malware payload (Mirai)", "value": "a6f1b2d2931f6f1ec08a553d953c87f80f1d9c99aedeef4cf8490cc10bf84d84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958871, "uuid": "db9d1ca7-1458-4287-96e5-df7d83acb29d", "comment": "Malware payload (Mirai)", "value": "cdfaf1f825f9bee95942b015b1bec61dead9fc12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958871, "uuid": "4b054cad-7dfd-4a23-ba97-47be0698aea3", "comment": "Malware payload (Mirai)", "value": "618edefe238d51198a72e2f68abb7de936f88ccb33717b47246d5717591a97e69a7b2e43deff4fab305613fa553b191d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958871, "uuid": "a81d6d89-7d4f-4baf-b8c4-0fcb3d2e494a", "value": "T1A0734B36B9792A26C0D0643E11FB4B59B2F127CE26E8C50E7D720E4EFF516506416EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958871, "uuid": "645e06bc-cb82-41e9-b3d6-4de7053df8a4", "value": "1536:wNt+9soAvAKNPZAhnSqOWD/H8pfS4SFFMprz:QYEq5DceFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958871, "uuid": "347933f1-c6fd-411a-bc00-314181ee08fd", "value": 80336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958871, "uuid": "4a53ac55-adf5-4262-81a5-eb539ff452e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958871, "uuid": "a8be9517-eca0-4e79-aecc-4de16c7f86ea", "value": "jade.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44183b0-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959956, "uuid": "20cf77e2-540f-410f-9cd5-161bf991cf4c", "comment": "Malware payload (Mirai)", "value": "7ee4fc5576f60ad8c22b5a133445f0ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959956, "uuid": "128e0ed9-3f62-405d-b020-f14695b48149", "comment": "Malware payload (Mirai)", "value": "a749426376b15f88a99e3dd7d5a73896a6c669c59576e59c5d6e9c6cf3d5640a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959956, "uuid": "5c1f6414-c02b-425b-b588-520a752c06d1", "comment": "Malware payload (Mirai)", "value": "9311999b8ae990348a43561ed427d2a7ab9db771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959956, "uuid": "ed5f1987-cdac-417a-8d51-fbbe2b58926a", "comment": "Malware payload (Mirai)", "value": "873bdf8c6e7a45c2d50b8c9d0a561ede0846291fa4017d39197b657a9bf9bf390ec87cafaba7119a6ad1aebc803490d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959956, "uuid": "13eacbc2-b077-4003-a985-2dd3213a451c", "value": "T18E630907B58281FDC14AC178266FBA3BDC2275FE0239B2A677D4FB262C46D211D1EE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959956, "uuid": "0b3bb713-8038-46c8-ad22-7a83bd856f20", "value": "1536:De74tE6dgkaTJD0xMI3Qh2XEC0vnK6aDlU:g4OogkuJxNM30/aDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959956, "uuid": "090bac62-bdb5-4a9a-bb53-abc8c2c22594", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959956, "uuid": "4a433005-cd7d-4581-9b8a-dba1137d7949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959956, "uuid": "3afc8521-26d7-4e2c-8534-ee15e9b306bd", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de826d2c-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959570, "uuid": "7dbd12a9-c5bc-46b3-85c2-ed76ef42336a", "comment": "Malware payload (Mirai)", "value": "a67aa00dd30e1bc45c5d7eab8e5f57d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959570, "uuid": "8b48c754-2562-4776-a061-ba736217f47c", "comment": "Malware payload (Mirai)", "value": "a7abb507c3fba818d313401ac9da83c6e7fc9a109f9dfc4e9c6b0d9d9703f6fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959570, "uuid": "34b3ecf1-9c3a-446f-ba33-0d8433b30a34", "comment": "Malware payload (Mirai)", "value": "94b1e7d0494105bef569b01de81e1d037e490a0b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959570, "uuid": "a98e13da-1688-451f-98e2-a07f9bab0ad1", "comment": "Malware payload (Mirai)", "value": "979eff669ad8b13fc1dceda86769288caaa3091e4fb0ababb16b122f5aa5d5f85631b5e7f946f8dfadf6424c159b4a89", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959570, "uuid": "d25c33d8-f3d1-4f7b-a280-e4b5ac5a3d8a", "value": "T1B7930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959570, "uuid": "c5e92343-027e-43ee-93a3-84036598550a", "value": "1536:wqnZK8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1YLn:C8NUv5nTacgzafVAwe4BNRIbT2gXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959570, "uuid": "a8629c22-0c12-4f25-a74f-2745834f2111", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959570, "uuid": "a90c9e2c-5171-475d-bb34-7b0379dcc310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959570, "uuid": "5c4f7061-c7fb-471a-b160-63a9f7d524fc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ac63c4-2ccf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774940627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940627, "uuid": "c09050c7-fd22-4561-a847-463bf3d64f84", "comment": "Malware payload", "value": "959aa5cad8e4bc518c07d1ab1a974821", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940627, "uuid": "eb0a75dc-176f-4e4a-828b-6db4d4e510e1", "comment": "Malware payload", "value": "a9235c0eb74a8e92e5a0150e055ee9dcdc6252a07785b6677a9ca831157833a5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940627, "uuid": "ac24632b-0f11-4721-8417-b061f8bf244b", "comment": "Malware payload", "value": "eea9f7fffb678692e6db5d5f4db9746e942cfec5", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940627, "uuid": "503198fa-04e7-4dfd-9d2a-343ebb0d6960", "comment": "Malware payload", "value": "5ec0f94b5ecdc402fe1fa23f43e02a095c36332cf8109e32f028664320db26d1c6f70978c43d48297f1466d150fb1995", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940627, "uuid": "43ba1bc9-a22a-48ef-8bbd-aba73a37d97d", "value": "T11945333AEB6FF54F5C9F84059B311270986A816B662253996F7C070337BC2B62D7872C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940627, "uuid": "8122b6fc-f016-46fa-901b-2221ddf9ba8c", "value": "24576:41VcTsoCzZd52oHSoIuTQ1fMMM77QoBXyik1VuyLdp98eOluIfE:4XWsoCzj8oPImQJMl77ztyhjdp9moT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774940627, "uuid": "b983a5ac-5aec-43d4-9531-bb1bac2b38b3", "value": 1193526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774940627, "uuid": "4ca91d4a-5e50-4a47-b1bd-145127e7fb9c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940627, "uuid": "14c56b4c-c35e-4e31-9df2-bc27feacc330", "value": "telnyx-4.87.2.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e6108a-2d1b-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1774973139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973139, "uuid": "0f35daa5-7f06-4531-b518-c6370128a6c1", "comment": "Malware payload (VIPKeylogger)", "value": "9cd431f26b71e9c98fb485bccd262372", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973139, "uuid": "1bb8780f-e0be-45bc-b942-841ea178c2a4", "comment": "Malware payload (VIPKeylogger)", "value": "a97401834fff1b8cab82e8a7dc22a83f8e16a2fbf8a6103fad1afc04abd2074a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973139, "uuid": "4fe0107b-5c4c-43e9-a427-8e046dcc61d2", "comment": "Malware payload (VIPKeylogger)", "value": "b3fc08a2b4dfff5b240c163ea210e04002f37de1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973139, "uuid": "bd0c0210-13a4-4c83-9b10-2c84c9eb2ab9", "comment": "Malware payload (VIPKeylogger)", "value": "8b12c4624bebd03a093e77302a7493c8d33eb3fba53c4c0e70c975dfc7add8ecc3ed7478a68419940a7b3b73b7d0ea6f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973139, "uuid": "aeadc1ab-97fe-485e-8225-92218d501ce2", "value": "T13BB5F92C1BA7C877E49453035C0AA2AB9D8C199FDC17B31ABEDCD5C1D810B4B65ADCB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973139, "uuid": "9cdc965c-596d-4656-a613-1b25d3420ae9", "value": "192:mgMy1jaNgbYkZYqlF7HUchEEaOeHG58bV82djbBr+L7sfqxmigbaN6FTfGFsy26R:mOjzM3zqCI3hTIR9M2hb7zFnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774973139, "uuid": "81d465bf-ddf3-476c-b071-13b9b3626dc6", "value": 2397954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774973139, "uuid": "f5be75ec-82b3-4c41-b0cc-8862c2f78e6b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973139, "uuid": "01868f12-1bf9-46ce-8c4d-9f2097ab318b", "value": "PEDIDO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01685fb-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979652, "uuid": "9a1095c9-e386-4859-b719-62020ee0345f", "comment": "Malware payload", "value": "e1910884513249afab955e61b8fa8d12", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979652, "uuid": "95ba0eab-0550-4706-ad1f-17cd12b1c721", "comment": "Malware payload", "value": "a97a90de70e57d45072e801ceffa0f2351ef1d4a4dde651581f4cc85115b17cb", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979652, "uuid": "1c9dfb7e-6c53-4372-9927-a349ea66e5f2", "comment": "Malware payload", "value": "18bedff5942396f04d7006db9c5ccc734026ae8d", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979652, "uuid": "59aeee79-76cc-49b5-b0f2-d47216120232", "comment": "Malware payload", "value": "391adb4f90df00324f7484067ac99bdfe436348273bcc191643c87ef7b8dd0837432bb4753284d1ba6e8ee7b530a4828", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979652, "uuid": "919f9116-9166-49ba-ae0d-3ba461dd5db0", "value": "T1A835F12D148CE2D3CF8AA2ADF6F0DBE6513A79B9304EC15DCAC4A9E37752338D501646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979652, "uuid": "5a627df7-b736-44db-ba96-a8765784da5f", "value": "192:mwiW2rKX18m5bGRhx1Ww8Xs7cA5BnuNYZCbsg+4/bphVevkKkXk6//kP/Zk9/6np:mwUOX18mVGRv1WwVhznJUbsf4/bphYHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979652, "uuid": "614d5976-7f6d-43a9-a859-acac8b1a92bd", "value": 1079638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979652, "uuid": "46f57941-e556-4242-98bd-8da12600614b", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979652, "uuid": "2f7e4ba3-089e-4fa9-9381-96b81559744e", "value": "1MAR30_Asssssssssssssss-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07544d6c-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774989274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989274, "uuid": "aef1c558-3a24-4662-8277-0d126bbc8918", "comment": "Malware payload (Mirai)", "value": "06dace3b6d6b5a31ace7165e3723fd5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989274, "uuid": "b6d5ef2d-66ff-498c-999a-55c37e971f60", "comment": "Malware payload (Mirai)", "value": "aaab475eb7b93e1253b382d020c3da14bdda74ac8e17db9de921cd57808e529d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989274, "uuid": "71dd2ef0-58e8-4782-b30b-81708136ba71", "comment": "Malware payload (Mirai)", "value": "87be5e0bafd63172f6a69d7c29330ba0851c80b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989274, "uuid": "df8f0c86-a49b-438c-b938-69de80df1355", "comment": "Malware payload (Mirai)", "value": "0dd4faccfe2b96c651d5878a15055a517bb2079b702a653b104b668524dd0acb335b95f0609c9b583945680b3ca8d148", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989274, "uuid": "d50f6958-fcb4-4fed-add4-18986b27faa5", "value": "T1E2334A26AE7A1E17C0D4A47A62F34329B2F1131F25B8CB2EBDB20E4EFF1554461176B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989274, "uuid": "c973478a-c4c6-444c-a413-96a57a263209", "value": "768:6Kovq9WU0SosBG3c2w8ak1r3lJJRmHUfoO+o8IqGqsg:6KOSWlSosBGs2/r1rVJJRAUfio1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989274, "uuid": "c0a4158d-7a26-4f7c-8df7-54fa3462f397", "value": 50884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989274, "uuid": "1e5e81f2-49fa-4eda-a279-710aef8268e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989274, "uuid": "368d6465-7611-4451-b703-38b41fb1b9cc", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4047bda0-2d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774976914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976914, "uuid": "8aa11c00-ff3c-44e1-8918-5a8747be8606", "comment": "Malware payload (Mirai)", "value": "135921dbd4d22ba69c989bed3b49c877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976914, "uuid": "e1a19429-38d2-4282-b3b8-a10aa0a63dd4", "comment": "Malware payload (Mirai)", "value": "aaf1f72b098df2ad84c453306cd96066d533b13b3e90c16c88df9094119a1fe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976914, "uuid": "ee236bf9-b499-4b41-90b0-d4900b32b87a", "comment": "Malware payload (Mirai)", "value": "5fc489c1a22c1282ae2f9c1e7755919a6c08806c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976914, "uuid": "b029a5ee-6aa1-4b0a-8805-be3bcbeb8726", "comment": "Malware payload (Mirai)", "value": "3eead985dfd74fe8ccd208ca833a898fb5d7b005feb1f17d37f8883179d03bbdf281f88f9bf0d1143b1ceb20a7d14ae1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976914, "uuid": "50b0a652-4f62-499e-9973-fa9e6b879398", "value": "T1824423FB15B3F28387FCE9D539DF1A59970143ACB2A62D75D450998AC84C00EAFE9708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976914, "uuid": "d19c8347-2c19-4c67-be82-afc838b14b2a", "value": "6144:lt4SvU7e0UD/SOy6Z81KyXT2JsvYfgpuJKplgmohI55ZmCV:wWz/SOyN156JsvYfg8JAFohI55ZmCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774976914, "uuid": "e0b40263-1ce1-4a6d-b325-d6e78116a4fe", "value": 274192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774976914, "uuid": "bf09e85e-8c91-4505-90c6-c84a2be09f02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976914, "uuid": "333861b3-9128-4d86-954d-9345eeb0a00a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb74f3cf-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959592, "uuid": "3de4e1be-8a4f-4723-80a6-d6310d5f8b3a", "comment": "Malware payload (Mirai)", "value": "e4b603e0fa4883451f568ef095002d05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959592, "uuid": "8b93ea25-6ef1-4490-a609-8ea2494bd06d", "comment": "Malware payload (Mirai)", "value": "ab8e7ec76f4021ec7f0a2586d3a2d5bf27d1e78e531c07aa6c71afcb6b59a245", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959592, "uuid": "1d8edb4d-3e7d-4f33-bdbf-be3b598c5633", "comment": "Malware payload (Mirai)", "value": "ae1b130b8b36650ae13b63a225da0dbc9b05eba7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959592, "uuid": "3201ff06-dd6b-4a75-8408-f99352835a71", "comment": "Malware payload (Mirai)", "value": "299c3f3d22c3f34208e42c96265a0a6ade3cc2869be3d435665f1ef29adf6ccb2185f6ca60b359efcbe6664ccf438f47", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959592, "uuid": "1e44bcc1-c497-449e-be1d-c83aa1172e18", "value": "T19AC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959592, "uuid": "d8195d0b-91e1-4055-909e-a007f312f86b", "value": "1536:68B72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dFJ:6eB4exMF7oZKJnCNYajJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959592, "uuid": "2539720c-0851-4aca-95f2-76f2195390e2", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959592, "uuid": "50a4a3bd-5d19-4c4a-88d2-f7fe27d163b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959592, "uuid": "42a28da3-7bf0-4a2d-93f6-f58f0121b9ae", "value": "boatnet.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c60aa0c-2d13-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774969526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969526, "uuid": "7e730425-ba95-4e4a-8ba6-3ba210fed870", "comment": "Malware payload (RustyStealer)", "value": "6ca1bda3636ce15a24e9046b50c39943", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969526, "uuid": "1e7180b0-a1b8-4e45-8a01-20c27eddf125", "comment": "Malware payload (RustyStealer)", "value": "aba22b2ddc6bdf2815a7193327f52b8877821f287b751dbce9da43bf4ecd1679", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969526, "uuid": "b24d01ae-83cc-42c2-93d3-a0b641115dc8", "comment": "Malware payload (RustyStealer)", "value": "8f55cd1d1df9348940f36359fd80bb713bbb5f11", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969526, "uuid": "86d8454e-8c33-4597-9e39-6e60ab07da1d", "comment": "Malware payload (RustyStealer)", "value": "b6fdd2a4a9f6921dd38ae29cc17cf3a3c09f8266dadd1ea141358379e71bba90a5a2d40a2f80ecee39a7e9d6597a3b6f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969526, "uuid": "6d19321f-b4ce-4d0e-8722-b8c0a0d7ad58", "value": "T1C266B0F4321568FB577A437BCA463DD9536A3323839BA9CC30B4B6C20663B65EE16C44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969526, "uuid": "8c9ba89e-269c-4eb2-bc8a-8ad7df8793b3", "value": "ae3c2ea21d0a1fd83a33d73767c53bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969526, "uuid": "f6c296ae-c88e-4c32-8028-fd75a6bd9ae0", "value": "24576:Jf+ANfqSuFuTXNwlO9w2GEvaTyTMmlkDH3klC280PEYSYy33IYht1V51NxBTWMZJ:5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774969526, "uuid": "e9332f96-5e36-445e-b7eb-7502c99d80eb", "value": 7057920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774969526, "uuid": "7b6a5d0c-6bf8-4a9f-8b49-77ecf111015b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969526, "uuid": "a6708c5f-8399-4d10-b5da-69c81cf61613", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c44911f-2cd7-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774943863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943863, "uuid": "b62e6423-067d-46f5-8c13-64b0857a91ee", "comment": "Malware payload (AdaptixC2)", "value": "7eee8ddf5f981ff7120ad633a5f7046e", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943863, "uuid": "ab8d23c0-4906-4a8c-bb9f-989575d5845e", "comment": "Malware payload (AdaptixC2)", "value": "abac8cd80711555a39d73e5aeab4919af37de95d057038778b737071dc35bb88", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943863, "uuid": "4a673662-46d8-4ada-8395-05b3d73e8d28", "comment": "Malware payload (AdaptixC2)", "value": "254cac4b221bdee6c78ce06a246f7289637fd6a5", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774943863, "uuid": "b85ed36a-fc4d-4530-b260-7d0b1cf6b6fe", "comment": "Malware payload (AdaptixC2)", "value": "303812e08d68745c8beccf5af546b27d1318d5f85d1397a157ff9c1cc71c031317243dcc6fce546bca2abc921ac8c640", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kitty-guard-buzz", "colour": "#57574B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943863, "uuid": "49fd871b-036a-4a10-83c7-b1d2837bed46", "value": "T1D8567C5ABC1D6863DAC975352F2612D43639FC485F82C7276A08B73CBAF27548F23261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943863, "uuid": "b0a9f1d5-d296-4426-b4d0-643ad5fa83ae", "value": "49152:TIfHnk7OBbDsBScs42zMWTCU8H1ND9i79ivJT5EIC:TIfH+OB8gcs4sMWTCU87cizEIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774943863, "uuid": "768be109-5858-4c91-860a-4ae163cd8318", "value": 6226082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774943863, "uuid": "cd42aa96-be5e-4974-b418-c9852a3ec163", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774943863, "uuid": "313f5d06-a69f-4d42-835b-7ee8b6e6b72f", "value": "agentarm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff321f8a-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959196, "uuid": "f637d480-fe31-4d50-97a2-1b61dacaf014", "comment": "Malware payload (Mirai)", "value": "ac09193cbaf806e293a5b4177a6592ab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959196, "uuid": "8f4e86fa-62b0-4acb-9370-cc3778051264", "comment": "Malware payload (Mirai)", "value": "abc9b5b646578de88f3beeb6013aedb233131732c263c32e9efe596c2bf243bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959196, "uuid": "b878de6b-ca88-4fd3-940e-49d4e013ed13", "comment": "Malware payload (Mirai)", "value": "1a2a3b6723fe140048555eab4565d9513df6b99a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959196, "uuid": "fe51f57b-00b5-40fd-875f-7ac5400f021f", "comment": "Malware payload (Mirai)", "value": "cba26abefff5d212b59ce54b704ac0e2485ece3314ff5bc7e0c5003eb089781c7f3450c90c94849e324de811b25909d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959196, "uuid": "dd65b602-a211-408d-95b5-3d9daa855e3b", "value": "T1D0C2E168205A641DC58E07FF254E7B8FE42026DEEA9ED3433449A14C72B3EA9B4B854C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959196, "uuid": "27181c34-6a49-4ace-ba9a-db79257055da", "value": "384:M4xtbDVzWOm5onmDT0DG6IKt0tgzU0TItFWUNvL5EhP3zUOjG1LrxS7I0YTv1RF:pEaM0DG67CYRTPML5KjUBRjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959196, "uuid": "051d4646-d7e3-4df9-b7d0-13700338cadc", "value": 27424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959196, "uuid": "a9937962-73df-47fb-a574-aa3c8b48d39f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959196, "uuid": "8f00fc78-8b11-478b-a305-5b1eed8ccac2", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558bf2ad-2cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774960199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960199, "uuid": "9474a859-347c-4c2f-88e1-041321f368af", "comment": "Malware payload (Mirai)", "value": "242c5bd5126ac5b4d54ca6a97edf0678", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960199, "uuid": "dda9465b-8916-477a-b905-72b18a647554", "comment": "Malware payload (Mirai)", "value": "ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960199, "uuid": "9aaca242-c711-4b78-946e-b9bb7eb40574", "comment": "Malware payload (Mirai)", "value": "747cb3c753e528c69a80fe2421aae8b5aa19fc86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960199, "uuid": "d4a1d391-8655-4dff-9576-e8255360e564", "comment": "Malware payload (Mirai)", "value": "99cc90104fabc5192debe9f6758216dba7bf530a1accff6c2644880a40ead52e8d7f07a56f6b9cd58d2db5c54da1312f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960199, "uuid": "96a22f82-73dd-433b-9f14-c70afd363a8e", "value": "T1C751F4C445849E75ACB7EA52BAB6C21C7092A4C314DF7F9ADEC8B9E0858EE10F140793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960199, "uuid": "aee31d8d-4b03-4635-b0d3-f34c78619ff7", "value": "48:ZpdXdgUpdgndgwdpdoXdd7pdZd2updydL1pdDdsgpd7dUopd2dfppdvdo8pd2dfG:ZzNgUzgdgwdzoNd7zj2uzIL1zhsgzJU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960199, "uuid": "cfd45796-b5d6-4f44-adee-96170689f790", "value": 3066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960199, "uuid": "9038977e-98b6-4209-9f9d-0e5a7dda205a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960199, "uuid": "15475b6f-a3b8-46c3-84ac-9a970d3e5168", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3ec724-2d04-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774963459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963459, "uuid": "d733d124-c4db-45a8-af04-7e20ac4d1c4d", "comment": "Malware payload (Vidar)", "value": "cbde8ae0d00710e40fd7a2186c14fc56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "toolkeep-org", "colour": "#0DC1BE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963459, "uuid": "f3121612-4c57-4e01-a6ef-b2b64dd632fd", "comment": "Malware payload (Vidar)", "value": "ae6adca9f46291f9a6f95e3e4bd075e11b5f77775e8c960b6d1f61f4544afa84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "toolkeep-org", "colour": "#0DC1BE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963459, "uuid": "c3ba88ea-c95a-420a-9254-8f682b1614ee", "comment": "Malware payload (Vidar)", "value": "b4a1681fdb5ef999a14951feb545232e0289f06f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "toolkeep-org", "colour": "#0DC1BE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963459, "uuid": "7c7465a7-e4b2-4580-8993-7358bf5cd81a", "comment": "Malware payload (Vidar)", "value": "0733c5e7ade78567c6b2a5b98d1070c4664885a8b239ac3f9fbda20f12b15f1b5d35db9b4821ee456d2a4a4a05e12625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "toolkeep-org", "colour": "#0DC1BE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963459, "uuid": "dbc8fe6c-493c-4541-8237-15562dd30dcf", "value": "T1DF857C4B7CD148BAC0AA633288B651C27BB6F8181B3333D32F54A6783FB6AD05975754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963459, "uuid": "e26916d2-f914-4b5f-870f-6da31ef35157", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963459, "uuid": "0b5c3671-9bf5-4645-896c-5030bd698355", "value": "24576:wOmQFVYf2s04J1eU7cg6MxfvuWpn0CeJZ0IrjGGZrvVzZeZFqG6WcRLG4:wOJFufnR7cMVHpdeJZFX3ZrvVz4ZFOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963459, "uuid": "5d6eeb59-e4c5-4817-9615-94f6773f67f1", "value": 1841288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963459, "uuid": "694b17df-e28c-43f0-a1ab-97f39ab51ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963459, "uuid": "7cdb0de3-d52c-4738-b31b-0bfc4816eba6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9823d326-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774989517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989517, "uuid": "0c903573-7dd7-44cb-a5a5-5debbcffe497", "comment": "Malware payload", "value": "6948384b24c1b8141a0e4352127cf4b9", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989517, "uuid": "f2c9f4a4-c961-4772-826c-1702deddbeb5", "comment": "Malware payload", "value": "ae7e21e817d08c2b6d1892285d63bf875036b285144e3456880fc0473f9bfe79", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989517, "uuid": "7f75d9e9-6204-494e-97f4-597da9dec1c0", "comment": "Malware payload", "value": "ac499fd461ac6525bc22931816244090d51ff90a", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989517, "uuid": "e8810b20-308b-4a24-aab9-ae696f65bf81", "comment": "Malware payload", "value": "4792197f62b4ea15f1e0c7c1174c76edd22f0ffd2abda130eb585b3a8a43db261b2cd252d425a05c83c90209a5ba599b", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989517, "uuid": "604a7f90-43a9-4934-bbd1-06e1976ade16", "value": "T1BD554A5B7CD009BAD0AA933288B252D27B72F8190B3233D72E50B7793F76AD05979714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989517, "uuid": "2d5cdffd-7ca9-45ba-876e-2460696c5cf0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989517, "uuid": "381e291d-6405-4c5a-a66c-d75b38c1bd6e", "value": "12288:Lzp1ZiTLGp4MfFkXs/eI2fwvVHy3l+58TCGvdzkDMfbGH8m9NjMwad:L1r+EfOXsWIJvM3l+qCGFWPHNNj9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989517, "uuid": "eb56664d-509b-4e26-a3c6-48a67b133c0d", "value": 1380480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989517, "uuid": "32b31b27-3845-4f94-bc0b-9378750b06fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989517, "uuid": "968e11ce-64da-4bd6-ac8d-d78e23c7132b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df46b0d8-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774960001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960001, "uuid": "96e37404-ec38-4f86-8d9b-2f59b201033b", "comment": "Malware payload (Mirai)", "value": "b103f1c80bca777686e27b5a4253cea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960001, "uuid": "db3baac5-471d-4afc-bfb4-2644c08763b6", "comment": "Malware payload (Mirai)", "value": "aecf45ea6b65236a96db17020973f9806b43b9fda93033ae497bff29902fc56c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960001, "uuid": "c5a9eda9-fdd4-4b91-b9fc-83dff8c16273", "comment": "Malware payload (Mirai)", "value": "d095b14e0d424daed5f6eb8f3f5a11762e0b0c03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960001, "uuid": "8ec6cb94-9045-4a28-9a0f-7c1045bb3350", "comment": "Malware payload (Mirai)", "value": "e9b0d10446e121571927ee684466905bac79376a90d25ee3f8770b781769ff7d8d70b1e88f55014ab0191ba19562cadc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960001, "uuid": "ae36e080-b963-4cf5-9091-25a942e8a170", "value": "T1CF730846F8818A16C5D512BAF92E118E332227F8E3DFB2139D205F643BCA42B0E77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960001, "uuid": "dd57460a-8c3c-4c0e-9a1f-cf4b2572656a", "value": "1536:lWnx3G/FuEGwKu1YKc1kvGFhiQ72RrQSDFkzwI9iKFfu7dXF6:40FzGo1D+KwJCRrQSuhu7dXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960001, "uuid": "e04e0d26-588f-4e60-9117-28c923196865", "value": 76468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960001, "uuid": "1bbc0ed1-8d6d-41c1-bba6-22dfb6964e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960001, "uuid": "73f59cc7-8928-4f60-8143-715854d86818", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72707943-2cb1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774927606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927606, "uuid": "5022a0bb-5f76-4890-9ff0-043d23b63ede", "comment": "Malware payload (Mirai)", "value": "1aabe03da470a7be5478507dd589fded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927606, "uuid": "e0713c6a-ee23-44b9-8840-9fbece54a685", "comment": "Malware payload (Mirai)", "value": "af5195e882ab3ab966730dd022119a4c5d996245f6fef56ee4ba458dd73da8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927606, "uuid": "dbe5e925-62a6-4d42-a305-d8d9ec1c67e3", "comment": "Malware payload (Mirai)", "value": "722ca7a8baf04cdcb00cde8f865b268e5a288496", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927606, "uuid": "065f6ddd-c48b-4a75-86f2-ac0561d9c2eb", "comment": "Malware payload (Mirai)", "value": "b1d7b9974ec8080336e54d80cbedfe754bc2d7ca82a1fa8b0f8cf8f79ed1fbeb033bc1b4ac5d9a8d65ec495d2b334e33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927606, "uuid": "172b36c0-b8fb-4e2e-8067-2515618408d1", "value": "T14B464C1AB2B314ADC15AC430836FDA236D35B85542317D7F2684AE742EB6E705B2EF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927606, "uuid": "a18c13ea-79c8-492e-8c03-1861737df0f9", "value": "98304:JJTBsEUfYU6akkWTQtvJxkvfPws9+daIic8Pn6tHg8Dtj:RYM9WicW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774927606, "uuid": "47d5482e-a5fe-4248-9055-a50422664d9e", "value": 5669928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774927606, "uuid": "08a705a9-b319-4e3b-92c8-894293b37397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927606, "uuid": "f0873ec5-f9da-4d83-842d-b16c3eb4afac", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c8e520-2d0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774967117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967117, "uuid": "756223c3-1c2a-48bf-8793-df27a4aeac1d", "comment": "Malware payload", "value": "9abb71ae94aec7126993a44c9f40861b", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967117, "uuid": "0ca52ebf-f5ff-47ad-be5c-45ce89a6e1eb", "comment": "Malware payload", "value": "af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967117, "uuid": "0d1f18b7-80ee-4b88-8db6-e0634c71c4dd", "comment": "Malware payload", "value": "971320c8fc9e663339988d3e95879653bbf3c1b2", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967117, "uuid": "e268957f-baa1-486b-beed-1b0a92579c8b", "comment": "Malware payload", "value": "e90c9949161ae33f332b087c9d9d325c62c8c940c5234cf46859caf02598b0be7b6e4d4dfd27fb5d67a7e50ba0da5597", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967117, "uuid": "4dae84da-0326-4863-bf7b-f81ef014deaf", "value": "T1939533DD60983C19C749AD32D5F0F636E35D9A2068E5A3E4D6427699EAD20CC2F338A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967117, "uuid": "3e48a30a-273a-45bc-8687-1de7dddd6ad4", "value": "49152:krqCL+seQ0naiq/kqB85LyhV0N8042Ty2gtuvVq5k2nee:krq2eQ0a5/8QdyS8Akk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967117, "uuid": "18b24c1e-fef5-4f32-acab-dad3aef1137e", "value": 1992434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967117, "uuid": "f7f640e2-6d73-4a8e-b003-7085cb64402a", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967117, "uuid": "b06baefe-642e-48c4-a0ce-768864097f43", "value": "filedata.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccfa8ef-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774979646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979646, "uuid": "d716cb94-0ce3-4783-80e4-ad0b2137e29e", "comment": "Malware payload (SalatStealer)", "value": "a6469a528227c6d2689e7153efa71203", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979646, "uuid": "3b47642a-ae10-46c2-8094-f82dacd173be", "comment": "Malware payload (SalatStealer)", "value": "b073028a732b5405a7d2f9237459c6afe1a21975e21d60c841d93b27dde33627", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979646, "uuid": "f144ed9c-c304-429c-a1df-c6b448dfe4ee", "comment": "Malware payload (SalatStealer)", "value": "afb74fdc385a784bc03dee0aba184a72b9d2d604", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979646, "uuid": "7279646d-fa40-40e1-99ab-369125ab7da5", "comment": "Malware payload (SalatStealer)", "value": "43e0c011df458ecd858672c49bdde6900fb8bea309d3c1a6e35804488ba0461c5c1216b59c179424aeebe03c1821a62f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979646, "uuid": "a2987d38-efef-4dfc-9353-e390bffe0d20", "value": "T120B533133AEB88B4C04115B186E4B79118F9E621070482D3ABD41E5B5BBFFC59FB92DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979646, "uuid": "2c2b7097-bef4-4534-aa08-78f9f220dbcb", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979646, "uuid": "3cbc162b-b019-429e-91d1-7a3dd3a074ca", "value": "49152:HgwRY2ALcUvtsBFD80rrf/g0YGhxqcoxE1m8PbowpXFDXANroMQ42:HgwRYF/vtgJj/VoxfWyNroMn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979646, "uuid": "124dd45b-cfe8-418f-a019-05c2832ef178", "value": 2341739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979646, "uuid": "96894a10-7ea1-4b7a-b484-285291c108a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979646, "uuid": "beef8f7a-d590-4300-90ba-edf5e6b1aa92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79763b2d-2ce4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774949522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774949522, "uuid": "480e5e62-2d1a-4308-b30a-7b8d8b195c25", "comment": "Malware payload (Vidar)", "value": "30bc14db5e40d0f38d13c56c1f466d99", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774949522, "uuid": "70b51f0a-5fcb-403b-88fc-30b1f12ccae2", "comment": "Malware payload (Vidar)", "value": "b20a1623d92c0791afef7916fe1758be58f69fd7cff850b7bee31aec0b60a39a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774949522, "uuid": "f0f742a1-18e7-4af3-9e29-ecceefd5f4b8", "comment": "Malware payload (Vidar)", "value": "ca6c9197bb567b8ac208332e80cdb9ae629863f0", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774949522, "uuid": "a3f1a989-672d-4b03-93cc-505c43ec3657", "comment": "Malware payload (Vidar)", "value": "3a63b91a70f435b94a1dbbc3564303f1cee70172e73b3d71902545197d2f3b5ef9e8a7d1b0c1f4ea990780f289a77ad5", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774949522, "uuid": "115ca1bc-26e2-490b-8f07-cdbd78110212", "value": "T17C958C4B7CE044BAD0AA53328CB25292BB76F81A1B3273D32F50A6783F76BD05975354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774949522, "uuid": "2e701353-301d-4035-8cd4-a5e9a318995f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774949522, "uuid": "0fa85c91-2725-4dfe-9a0e-9c21045d3adb", "value": "24576:/BgndUIheQwAXtQyLazcQjwrXPLyg9NkFHzo/+nSV3GRWdtNbXwyO:/BgdUIymLL7QIXV9NxQSVH3wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774949522, "uuid": "55824d72-5362-4d1e-9754-f9a41805a5f3", "value": 1920640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774949522, "uuid": "7c3e4f08-fef6-4e20-a1f8-1c3cf0eefe06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774949522, "uuid": "7f5526e6-878c-4a3e-ae0a-7c47144c1ff2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95969107-2cb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1774928524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928524, "uuid": "caf5912f-c84e-4d86-a6c7-aa3c9b29bbfa", "comment": "Malware payload (Expiro)", "value": "e06cc4d6d048ae9c8c0636135278d807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928524, "uuid": "e417e292-c7d9-43eb-bdfb-0435e7866ffe", "comment": "Malware payload (Expiro)", "value": "b25093f6574ff5b2d7ffd787b487c7182427fe43d52d6a15601ca50ff34910fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928524, "uuid": "fb85aae1-777e-4ebc-af67-5121dfa21944", "comment": "Malware payload (Expiro)", "value": "6b0f024c4c08c8ee43516f2ac8e3f30780f570b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928524, "uuid": "38ec1d46-d378-4f0f-b859-6d988ef11a3c", "comment": "Malware payload (Expiro)", "value": "d0fb11e86ce833feacacdd3ae730c468f8cfeeb521c4fe3704e1a7e2de1b5e10196259bb338179c78b75d5921fa22695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928524, "uuid": "22600c46-f4dc-4147-86f5-2fbd270f940e", "value": "T1AE852324B6D68030E5B719324AF0E6B41A7CFC309F72895F57552A1FAAB04D1EA38377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928524, "uuid": "7fd6dcfd-8449-4d78-a8e0-45330289a3b2", "value": "59dd7ae6bef680b839d5a65e314ee5ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928524, "uuid": "cf914fd5-aaf7-4039-ace2-ebe4dac315fb", "value": "49152:hr/T43fxo3C9/C6WdiCNOYcsx4x8EVep:hrMpokC6+1ix8EVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928524, "uuid": "17564f76-06ec-4abf-9fdd-c2291e2e0f2a", "value": 1838080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928524, "uuid": "d6f801b6-80d4-447f-b1ee-9e3ff2f5e8a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928524, "uuid": "4898fc28-5c10-4141-b69f-9dfdb87d6bdd", "value": "b25093f6574ff5b2d7ffd787b487c7182427fe43d52d6a15601ca50ff34910fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85457488-2d3a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774986479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774986479, "uuid": "5b95641f-5b6b-416b-afb9-c4d065015d54", "comment": "Malware payload (NetSupport)", "value": "f483618f7ce976720b04e763a3b3de49", "object_relation": "md5", "Tag": [ { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774986479, "uuid": "7fa9d881-6dc4-4b22-86e8-4510ee60a001", "comment": "Malware payload (NetSupport)", "value": "b3e9ada12ec44777ca75204386492e8efabc5e17e7b8a204a97ff8a0c1c32ba8", "object_relation": "sha256", "Tag": [ { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774986479, "uuid": "58210d60-934c-4ceb-b864-261f933c520b", "comment": "Malware payload (NetSupport)", "value": "8995f1a1d0ecf393c65c8f8de540c705cec08c81", "object_relation": "sha1", "Tag": [ { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774986479, "uuid": "3df02ee2-7194-4695-a07d-9de22a003086", "comment": "Malware payload (NetSupport)", "value": "0187560f8ac8e5acc7d69cb597aa480b7ab8f4070ae9e853ed170e8f1269a24e40cc3496caaccaf8a4294812a005ee66", "object_relation": "sha3-384", "Tag": [ { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "blixorugggm-org", "colour": "#C5F719", "exportable": true, "hide_tag": false }, { "name": "kfalospiro-com", "colour": "#6AA17E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774986479, "uuid": "a5e92a7d-e578-4283-b0ab-a78df87613d1", "value": "T119967CB88B84975EAE6E1A07E078571E67F37F26D09271FC5B62370B216FC086639C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774986479, "uuid": "63a13274-68ac-412c-ad13-33113f2be582", "value": "49152:xB3u7kFIvGaA1UzZteLlGDRISCvSgpV9xESjuPV7Xu2zAxN9eR:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774986479, "uuid": "1679220f-46e7-4aa8-9f30-e347d837796c", "value": 9411057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774986479, "uuid": "e801aa3d-6c0b-46d5-b656-2459f907b4a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774986479, "uuid": "64903a77-29dd-401e-b76e-7b00239fcb4d", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb95dfb-2d02-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774962577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962577, "uuid": "2c8df657-8932-419e-821a-10b5e9fd9b98", "comment": "Malware payload (LummaStealer)", "value": "cd22d0d404278e9dff0bcb6562884b2e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962577, "uuid": "cb8ba880-b64f-444f-a11a-ab1831573246", "comment": "Malware payload (LummaStealer)", "value": "b41271b81e2f50274fc5b5aedf4cf38fa2b80542a5e7c84e37bfdc1fad576c82", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962577, "uuid": "e48e4011-5914-43f0-ac67-8fb9c4a85aa8", "comment": "Malware payload (LummaStealer)", "value": "08c1d48b885c4fdd68a42b9a1c5ad57121387891", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962577, "uuid": "9472ba8d-8fc4-4aee-bedc-e5ba2d826ff4", "comment": "Malware payload (LummaStealer)", "value": "e23cdaf4daaccae741fb4c27fcb9ef09f2f19fecfd26016636e413577f7d4406ca8c11dffa48e9e41d83895dde017b1e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962577, "uuid": "8e171d31-a518-423c-bcba-c44929473a95", "value": "T1EF755C51FE8784B6E412133289E752EF2335AD0D4F329A87EA447E39FA772D11832356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962577, "uuid": "ab73c353-11d0-4a15-97e0-c90206d07bd8", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962577, "uuid": "600aa41e-3c03-4e44-a8d1-fd8dbb6ba5ed", "value": "24576:BtlLlKLeexQvL4c2dmvtbBigoUUyBrFxmGoT0iHOB1PN1jSIo3KkWRVgxTpXuteb:BrQky2KgDCS5ke8TpXuteriVwEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774962577, "uuid": "a45c046a-0084-4bf5-bcf4-d7bea7f0dfee", "value": 1580032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774962577, "uuid": "3e496b5c-d805-4dba-b7b2-2d77269d86e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962577, "uuid": "e23f00d8-1c46-4856-a121-5f1e4bdc03b2", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0322abde-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954478, "uuid": "e7c5eea4-02b4-494a-aa86-cd044bc521f1", "comment": "Malware payload", "value": "fe27e510850f077e970a158a1a7b4103", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954478, "uuid": "e6e289f8-03f8-4a78-8347-a42ba903fb48", "comment": "Malware payload", "value": "b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954478, "uuid": "5ff27f7b-a11a-4a09-9655-286e13ac140b", "comment": "Malware payload", "value": "d4346b246e56f3d15e24fe30b91f989ac243e252", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954478, "uuid": "9648a8f0-44e8-4ed3-b2a0-5f7521b28148", "comment": "Malware payload", "value": "bffc99038165b36c6718d561943e0b42717c23c31920d99115f5cec21beabd213ec124e90bacd3e54b177b07533304c6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954478, "uuid": "d76bf1d3-bc6e-431d-8a31-e04531ab2c85", "value": "T1FCD0974B11240066CAB4CAA412AE7302AE4B312710032D9A322F543A7F180B3C2DA098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954478, "uuid": "a377f546-652e-438c-8aa1-a166c0c4066c", "value": "6:hmyE81R3KupMFIs3DVMjTF41R3IWFJ2HddJHG2oZKFM2Moh0DA:M181kUMn5OF41R297hFfh4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954478, "uuid": "36b9be21-63aa-4656-b551-49663de4b0ff", "value": 251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954478, "uuid": "0d3c8d0d-9a03-411f-b951-d3f5860e8ceb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954478, "uuid": "ef82eaf6-af8b-43f5-a16b-94258a7ab960", "value": "b4525711eafbd70288a9869825e5bb3045af072b5821cf8fbc89245aba57270a.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2448b500-2cda-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774945084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945084, "uuid": "7b79ecb1-a0f7-4bbc-b7d9-38bf0f81177f", "comment": "Malware payload (AgentTesla)", "value": "4f8d9b0da368599db0976036d4deea8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945084, "uuid": "afae8882-5f5a-4e39-a842-28829a031649", "comment": "Malware payload (AgentTesla)", "value": "b4542279746a951c3487cd4fc70897abee32672723c249bb860b5eca2c14a2b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945084, "uuid": "b805c96d-3573-4079-b47b-9478a5ae7048", "comment": "Malware payload (AgentTesla)", "value": "8da20f255f794a47359a74432c323dc93d54a16c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945084, "uuid": "da9155e3-21aa-432f-a24f-74b9fbf4d0a5", "comment": "Malware payload (AgentTesla)", "value": "c72717c77dec3fcd9012136501fe84b9cc011649f9632537e21ea614381c2c12837f6f365b40d5d460c9f0868ebaab26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945084, "uuid": "5e7160da-5562-45b6-9e2f-84b738d17d1b", "value": "T108645D60ED3413978D9717ADACA85961C9BFC90D922640F5F7C9030E6201AFCDBBE62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945084, "uuid": "253470d9-2036-4c5d-b147-82b1fd46e381", "value": "6144:21qyStOwmOm/vDkZXkNHRZvvLW78tTtP+I:21qyStOwmOm/vDkZXkNHRZvvLW78tTtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774945084, "uuid": "d46fd748-2b96-4bdc-bb2b-6b8466eab27c", "value": 318641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774945084, "uuid": "563123a6-8878-480d-ad8f-b10a2f677910", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945084, "uuid": "f0962d21-c124-4853-a9da-b51bdf837a44", "value": "IMG31032026-00316.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7133d045-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959387, "uuid": "2391746c-0e5a-4867-9a35-fb65419706ec", "comment": "Malware payload (Mirai)", "value": "a9114ed4d67aeda5db3067c0d7493bc1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959387, "uuid": "0dc9661e-5135-4b89-b700-297a4818c189", "comment": "Malware payload (Mirai)", "value": "b52c5013811928ec59cf5d75d3eeb13907888468170c54d2650dd50fca5df090", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959387, "uuid": "132b619f-150f-4ba7-b3f0-406b83989bd2", "comment": "Malware payload (Mirai)", "value": "efdc48108ef8d0901b1cda99f511d0921cb72800", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959387, "uuid": "b43cb1cf-eb69-4b71-9b5d-280c50481c3b", "comment": "Malware payload (Mirai)", "value": "f9d12e21ba1c89cc8578006adf63eddf6991bd9f565f28321d32ef55cdebe7f563b67f2dfa2030456a9f6540e54f36cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959387, "uuid": "96a3091b-3aa8-45ec-90b1-03a3e24b6588", "value": "T1DAA30887B902DE7FF80BD6BA049309197531FA660E530B76B367BD93AD310D41926F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959387, "uuid": "90119ec2-4608-4af8-bdbd-c9772c93d49e", "value": "1536:Xyb7fahHx2asY7stwZgNU68FF4PDW0gsRmDZYvT+Ff8OUdKxcS:Xyvyr7sY7stGgNU74ZgN+tOUdscS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959387, "uuid": "25ea8bb4-4257-4fe2-9dd3-315fd868e1f6", "value": 99684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959387, "uuid": "7414ef99-a7c9-4430-9d6f-eeda52f1274d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959387, "uuid": "3209d01b-1af0-41d7-9d6a-c7c1ebb162b9", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d15f1d0-2cc0-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774934093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934093, "uuid": "c997d18e-ce79-4a41-b4f6-d1e7f44d4d28", "comment": "Malware payload (SalatStealer)", "value": "5c7ba305332eca919ddeb5b5d9066a9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934093, "uuid": "9867edd7-afa0-462c-ae69-3fe27807c09a", "comment": "Malware payload (SalatStealer)", "value": "b6e3fe7402b50f33ff58c45c62a6ba4ba5688dfa4620e9d2f64162bfc865aa04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934093, "uuid": "3d1fa78f-4e27-4bdf-96a7-77e6b9acc66f", "comment": "Malware payload (SalatStealer)", "value": "62e0c6d5609e4cb3171574b2b7275ff5ae06b41b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934093, "uuid": "f0ce81c1-68fa-413d-a8a2-37a36997a402", "comment": "Malware payload (SalatStealer)", "value": "2ffa56e38322d0a36592a213add6968bad3db7d21b207aa894ab6747fc91b54dadd41800466b93703dd360c7b0d8a169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934093, "uuid": "3b1d3a08-50cc-4063-9f55-dea9460a73c9", "value": "T178F533F5115CAEF3CC0BA978BA69919AC65E80D0AB1583D52E31FB7C04D7D1748CEB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934093, "uuid": "6e261ec6-c0d3-49c2-ae6f-a5605f99e922", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934093, "uuid": "8bb9c1ba-c7d3-41b0-b5f7-f53264d0dece", "value": "98304:hllpHiW8ZG9Ir6tcAyF4csdLTF8jD/QKaxYJGnm:hlF8Zxg3OslWPQKaOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774934093, "uuid": "bac21401-f785-4679-9018-18977787a108", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774934093, "uuid": "1d378a3f-3f4d-49b4-b88b-024762420c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934093, "uuid": "8695b16f-b72d-4c84-bf76-fed30b3bceae", "value": "b6e3fe7402b50f33ff58c45c62a6ba4ba5688dfa4620e9d2f64162bfc865aa04.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e95dd6-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774960577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960577, "uuid": "808d1b06-b7bc-44ad-827d-1fe156ef2525", "comment": "Malware payload (ACRStealer)", "value": "f34db180067ac19a6909a6c665a12b0a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960577, "uuid": "cd61b3e4-7109-4633-94c8-e07e467b2a97", "comment": "Malware payload (ACRStealer)", "value": "b6e579457bd4e516dbeb39f0d1a267555367c452558bb08e3333c289a922d550", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960577, "uuid": "fd65c587-4719-4077-b855-bb3e3449a3ef", "comment": "Malware payload (ACRStealer)", "value": "e1a161dd468896735bef517d1a9ecd42e95daad4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960577, "uuid": "5968eb8a-c9ca-4d66-962d-7753de14dc0d", "comment": "Malware payload (ACRStealer)", "value": "0304639d776783c2f01e9a215ddf18f6eb50c94d5c5fb3a3cfe2db47ac76cbe66cc99d4dff2854007155d0fdd99f1e47", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960577, "uuid": "e2bd4ed2-e5c2-46ae-b182-b2006fe9b3e6", "value": "T112566C23B6449D2CC0F601729A7A2D608AE19C179735E1D3368CBED51FF27C269B724B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960577, "uuid": "9a91d4ae-e26c-453e-81f0-e493c1047063", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960577, "uuid": "9bfaedbb-ce7e-43cf-b014-aaacde305275", "value": "49152:5GWShKFK51yVYuFhM+IQXT7IeWyHPDMZnlPqnkcDib/B3QmYMMVl3TGF8etltUWz:50151GxhiehH7MZcniemYMMvsUD+Tg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960577, "uuid": "989c420a-5726-44ae-b136-f6207bac4630", "value": 6133760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960577, "uuid": "9a15a6a6-b9fe-462d-b36a-28db26db5538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960577, "uuid": "c4cf91ef-9646-4c7b-8491-104ebb3ec89a", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1dd6eb-2d02-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774962519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962519, "uuid": "7ceaee7b-f98e-4930-abf8-89fcb06c7d16", "comment": "Malware payload (LummaStealer)", "value": "ca81843803de3433c4676159b6366f00", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962519, "uuid": "ca819e0b-c321-47d2-8531-f0b41df9c067", "comment": "Malware payload (LummaStealer)", "value": "b7076983658e5cd6dc68967d959ec9c701ad9313403d2224a402aeec6bc9c2a9", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962519, "uuid": "c82cc5ec-18c8-4b39-b667-577270f142cb", "comment": "Malware payload (LummaStealer)", "value": "a6b3bfd0f51b81e1e2c4a9a7e33a4f9b50d8a77e", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962519, "uuid": "158da94a-20d8-4659-8125-7814b4ef22ff", "comment": "Malware payload (LummaStealer)", "value": "e99a5c323d5ffdb589ec21f20f054dceb57de4c6dafe74df54edc5c6c769472eb5385ba1dfc2d860edce520c1761f9ec", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962519, "uuid": "36b83e7b-9922-41c4-96b0-ece5d0ebab4f", "value": "T115655B51EEC784B6E412173249E752EF2339AD0D0F329A87EA407A7DFAB72D11832355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962519, "uuid": "e5bd2150-c0e9-4e22-958b-61f61dc56317", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962519, "uuid": "e8a6d00c-67ae-4077-8e15-1427301eca1d", "value": "24576:PtlLlKLeexQvL4c2dmvtbBigoUUyBrFxmGoT0iHOB1PN1jSIo3KkWRVgxTpXutef:PrQky2KgDCS5ke8TpXuteriVwEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774962519, "uuid": "40ebafac-697d-4d09-bd4f-41834656225c", "value": 1461760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774962519, "uuid": "31746a82-5857-4069-94f4-b9f8f764f168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962519, "uuid": "142352df-e2c7-4eba-a1eb-2b273af3aa1a", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175f7175-2d38-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774985435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985435, "uuid": "1ef90812-8e4c-44f0-9b87-a9020fdb94fa", "comment": "Malware payload (RustyStealer)", "value": "f0574a783c637414bd333b730df18e59", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985435, "uuid": "a9228539-e657-4fe5-bf92-1b7e76f779c2", "comment": "Malware payload (RustyStealer)", "value": "b7409c444539c3cb3b63809db8359543e19af9c43ff2f36543651fb6d7e041d9", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985435, "uuid": "4b6ff22a-e7ae-4c41-a155-747bb30ee2f9", "comment": "Malware payload (RustyStealer)", "value": "7f38dde18b67c71e746a628a916224e20d69e85c", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774985435, "uuid": "c256617d-8028-4db7-87c0-2683c6bea367", "comment": "Malware payload (RustyStealer)", "value": "8f61dddcef97551b12503cc3a449c895044a9cb156de2f6f55bce73fab6cc519c1c7dc4bef1e1ad023218f9d8ac5d77b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985435, "uuid": "886abb13-4bff-4d8f-9edb-28890d1b360e", "value": "T1B266BF747260BCF3596F437FCA577DD9436A3752429AACDC60B8B6C20613674FE2A808", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985435, "uuid": "cbd4f897-b47f-4105-b3d8-2ddf6f027b89", "value": "43bde8802b940524fb43cd661cade5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985435, "uuid": "f4ba0f76-b2a9-4402-9d76-a7bf786f7e1f", "value": "24576:uK5eIjaikWLkkPc7xiHI0jEsNHxPm8vcPTso52unEYaHnHSdl10y9GCEByCfkHBa:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774985435, "uuid": "286b8880-f9d7-4486-81ac-37317c172cff", "value": 7100416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774985435, "uuid": "c79eec73-1750-4263-9ee4-4ff58a16f31a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774985435, "uuid": "695bbae6-ec95-4c81-919e-47c776a9a3a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b123f2-2d3d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774987847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987847, "uuid": "ed1dab5e-e433-4426-9b68-fa3b75ca1964", "comment": "Malware payload (CoinMiner)", "value": "3722d309e7d5a073aa511b75ed3935b4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987847, "uuid": "b18f4019-9771-4e20-96f9-dc52d55c627a", "comment": "Malware payload (CoinMiner)", "value": "b7af70e86b3b63c467582b41944c380bb6c16ffc98c26be4651539b9b274f5eb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987847, "uuid": "d432311e-7656-4ae7-81a7-f574e4be96ba", "comment": "Malware payload (CoinMiner)", "value": "f6bd870aef7c927cd1ea054ca484cea3231606cf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987847, "uuid": "7ff75475-1a10-4933-9f23-393376f6df41", "comment": "Malware payload (CoinMiner)", "value": "ca4036029ad36aeeb7c54a485204d48535ea9ed2675f652fa4314baf52acba8cc8b0c254e0e39aee520473a47dadbe5d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987847, "uuid": "0a733d79-5945-4b65-a20c-2c3777bf8c5d", "value": "T14322292F7E440231D3A048B815B4464BA53D1633A797F3EFF733D65A0FAA2449490EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987847, "uuid": "f31fbf43-3899-46a0-92b9-61dd3af47181", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987847, "uuid": "77288182-d61b-46c1-b9a2-0f5b7b1eeb56", "value": "192:h5orG2wsO6Ba/x+eVVPFJxTEZmFhSucK:h5oWsO9/wuPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774987847, "uuid": "a7164575-5444-40c4-b0e1-28d55f41f1b2", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774987847, "uuid": "9283c921-2647-413e-a730-f822a6c62db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987847, "uuid": "6e1ab6cd-11e7-4baf-baf3-02497d7642a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09773d57-2cf3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774955777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955777, "uuid": "221d7bed-f467-4375-bb2c-24678a7816c6", "comment": "Malware payload", "value": "a9ff4281ba7a326e32cfef7f49585709", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955777, "uuid": "447318c6-aef1-4715-9519-d7cd7bf18c51", "comment": "Malware payload", "value": "b7bd319d5fd116a9514a316599210aac1f30d86391b2fa8fbe5809bacfd2c132", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955777, "uuid": "050c27fb-bdc9-44ea-a804-031d9a18c94a", "comment": "Malware payload", "value": "c63872fd62d50dcfceeda3ce6145361839034fd6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955777, "uuid": "f5439688-f347-4791-93c1-d9869f96c61c", "comment": "Malware payload", "value": "f3b4c547b2a2494b196fdb60b8bce102b2fc94248da2aecc693546e87f3b78e4ec61bf283f1b38564191bf9d7355c422", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955777, "uuid": "0b3369ab-cee5-48d7-8ea3-553d2bf7a5c6", "value": "T15061AFF831D0A93A15EBCF0E73F54989906E45E638E13F7CC9980D211917CA4FA8DA4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955777, "uuid": "617cefca-6ca0-4f3b-92f0-af34be302463", "value": "48:RSaGR9B6FuEAgNR9jYziWkK9TL9kDXbhUzVt3sXcwOWsQGUZVG2Z3q99VJ38j299:RZG6XKT0eYhY8oW3q9SC1pHKX/2mvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774955777, "uuid": "70f466fb-7178-4d52-8a69-e43d86d233bc", "value": 3300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774955777, "uuid": "716a48cb-570d-48f7-b37e-c4903985483b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955777, "uuid": "c602118e-e229-4638-ba35-d33f25cd59cb", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f94d484-2d17-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774971410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774971410, "uuid": "286d53f1-ade5-4940-a1a4-b8695c47fb4b", "comment": "Malware payload (AgentTesla)", "value": "bb139c91d5a845eece302e3da4aaabe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774971410, "uuid": "cb240b90-7991-4396-bff2-60d4c5aebfef", "comment": "Malware payload (AgentTesla)", "value": "b7daa46b77f75188579b593906c597198726f0e6e57c7df79e31db3abc6e93ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774971410, "uuid": "ef3c0798-62db-4ea5-8737-58c84c3902a4", "comment": "Malware payload (AgentTesla)", "value": "58f2400eb1e03d66891630d4a35d9bb6334e3fcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774971410, "uuid": "d8dad2f4-a715-4c4b-9a28-2ec6aa3f3009", "comment": "Malware payload (AgentTesla)", "value": "e1fa8f37c1adcb4219124557f50af25952679f4054e9bc9fb0afc8402ac6902f3b57ffdbadd7344c3d7da62d765cbd8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774971410, "uuid": "e0413bbf-3df7-4cdf-a20b-f7887611dabc", "value": "T1CE6502114DC42FB4CFEC561890FE1A1E93E0468E9427B98AEB37BE4BBFE79041507199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774971410, "uuid": "9206f83e-31d7-4e32-bb8c-b0241885aa5b", "value": "24576:wFjyFgsppyCDcOe28SSGYop85w8qd2YCWd9FNAeP6ctLM:cden85wDUa2cM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774971410, "uuid": "02fa0ce9-2a4d-4238-aa7b-4c94da712b02", "value": 1467565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774971410, "uuid": "23416014-7b95-4dc4-9e1e-9b84722373c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774971410, "uuid": "89a6bb08-4cd0-469f-b72d-cb10def38d44", "value": "SWIFT COPY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c78c881-2d0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774967459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967459, "uuid": "69aac5e4-ab4c-438d-b480-f34be043c91c", "comment": "Malware payload (Gh0stRAT)", "value": "5ff577c8e34c2a061f7e2345b9269eea", "object_relation": "md5", "Tag": [ { "name": "bb-kgdhjc-com", "colour": "#092548", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967459, "uuid": "86586668-5edd-4d8a-ab56-00e10b157fb5", "comment": "Malware payload (Gh0stRAT)", "value": "b93836a658760e497c5add97c8a8b4675af5b35ffe56ef95b56e6aa109d32443", "object_relation": "sha256", "Tag": [ { "name": "bb-kgdhjc-com", "colour": "#092548", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967459, "uuid": "d2cd27be-f056-477d-bbe6-dd6cabb39f02", "comment": "Malware payload (Gh0stRAT)", "value": "f36e27bb4d9f1da78e5496d8aa169bd509c399db", "object_relation": "sha1", "Tag": [ { "name": "bb-kgdhjc-com", "colour": "#092548", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967459, "uuid": "57772816-544a-4f3a-aa44-4261958ea5e5", "comment": "Malware payload (Gh0stRAT)", "value": "832774c86ca0665a5704e0503d0ed9a50326d798f8ff21b62374aa34ae711a44b22a666a41b2b685b928800f8315aa0c", "object_relation": "sha3-384", "Tag": [ { "name": "bb-kgdhjc-com", "colour": "#092548", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967459, "uuid": "588f0c96-577a-440a-a84b-86307a6d5d15", "value": "T1C3173313B18E673EF06B8A3659625A51543FBA21652ECC73C6E08A4CCE1E0641DBFF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967459, "uuid": "bfd9a55b-90a5-4ed5-bdd5-989f432e6e04", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967459, "uuid": "6ca8a53e-d6ca-4c9d-a0a7-4b678ac05cb3", "value": "393216:yDUyyrCXbSog5gwvkrerTe9Ve1I/2tNt8EtQmdBDvdn8oOjblIQggliprD:2c+bS55gSkCXMI1msLJx7DvmoAhIC+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967459, "uuid": "d06a6bb1-007f-42d8-a6ac-e6a699f2f7d7", "value": 19597244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967459, "uuid": "1001f9c5-1469-44ff-900c-3ba46225737f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967459, "uuid": "3d7f5d4b-481b-47f8-9f94-f3177e037e5b", "value": "F_Exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74be7fde-2ccd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774939636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939636, "uuid": "1c9c72a8-4d5b-4c2c-ad86-5b455a22f904", "comment": "Malware payload (AgentTesla)", "value": "d5f6191bf356b65a0043200a4d73e5d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939636, "uuid": "79defce9-4810-44da-a887-00436188ccfb", "comment": "Malware payload (AgentTesla)", "value": "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939636, "uuid": "b46fe859-c0f8-446d-ad45-33aa82e80bb7", "comment": "Malware payload (AgentTesla)", "value": "6c4d4ef6f0d1418bb3656459ad5a0f8383cd9c34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939636, "uuid": "ba0f5166-4d3f-49b5-af82-60aeafd8f267", "comment": "Malware payload (AgentTesla)", "value": "25cb64fb24e904946d3a78a97b5a31a788f29ffff3f3a12523e541dfc8b99d6548ae9c3ed999ac7a0e4041ce50ada596", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939636, "uuid": "6888ecc2-b411-4e19-b13d-68d80b7638f3", "value": "T195C44116EA10A02FF493C9B0797996567C292E721280EC5BF7801F6970749ABF1F172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939636, "uuid": "2e9ba4a6-27a5-44d5-b126-591dbfc8b5a1", "value": "fb6d9f3e3fa7e91c5ff2c06684e3248f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939636, "uuid": "d7442ed0-22dd-479d-8ca1-bc5cb0223afc", "value": "12288:c+7UOXcZwNlGuZ38u5KzyNDJdmTzbprsXouDXZGOjbHvmgwT:17LGuVgzyJdmNrsXPNGI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774939636, "uuid": "cd20cb20-3bff-4f21-af65-a66f2d1b772f", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774939636, "uuid": "38182c70-056b-4186-b309-38e0e2800b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939636, "uuid": "cc9eaab5-054f-435c-96ea-cd624a635069", "value": "Pago de factura pendiente n.\u00b0 431890_____xlsm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951c1ca4-2cf9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774958588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958588, "uuid": "07137d81-66cc-4f58-b409-61f023f7e614", "comment": "Malware payload", "value": "eb1079388f7d9c0ae5cf29e95ee64973", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958588, "uuid": "5a43d32f-fddf-4caf-b3ec-3c8aa405dfdd", "comment": "Malware payload", "value": "ba2e6b8e47a17f6e8310fcbd29863f38162e047cfc1d2dd98c7e23a739a4cffb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958588, "uuid": "cc24df6a-070a-475f-bd9d-723d0170f893", "comment": "Malware payload", "value": "249f8af98e0f2bb577ef46169317cb507c520c6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958588, "uuid": "6857e89d-233d-4d45-98a8-4a8b1fdd7534", "comment": "Malware payload", "value": "9d2b99bc4395c095bf96cad0da94b0c0e13c46dd49a769c0ab4a4b1c1aa50a8403c75077cf2eb4b35904e5525c932dad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958588, "uuid": "dde61cd2-7684-4ab6-8da8-071287f12b8d", "value": "T15AF09E1FB19D2820A334002FB6BB409CBB8A59263A40CE02B242ED391B798C8754E55C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958588, "uuid": "c0663117-404f-42ac-a9c4-66fc4f8a4c4a", "value": "12:e/51651eI10/KP4QipAS/zYrnYXF9ZhsW8l6m2yXvySiQVRH:e/H6Heu0/zApObhsHqSiOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958588, "uuid": "d0d0ec8b-bda1-4eda-8ba4-c548e359cc82", "value": 501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958588, "uuid": "9580b272-e9ac-4d73-bc77-b9238384dc2b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958588, "uuid": "f82d1e6a-14c7-47e5-841b-e46e0affb38f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2290ccc5-2d0d-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1774966986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966986, "uuid": "0bfdacff-bc52-48d4-9d53-535d3ea7849b", "comment": "Malware payload (Arsink)", "value": "b2ea2d2d9c40a5a861237adaf7d4b055", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966986, "uuid": "3bb220ca-1760-459a-ad44-d29f5a72faa9", "comment": "Malware payload (Arsink)", "value": "ba71c7e507e1b0d8202447f9f86f585286b4ab01b58c7e32bb4f495381ef5004", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966986, "uuid": "ff762f0d-8233-41b3-837b-6fc3e8044e6d", "comment": "Malware payload (Arsink)", "value": "7068716c49447330facbe9df121dbcf943bfc610", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966986, "uuid": "527e2d90-c49e-4309-8de8-a3c4e33fda79", "comment": "Malware payload (Arsink)", "value": "6e01b46a179329f10d4b0f83d8f2f40acec6a082bb4d570e8c3aab5be6e1a7eefb4813ab406e9cc8f601866f6e217398", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966986, "uuid": "e0721fba-5cb7-434e-b7c6-7e6c5dba281f", "value": "T19FF30267EE284A47CABCA6F9FC5BEE3EBF05238DA09017DF051348927D615610D9D04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966986, "uuid": "70592b6d-5b0d-4d9d-bd2f-a99947bebbda", "value": "3072:e64dNgorriQCl0Hukl54YxDFUjwUR+/1NwBMAghNZV68C69/RcTT:e6IgorGQA0pqIDFSf+LhN9CK/iT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774966986, "uuid": "62f868db-5173-4367-9b19-099551e8c9d7", "value": 173019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774966986, "uuid": "c2355f4b-ba56-4779-8e8a-a2a4e4783ee9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966986, "uuid": "a6065dc4-b0a4-4de3-b4fb-9f21fdd77750", "value": "android.locker.byGdzawr.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123c85e0-2d36-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774984568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984568, "uuid": "236cc51f-5ed6-4b63-825f-4a05e255ad81", "comment": "Malware payload", "value": "b171bc6c1a136f25cfd1bb830e5a7703", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984568, "uuid": "d18863f7-4971-4a3f-be21-0b65b86e6169", "comment": "Malware payload", "value": "bb4a014385f5dd150e0a64dc96a3449e4afc9d4d4c2828a4c86a4872d858090b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984568, "uuid": "090ebbb9-9feb-4d1e-baf5-9616c8046522", "comment": "Malware payload", "value": "29dd9d912a771f918fa55bda042bacb9f9268d4b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984568, "uuid": "f8ba9104-fa2c-47a0-bde4-939a99897825", "comment": "Malware payload", "value": "32ecabfc0e290cee206da9aa55090486f43161b9779142b96afa4407818aa589dc53d98e80ff698910a992f992087b46", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984568, "uuid": "78790b0a-bfaa-4225-8d32-11506dc8d2ad", "value": "T120825B0FB8424327D4D110709A22867BD9B9947673D858EBFB904EEE1A686D1FC3325F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984568, "uuid": "b115648b-5aa6-4b8e-901d-78bee36948a6", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984568, "uuid": "9585f1fe-21a7-4c8e-8ce0-c3542de93b33", "value": "192:po6e4SCngTBv0Vv6XomcW6LUjrwwbEPBle6cPKUSffzQz7t99dDZ+W192mJxTmvw:ptI0VwYLwbEPB0cf2t9XZ+Iav8U9cSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774984568, "uuid": "b85da66e-a038-4750-a91f-67ffa00cd883", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774984568, "uuid": "429956b3-62cb-4a92-9a34-760bd649a062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984568, "uuid": "fd52226f-a68f-4b89-a0ec-525aeccd8aed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83050288-2d1d-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1774974020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774974020, "uuid": "c8e075f7-6e55-4cf9-a491-1e30e8a4cc80", "comment": "Malware payload (Arsink)", "value": "35881955976fd4edcdddd6bb7268719e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774974020, "uuid": "f8775172-ac11-4ea4-9afa-50f2518762cb", "comment": "Malware payload (Arsink)", "value": "bbb41ec382738c0ee5b94d023f023209928ca98893f146a8cfdaa608afe7b4e6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774974020, "uuid": "213ac952-a7d8-4808-8ae8-8cce2bb392b6", "comment": "Malware payload (Arsink)", "value": "937f433d793d91b43c6e6ce2320398003ef5beee", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774974020, "uuid": "65cbdd1c-3044-4b8a-af61-a444d5c4b156", "comment": "Malware payload (Arsink)", "value": "4e610c37ceeff09a5dde45531d0b61b7256cc83faf278dda4471d2d463b26f0f0dedd193b8532008307592ed374aaf3f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774974020, "uuid": "36c4e8af-1b26-4f02-9de6-d1714b1279f4", "value": "T1CAA4120C032CE8A4FDE72271EF3115669476E39A7B9150D44F7ACA993CBEB32742592C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774974020, "uuid": "f17455fd-0d1b-4556-9459-666cb720e11f", "value": "12288:4JXnxZMJXnxZjJXnxZ+JXnxZ1JXnxZrP+G/4Wq:4V0VrV2VtVDPvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774974020, "uuid": "5db90ec4-e8b8-4460-a44b-4c1e62100458", "value": 472124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774974020, "uuid": "51372ace-d7e1-4087-a070-494712c3fee2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774974020, "uuid": "20fb28e0-40c5-432c-a71a-aea322a90e9c", "value": "\u043c\u043e\u0434 \u043c\u0435\u043d\u044e_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61810e3b-2cd3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774942181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942181, "uuid": "93e0bc18-453e-4c53-90a2-f664fe866348", "comment": "Malware payload (RemcosRAT)", "value": "6f83271f21a3a6dc3f491c463e30a07d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942181, "uuid": "f68a050c-1f4f-4fbc-91b2-3bbc51983fd7", "comment": "Malware payload (RemcosRAT)", "value": "bc330757e04b4288f56c156273bf486b4f94c8665f52c4888db8fe63b9df923e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942181, "uuid": "d44e1e19-4a51-4fee-9e67-d349646f1474", "comment": "Malware payload (RemcosRAT)", "value": "864fd09dd3f83f01998c62a201ff3baf52b08708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942181, "uuid": "7707b4de-fa12-4ad2-af08-d9ed81e54988", "comment": "Malware payload (RemcosRAT)", "value": "712df7b86743d5a33b59d573a82bf4601b0f580b0d015c63562e2f37a54624417457a2a6d7bfeb25d7ef392fb32e69c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942181, "uuid": "d2a1f2fe-158a-468a-b803-0645087502f1", "value": "T19A5501843259ED02D1B65FF40931D3B443B96D896811C307CEEABEEBBD3A795640A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942181, "uuid": "8910db4c-194b-4801-b5bf-fe077a96c9d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942181, "uuid": "4a9b68e4-517a-41b3-aee1-e5793b22e5d7", "value": "24576:Y/5ScrFFG50zdrSvgiPe4GYrScLOvw9jbvifVsY3jL0MaNKtOAS:bcr250zdIgN4BrgvCKNsUDVFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774942181, "uuid": "bb6a6d46-cf94-45f1-befa-42df859fa6de", "value": 1406464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774942181, "uuid": "eb55d395-fb7b-4c89-b07f-2cec36605e27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942181, "uuid": "d1a6d62b-c5c0-4ca5-b015-7de65d373945", "value": "dwg.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95832de7-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774954723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954723, "uuid": "f3f90501-0ba6-4706-b22b-fbf1cbfa89b8", "comment": "Malware payload (Mirai)", "value": "637282f4874a363207ee689407d518b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954723, "uuid": "a7a4bbc1-f000-4814-843e-e2b1daec7dd5", "comment": "Malware payload (Mirai)", "value": "bca785f9414b03e36fd19239ef8ac56a36f5075c9275886e67f36977791af61f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954723, "uuid": "e6aefe75-11f3-4679-9634-42c74507d8e2", "comment": "Malware payload (Mirai)", "value": "bbb0e0008ae458ed8f83fb8d82f6d10dcab5f99d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954723, "uuid": "52742d96-f7c3-4e8e-9fb2-00cf38392b1e", "comment": "Malware payload (Mirai)", "value": "91777cf4e9143fd4ab4e30e5c6ec4f097b874a08b458dad0de574879b15e3c3b47378e703dcc67da3aa6d38b106213db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954723, "uuid": "cdcd7513-73f7-45a3-9bc4-dba0486158db", "value": "T171334A35B6752A1BC8D8997E26F74328B2F4168A24F8CB1B7D320E4EBF2085065172B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954723, "uuid": "5a3a275d-697d-4f9b-8675-04a629e88a9c", "value": "768:Pj72UF999I26p/d1DNwmOBG4HpX2KlNptBBYfhjCQJwO+35NTScj:P3pF1IDp/nNwTBG4HpmKl5B+fgQJa32W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954723, "uuid": "42bfb13b-a544-47d1-b81d-fe5c6104ac0a", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954723, "uuid": "676e10b8-48f7-41bd-ba16-029f1c6b0008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954723, "uuid": "4ebadfe2-0a21-49f6-8418-69115e5f9864", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ad3aa9-2d51-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774996551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774996551, "uuid": "b05c41fa-e621-4a6d-853a-ed0379aa2085", "comment": "Malware payload (Mirai)", "value": "103e6482f85da49de15b99fdac8336b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774996551, "uuid": "72890867-eb6c-4cc8-af9d-ae172971a8dc", "comment": "Malware payload (Mirai)", "value": "be0427213f7b4da4687f5878dcb9f714dffab6ebe86d3c05d9ddbc6c64fadd25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774996551, "uuid": "8eb57d1d-366c-4f18-950a-5182671ff078", "comment": "Malware payload (Mirai)", "value": "e6865b7321216256f8cb69736e147c49e54dd3a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774996551, "uuid": "38cab098-c331-4ee7-89f2-400dea88acc2", "comment": "Malware payload (Mirai)", "value": "24096dc1b5c7d8d4f79d43de31df338fc0ff926f33350de45c6d7e89d2be4383e7d856bb1e9a99c0e8281ffa80e67288", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774996551, "uuid": "1de60139-3395-436a-849a-0e81f50786d7", "value": "T1AF142A46E6418B13C4D627B9F6DF42453323976493EB7306A528AFB43F8379E4F22906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774996551, "uuid": "9ac5531a-f3d0-4eb5-95eb-288a0b29981c", "value": "3072:oWmbBEePj/UjgmPEatQ1CMs+pG0wH13D+bhkouM/RyndrnJ6AQ:oWE/U8OEatQ1CMsES13D+tpuM/RynP6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774996551, "uuid": "e959d848-9012-4b4d-86bf-05c16a5e9566", "value": 198290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774996551, "uuid": "bb0d151d-17a3-4629-9cb8-3d409298a8b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774996551, "uuid": "efb41d19-5036-4bad-a43e-efe0617eb42f", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1975999-2cbe-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774933403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933403, "uuid": "e6d2b37e-7d85-459f-8da7-133686cbabe9", "comment": "Malware payload (SalatStealer)", "value": "3d3f77534e725c764552129229da0df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933403, "uuid": "73e07436-f394-4016-a6fe-d1e031b64d6b", "comment": "Malware payload (SalatStealer)", "value": "bfcb50a7d2ab8f3b19804bdd0bc90a790228a9ac2699a1ba09b2032a32c472be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933403, "uuid": "3255f386-44b9-4732-a27f-f30c0a4d8cef", "comment": "Malware payload (SalatStealer)", "value": "e2f9461434cf0261f8fc2bb8d43591f11e9ca381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933403, "uuid": "a6452883-b8af-4e30-a717-2e4a44e6527e", "comment": "Malware payload (SalatStealer)", "value": "eab22c071a5184cd979d3e1f47da0877c746cc49337e2388e70f6ac499731d5ca3c2bf203ffd999dc24588b544277789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933403, "uuid": "7b517ce7-5c27-485c-bc8d-88eaceaa267c", "value": "T14BF5333CB08F4543F3A7E632C6A54D283A44CEB3995F75792746E82F9C46205DB4A0AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933403, "uuid": "a98540c9-f9a1-4361-9910-0d8e8569bd4d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933403, "uuid": "de80a189-6321-45f2-8439-a2ec5b444189", "value": "98304:vOi8y15rQQV1G3Odz+whyZHWctVGj/mRHLfT:v4yHJV1Y4z+wh0TG7mtLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774933403, "uuid": "712e7bf8-540a-49cd-b00c-6fbbf54e5fd3", "value": 3592704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774933403, "uuid": "899c3cf1-3db9-4da5-8119-00a1e8de6d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933403, "uuid": "8f1e598c-c40b-4a9c-b090-eef1fb00655a", "value": "GLOBAL.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe82716c-2d3b-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1774987112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987112, "uuid": "cde897c6-4dcb-45e9-af29-7fc399018682", "comment": "Malware payload (Smoke Loader)", "value": "2c5a23a7214690106fa5936695ccb73d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987112, "uuid": "e7adca14-6c05-401a-8231-8f4717f9940d", "comment": "Malware payload (Smoke Loader)", "value": "c10f5d1f24f3cd25234931ee02482e8fa94f8fa40799255a7acc5c9f634e0210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987112, "uuid": "a49b35aa-73ee-4e71-844a-04e5d7f6364b", "comment": "Malware payload (Smoke Loader)", "value": "3f02a359d9ff1ad78417da2bed12c910a433e4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987112, "uuid": "40f429b0-e810-4c2b-9fe1-b891c95f36d3", "comment": "Malware payload (Smoke Loader)", "value": "f665c27e169d92cd65d987d6f93302d02675db727186b0ebcf52c939a411eebe0268c2d73a4fe64fcb671b0ffa52bb4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987112, "uuid": "299217bd-c464-4c12-87dd-3542164263ba", "value": "T1A5E4A1EFAF24B5D0D911AAFCD4917E45D3A0BCD0BA9044AE6597FB2BCD38A438F09045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987112, "uuid": "e12aa33d-b818-4d94-9488-d3c25fd4a418", "value": "12288:iVcyEvqc+MAUG6s+pOaQhFglL5YJjZbaI:iVfEv6nUGtEOfSN5iUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774987112, "uuid": "7b9fafed-f7a6-47eb-b304-4a4dbf618c59", "value": 704280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774987112, "uuid": "2de8b225-d3b6-491a-b83f-9a58a27898ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987112, "uuid": "052101e1-d6a3-456d-bd80-4d1703a2582c", "value": "Burst.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a199d94d-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959038, "uuid": "20ea188e-287c-47aa-b5e0-c8f5a4187394", "comment": "Malware payload (Mirai)", "value": "749b9e18f71688f8167e89c0c6b3bfda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959038, "uuid": "c25c0aa9-7116-4397-9eba-d02196150b84", "comment": "Malware payload (Mirai)", "value": "c3a5e296148b2065a81c72ddf2cff9138aedfd19cf4d75db27150cf29110bd76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959038, "uuid": "2de886e5-7137-426d-a191-c3c7b6a0557a", "comment": "Malware payload (Mirai)", "value": "14776d8208eb4d2fd6d927ec3add528db64e8f5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959038, "uuid": "0163947e-4c88-4809-81ba-edecc6b60c7e", "comment": "Malware payload (Mirai)", "value": "7a05f84c0ff0843f6c18ef6c46ac1cafbb7e73fcea593ce3d46fba17f1dfed6148ebee05181b63c8068866c1184c8b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959038, "uuid": "434339c7-330b-4ca0-a158-e5d224afdb8b", "value": "T1A3332889F747DAF0CC4305B0115FFB37A936B8A12224DD77DBE0BAA37CB16425416A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959038, "uuid": "091302cf-829b-4b7f-8953-afe64c1e27f4", "value": "768:AYZ8SfvufWuq96fu8zOoevR0sRlzhJdt9QgcpOR9s0Jel/iE+nKPaO+hTvlwas:oSfvufWuq96f58X3jJelSK3+hjlwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959038, "uuid": "e0080fa0-d5ff-4ce1-bb6d-a3a06d2e0be6", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959038, "uuid": "482695b2-3998-4be3-93f4-905b6b37be7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959038, "uuid": "87064683-cabd-4361-9938-2bd26671874f", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f72a9e-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959375, "uuid": "89d95eab-eebd-4ae8-b8f8-36e1af0670a1", "comment": "Malware payload (Mirai)", "value": "433e0815bf1129c43e7b7c29ffbcf5b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959375, "uuid": "f12e52cb-567f-4c80-9e9a-7f0e5fb2bff4", "comment": "Malware payload (Mirai)", "value": "c3d381d04149d2c5f369249694174fa9f7db098739f6eba4b6c04fc15ff0a176", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959375, "uuid": "7e4616cc-4f43-4d6a-a8a5-3a53b00c756a", "comment": "Malware payload (Mirai)", "value": "58103bbbdbc78fad736f006dfef91783a0ab982c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959375, "uuid": "9d935e96-46b3-4f32-b4d0-527dbeef0985", "comment": "Malware payload (Mirai)", "value": "56f40144ac349d86cda7ae5b6482c9e7370a64ed281a86a2c3c27fce3e39bd4504133fc2365d5bd3bbc4c7527af8cf19", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959375, "uuid": "5ae68121-eb69-43f5-af03-4d504a88acf0", "value": "T10393E842BD429F13C5C221FBFBAF059D3B166B79D6EB3202D921BF9023828D70D66251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959375, "uuid": "c59dcc8c-9bf4-4942-aa76-89bdaba46e61", "value": "1536:QFV4F+8wMvh/zTjmCon3rqMGbQCiv6eQ5vkQevK4Dg8MgdxMUNEd1a:QFVSUujmCon3rql8PtckLvK4jMZ1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959375, "uuid": "40637c3f-df54-4279-8ad3-d0ad5f52b849", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959375, "uuid": "2aed2ec7-7c76-457d-ab79-b6a937e3c103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959375, "uuid": "54410ce3-783a-4b5a-b121-ead77899b371", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487b9029-2cd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774942139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942139, "uuid": "2e13ec23-7bd8-4eb5-8aed-9dde96a23117", "comment": "Malware payload", "value": "e9bc8b8c47e0658a546d8d13b0221ad9", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942139, "uuid": "6fe561fe-36e4-42de-8673-e43f28189378", "comment": "Malware payload", "value": "c472fa2c61e549dea3f6955befb62a9054fbe1eda00a474680cf6e5f5911a009", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942139, "uuid": "4427e54f-e52d-4020-b45e-39c95eb538f1", "comment": "Malware payload", "value": "ef1c6c1fe9d67e2c2eef0a9f1c52995431988af2", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942139, "uuid": "3b079433-4c26-4919-8f2f-c9b39a1c256f", "comment": "Malware payload", "value": "964067b0964c4a2756b05c3c36604410e40c2c4a57aed760b2da858656d578d8bf12651b9a7958c2b95c4d03c53849ad", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942139, "uuid": "27dc9a14-9c87-4fe0-a186-37cc61e0ea37", "value": "T16E5129041DFB01CCF27797315BECB9F74826E851992E36B81281C6445B35980E862EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942139, "uuid": "f9c3f8bb-9aff-4c7b-9839-f7830084ca76", "value": "48:8B5aCLGUrg5M0R8/rQXlfK2oY5XOdLPZFBDaI2jzP3jdJDrObVvDA+5MM3q7BRa/:8B5Fyogy0RvKXd3BuI2jzPTdJGxOCqlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774942139, "uuid": "d0d2be13-4533-494e-9b2b-9ab5d8c3cd83", "value": 2992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774942139, "uuid": "d6991a6a-1581-465a-ae59-9fa1bc120658", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942139, "uuid": "16ab8181-7dc7-4db5-8e15-ac7f17a567b7", "value": "c472fa2c61e549dea3f6955befb62a9054fbe1eda00a474680cf6e5f5911a009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f2723a-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958987, "uuid": "9e6bfa56-f528-41bd-bf6a-387e84635225", "comment": "Malware payload (Mirai)", "value": "588d407854fa17c0e892636810b75322", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958987, "uuid": "06692a26-9d29-48d9-aa1e-41c2375d704a", "comment": "Malware payload (Mirai)", "value": "c4c585dd6ef3dfb24d73300f8ab36539914c6b0f85770c4187622206352287e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958987, "uuid": "12779f18-b97a-4f55-b873-89324f753326", "comment": "Malware payload (Mirai)", "value": "f90d6496bc29d335ef94acd06915409f7b8b6b1d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958987, "uuid": "30bb23b2-689d-4171-b243-bf65b6d60797", "comment": "Malware payload (Mirai)", "value": "79c40c4e9cf184ffd998d28155e093419ab092cb262f1e01de13dcb009f487b9a4e71fcea5f67b9d05cb527d03c9e4ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958987, "uuid": "e061b88e-8f79-4ae4-a9d1-24daeb187e1e", "value": "T120B2E16C50940E09D85B40FF9AFE05E6E66184830AFECBD99F270CC3E2B78A2791D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958987, "uuid": "86c199d9-1713-4925-bba5-c99a6a171fd9", "value": "384:MniiBi3f2PSrf64K5WFSlvNjJ6mAN8bhmglJbN2EIKHT0P6+PbhDYOK6sNrheCVM:xiBiv2PSbePxNNw8dtlJwEIGT0P1Pbh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958987, "uuid": "a5ae94d0-9e75-4a01-8ce8-6d7303b27e48", "value": 23440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958987, "uuid": "094718d6-ec25-477c-bf78-1cd2309815e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958987, "uuid": "e77f9f6d-25b9-4b63-ad99-c41e1da4307c", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f658afbd-2cb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774927398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927398, "uuid": "ce882d78-206e-4b61-ab23-c2d62d25cc39", "comment": "Malware payload (Mirai)", "value": "ce47b8deb932398ef97e6112bc7de633", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927398, "uuid": "a524d6b7-8fbb-4c94-b868-0d91ef83a84c", "comment": "Malware payload (Mirai)", "value": "c4d9c7e644806fad3a83a083e3c8d487bd2788a996f0b7aa01712ff68f6dd3d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927398, "uuid": "98b3a779-3483-4c3d-940d-12f6698bdc76", "comment": "Malware payload (Mirai)", "value": "70e31bd115480ec88ad4629e3d4cae54ebb0f41e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927398, "uuid": "aa0954c9-f024-4b85-8820-61af028ce1f5", "comment": "Malware payload (Mirai)", "value": "5dc933c71a2120e65e0489543d4eb1ebd5acc69451ddc88615f26a00442b2e85467dd5e239ffcebb7a37baea9e9064df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927398, "uuid": "f885c6cd-9566-48b5-8b96-6bbf26b7e221", "value": "T159044B46EA408B13C4D32775BBAF42453323AB64D3DB73059928AFB43F8679E4D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927398, "uuid": "55a3beda-7411-4aa9-be12-36790714ce89", "value": "3072:lRu97jI4rqE9SsRTM6/JaOf0aHd3NYjZX2juOVQrmvN7BM/9+OomIjDA:Pu93I4rbSsRTMkhsaHd3NYjh26mvNdMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774927398, "uuid": "113e6e6d-bfe8-43d6-bb7e-f6458bb5370f", "value": 180740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774927398, "uuid": "fc937981-3d80-40bc-ad61-a5cff6b95453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927398, "uuid": "c99671f1-8845-4dbd-9656-ed0f95341de6", "value": "rebirth.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf76d4d-2cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774955165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955165, "uuid": "b3d81d8c-8e1b-4301-a8ee-dfa8d61cd9fc", "comment": "Malware payload (Mirai)", "value": "b7c9e65f0360b4a9315bc8708b3a43d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955165, "uuid": "15d2891d-af1d-45bc-9353-d17a367ef0a4", "comment": "Malware payload (Mirai)", "value": "c5ad3cfe1a5b9409cb54a59a5466ada8c7306ea0262829af35f1206d8530c67e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955165, "uuid": "b9f6fff6-904e-4a4e-a413-5c3421790c62", "comment": "Malware payload (Mirai)", "value": "80a946d6eb73dc0f5cece8d0868541487bbf6103", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955165, "uuid": "a4802986-8f2b-4e1d-a5ae-1bcea804c101", "comment": "Malware payload (Mirai)", "value": "9382a242a2b9a8aefa21202348f26035e1c2da73f6eb1198729efb7f0ccae2517d85db2cb9d1e5134004e766c7f44c0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955165, "uuid": "e08c927b-7456-49b3-8ceb-043a476e697a", "value": "T1735150DA01906771DB06C64D77F032F4524AE2835EDF8F45F9D8182C9EC9D8C3A99A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955165, "uuid": "ce8485c1-64fd-46cc-b09d-c1a286e10285", "value": "24:g12JMMubiBExuZvE6EnE2EhEKOYbwxwJUf/whM3S:g12JMMubiBExuZvvcvyIYbw9whM3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774955165, "uuid": "401801b0-da44-400f-b5fa-b7e8725558dd", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774955165, "uuid": "3bfdd090-74f0-46ce-baf4-33f36efde7c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955165, "uuid": "726b3b85-c005-4d88-bcf6-05053ca38350", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19adf8f-2d49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774992969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992969, "uuid": "a4a6c1a6-11ab-454b-bd3c-ec8034e99449", "comment": "Malware payload", "value": "13c272204cd47eef5c5b9c1fe4d2d6b4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992969, "uuid": "22e88527-4a5f-4557-af7e-eb20b200ed7d", "comment": "Malware payload", "value": "c5d85af3c1ff78f80283ebeff21bc44d3dd2f51baf08717f54dd7d5f2c1a8d3e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992969, "uuid": "800a0f7a-ba38-467d-8fed-b61346dbf68b", "comment": "Malware payload", "value": "12b5cf3d4943d2643ba2c34ee2b534c7352ad7fa", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774992969, "uuid": "01addd5e-8dec-4e64-bff7-8b6257e6aa1a", "comment": "Malware payload", "value": "5f7395561124ef0455cd2e275e25f7dc529091b6dd81089ece152b054ac4288e8888c801aedb96a8291cad19b92ea783", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992969, "uuid": "78081172-e20e-4142-a878-2bfe3e155b07", "value": "T1E5411A32C6479773F67BB2B52B9E04299AB188FAB4651818BA11BA4401AD1782582A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992969, "uuid": "be4544e3-7e5b-4b9e-8d60-3aa5e95e8bc1", "value": "48:JGeiOQeaESNK5/eMfL8sNY/lj10ByjPn1y7Iw+daWmt:JG4Q9ESzMT8sNYlj671pWmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774992969, "uuid": "e0273236-f05f-417c-9361-609e8a87adc8", "value": 2394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774992969, "uuid": "b9ba6fd1-287f-4e8c-84e6-0f930882b4c4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774992969, "uuid": "30281429-cbbc-4faa-bef4-48f1459808f1", "value": "TaskbarFinder.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2354e3-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959596, "uuid": "7091e991-9cd5-495f-8cfa-0240c17cc6f0", "comment": "Malware payload (Mirai)", "value": "c5f3f9cde7856d0f24f7b0ca595cbd3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959596, "uuid": "c71e69a8-24ad-4adf-ac7b-85cdf318f52c", "comment": "Malware payload (Mirai)", "value": "c5fabb7238edaf7d1f9b477a492fc8bfa1bdb6137784dca152e6187ccc4b6cdb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959596, "uuid": "2a213ea1-df31-446a-bcb1-0ed7390048ac", "comment": "Malware payload (Mirai)", "value": "b9b1e8bb9acc2f1063b878b8f299ea5b7876afdd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959596, "uuid": "cccc0eba-a07c-4a8d-a83f-0a1e2b538176", "comment": "Malware payload (Mirai)", "value": "1d0e736f66423bfef7e18e6c4b8d528e2dcd76a6df55b493a4030a4831030156f70ab3391254fdd84f79cc8157b5a890", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959596, "uuid": "be39a9ed-035c-452d-889c-474fb534a077", "value": "T1D6A328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959596, "uuid": "10ce9cf0-bc75-40b3-8854-c5be2fe34e0b", "value": "1536:71ufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAn:wbU2RC4kPCtSzWu3/3L1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959596, "uuid": "fcba2b5e-3a85-4137-bbc3-413f813cd5bd", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959596, "uuid": "3b34fbcc-67b3-4690-94e1-9dad22c441c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959596, "uuid": "872d4090-6b8a-437f-868e-8662b23bfe83", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d3b84e-2d46-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1774991741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774991741, "uuid": "f53b1c5a-1ffa-4250-aa6d-84bf562ca323", "comment": "Malware payload (DeerStealer)", "value": "566ed2b1d948f1648adc8fa29cd889f9", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774991741, "uuid": "6a1300ae-dacd-4768-8ddf-0ef8c2c5fdd9", "comment": "Malware payload (DeerStealer)", "value": "c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774991741, "uuid": "afadcb0a-397f-42fc-b639-26441acd9fc3", "comment": "Malware payload (DeerStealer)", "value": "f205139e4ddcd252e49876b3d1c044c6642a9001", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774991741, "uuid": "792661f1-7547-489d-ab35-aa2abdb398b0", "comment": "Malware payload (DeerStealer)", "value": "3ccc73b3d2fe42d89efc541c1143f20053be552df5dca492eca456c2d910b8e38659b0aa4d3878281c52be9be5b9aac3", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774991741, "uuid": "ff93d433-e0c2-4b13-8e31-844f8b764b1d", "value": "T191963335FC81993DF01724FA45871C03761EFC0123B8C6BFADA5FB19AAB66E409A251D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774991741, "uuid": "d3c437a6-3a12-4715-97b1-2c3c723e4d68", "value": "196608:PqEJJDy7uNbyvYx2M6yV2ADOb+OqcSGncI:FJmybfDPzFcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774991741, "uuid": "4c70c4a0-0749-4ba6-88f2-937357b999ef", "value": 8925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774991741, "uuid": "91ec2e00-04d9-4095-9f0c-f0d8b03007c2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774991741, "uuid": "ca3054fe-a964-40f1-b626-59b406d5a9fa", "value": "Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be3e368-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774959324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959324, "uuid": "ef5e8b4f-8dd0-4f72-ad2a-1f75f9286f80", "comment": "Malware payload (PhantomStealer)", "value": "bd26fe571ca46cba8591f815f91806f1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959324, "uuid": "173fd9dc-6c69-424f-b1eb-8369d2fda32a", "comment": "Malware payload (PhantomStealer)", "value": "c93d148643e65e890a5a65c214927c7e8278fbb176da22b408f29909a7564514", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959324, "uuid": "87a54bc0-3dbc-444e-bf6a-1ef0c99462cc", "comment": "Malware payload (PhantomStealer)", "value": "d3d7bdac793e77026828c764d421273e33ca8036", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959324, "uuid": "42dff820-292f-4d47-b8b1-e8de08471f80", "comment": "Malware payload (PhantomStealer)", "value": "f72454b5f72ce3acdb54b6e7a064d5a78429d0ef842a454cbf6f8abce5b76282bf7e5f5b269a91287912edb9c59376f0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959324, "uuid": "920bc12a-8c6f-410e-b2a7-f08c5b6e86df", "value": "T1293502118AC83FB5CFAC5A1C90BE0A1E53F04A8A541779C9EB737D47AFE7644420B2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959324, "uuid": "fb873de7-6d1f-452a-890f-382214174435", "value": "24576:2BEhQtUgmA9misOSNDtGibjinCZL/WHSOEcqYtu:amr1HUOOsOEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959324, "uuid": "6f7b5df1-b97a-42da-9478-be4ec2a1a766", "value": 1122538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959324, "uuid": "d8ba20dd-9c95-4c61-a301-2f671838b510", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959324, "uuid": "7c95cbd5-9eb4-4989-bdef-c852f411a045", "value": "DDT-REF# PO 215822-SD24T.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eca1e17-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774989286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989286, "uuid": "89f23d13-f353-45d5-90d3-800e86c5b588", "comment": "Malware payload (Mirai)", "value": "d3d76fa602f70ca6a03e48793c95d94d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989286, "uuid": "8bc87fbc-6aaa-43da-849c-a451b67f55ba", "comment": "Malware payload (Mirai)", "value": "c9beb5ed398e967c6833e6c11dafdc243c7c1593a2e74924b7ac594653dd4cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989286, "uuid": "03fb2862-a733-4ef9-b571-2b984adb8bdb", "comment": "Malware payload (Mirai)", "value": "c0e59219016ea793297bf1d7c51ea4003737820f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989286, "uuid": "086490d5-aad3-4b97-9b21-6de8148b008a", "comment": "Malware payload (Mirai)", "value": "9d7c183c1dc574b6d9bf5ebe6404c5ab2d64c2f526cd1ba3242c0d62ead0e29c25aae595976075897bb2bc1c38253c04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989286, "uuid": "4cd3f537-625f-4fcb-bcee-533bc1c53934", "value": "T1F4232A07A58580FCC56DC17846BBB93EC92775BE0239B2EA7BD4FF267889E210E1D504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989286, "uuid": "d5b3d196-1262-40e7-85a5-745418e19415", "value": "768:owLvSBiA/UTzQGNdlIwt3v+AA01W2esezgljpakgPMfAxXGnbKC8OIzJyJVm:LvSo1TzQG7lIW3v+cTYgljElU5bxoVyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989286, "uuid": "5f0ecd9a-a7ba-4e73-9b04-d4f053b62081", "value": 47008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989286, "uuid": "d85fb33a-2040-438a-a695-f910e82dbdce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989286, "uuid": "5f52d65c-6097-435f-b725-6788e1cb7837", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0364a8d1-2c9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774918830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774918830, "uuid": "963453ee-90e5-48a7-a0fc-8baf3cae238f", "comment": "Malware payload", "value": "954fb9cc5bd43feda82376beeddbcf3a", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774918830, "uuid": "e8332a80-ee7b-4600-8131-4a7c8af0dbeb", "comment": "Malware payload", "value": "c9e9abec8891d71c20d0a071163f7d9a5fda43bda0632a766167931b8124b467", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774918830, "uuid": "2a2922e2-aa5c-41dc-b270-7107d64199a3", "comment": "Malware payload", "value": "ad7d01851df97f36b57492ad0863a2b6251baddc", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774918830, "uuid": "beb87f9f-3b52-48a1-a332-d6b0d0b4310b", "comment": "Malware payload", "value": "33c7140fb555be07a4ffff25153aa6c7b593d835aa6f525fe5fe3a6843fa841b6eaafaa2733c88541ae8125610e052e8", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774918830, "uuid": "ff0f3d18-df53-493e-963a-418a9ccf7684", "value": "T177B2D0D3BDACA6C9308C995692BDDA93D2130E92D1846CDA5C5C5E24A903772BB38F14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774918830, "uuid": "a7a0bdbe-d602-4d37-ad3d-727bd36de454", "value": "768:elLFHZPmmZT9MRmwOX/02L6uT3g/V3w4f:axZPP1ORx+51T3g/V3wW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774918830, "uuid": "7b94d4e9-e479-40e5-8522-0fa3f0080d19", "value": 25374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774918830, "uuid": "3cb8fcc3-3237-4d3f-bf0b-ba0b94a16cb4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774918830, "uuid": "f60f8e56-3c02-49d8-8be0-4845c2d11f8e", "value": "nBOQ__26_Supply_C.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecf3879-2d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774976912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976912, "uuid": "65fe9717-ae56-40ea-9262-70f841309247", "comment": "Malware payload (Mirai)", "value": "f6cb5c0a8a1bdc80761c24bf5b63722b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976912, "uuid": "d8626b78-6f22-4801-b7e7-05c85b427019", "comment": "Malware payload (Mirai)", "value": "c9f1898be5497409f06688f413d277d3391ee1f4406b16a611bdcce761c04930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976912, "uuid": "193336e8-880b-4e2c-a9a8-21d4212c6a61", "comment": "Malware payload (Mirai)", "value": "47e0337be63df8007654a89c09778b00170f1852", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774976912, "uuid": "4a3a0bb5-19b2-4449-9139-896f623383ad", "comment": "Malware payload (Mirai)", "value": "d5f171963a309d31c80d67e7de4a48b14aee60f69db36331da2308d0db7968c57cd7ff5c480611c0c3c98de1b94937ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976912, "uuid": "50dc6cbe-f5ba-4bc1-b987-3fb93c5de0f0", "value": "T10A645CA29307CE5FDC5A573649DB8F3077F255A212638147E225BF2967222C0DF1AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976912, "uuid": "23c416f4-425e-4f4c-a5f2-2f1290a29573", "value": "3072:K75rmCkX4wSuW2UjVs4ryehMRZgDpBrsGqau40JKmpu2dhFZvrDoene4QXUG:bCFAUjVfaRGDpBAq0JRZjDPne47G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774976912, "uuid": "85d56cf6-0bb1-41b5-b73d-a59674be5798", "value": 332691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774976912, "uuid": "f2a868c9-ed26-43de-ad1c-3f97e56d1bcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774976912, "uuid": "d58bb0a0-d5ac-4dd4-8811-7aa8aa8f3b73", "value": "q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c95523b-2cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774934388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934388, "uuid": "2a368a40-103c-4076-a563-5d213b497ed8", "comment": "Malware payload (Mirai)", "value": "b37409ca1ef40ba162fc5f6df6f8c4f7", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934388, "uuid": "d51b7524-f2f0-4e9f-b348-e0f2c7c9b5a9", "comment": "Malware payload (Mirai)", "value": "cc56956ae61a8acd0f9260a78bc87dd223c9d6b18ef2cec4156b65a768e54a58", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934388, "uuid": "021efa2f-82b5-4b27-9448-baa83c796c95", "comment": "Malware payload (Mirai)", "value": "1e6b4de8b8f781b7022232640c08557346faee7e", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934388, "uuid": "1f1cd2cd-361c-48e5-907a-0c4da925f7d9", "comment": "Malware payload (Mirai)", "value": "bf23c1d8d443dac72e5d3b3a41f7be5abef987d0d9f6b0cc2c49c055d3ce175edc3c4ff63196a1903cdbd46e604b7c74", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934388, "uuid": "439c64ff-191e-4d9c-88b3-50e61a8a311f", "value": "T1DBC37E45F392D0B2D44707B012E7D32656B0EE7317198E06E74CBFB1AA29645F22AB3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934388, "uuid": "64627820-9ff1-413d-919d-36cc8df7e5a2", "value": "1536:gVQMqLfS6oOkLyYkg6YoBMUF310vfni5olYEEGZEApxioDCHIrKZtyIP+XEiK:gVQMqm6SL5yYoKnPl3d0oH6tyXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774934388, "uuid": "d12888b6-79cb-470c-9bbd-9beb0e74071c", "value": 124643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774934388, "uuid": "dd1a837a-261b-4e1a-9750-c7e30f5685fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934388, "uuid": "5564d1cf-8509-4787-ad72-34dbd936ad6c", "value": "bot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2900975-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774960006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960006, "uuid": "501dd4dc-690b-46c0-80d8-5640f6442a0e", "comment": "Malware payload (Mirai)", "value": "f14b5e0f62ed38d3f99254fddb5ddc29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960006, "uuid": "fa1a82bb-64d3-4d96-844d-5f0d1ca3d207", "comment": "Malware payload (Mirai)", "value": "cce305489bce68551e227bb9daa62af6f648c068b7b30d73fc51e251b7c020b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960006, "uuid": "547dcabe-806c-4717-8554-5b70cc2d8db9", "comment": "Malware payload (Mirai)", "value": "5d3375381240ef2223d131ab2554440f5f8ac112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960006, "uuid": "d5f38311-32e9-45ad-b664-998ab5c190d6", "comment": "Malware payload (Mirai)", "value": "a5ee10b4e0c0f941c244d06874799c6c1299473408c5cb3a01e08682dfe1b14b21decc2f433152108714d862a4cd4897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960006, "uuid": "d29d0dd6-90e9-4ace-b1ea-ccedab2e5705", "value": "T1ED532851B8818A23C6D0237AFA6E45CD372163E8E2DF721B9D215F2077C682F0DA7E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960006, "uuid": "2d4ea32d-8782-46ec-92c8-79f11a44a158", "value": "1536:DLabaJKAQlI1W9PvxJC+U3lH/Sscint56k5Z2T6:DLajUVfgYb6eZ2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960006, "uuid": "3f94a351-c32a-498d-aa17-a2f7a1071a6e", "value": 66632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960006, "uuid": "f81b0ac1-97eb-4080-87b0-56809539325f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960006, "uuid": "9d5aa02c-b90a-4b8a-a624-c552494cd8e7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1da6c5-2cd0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774940855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940855, "uuid": "9aea0253-30d7-4d14-b294-c6f54260f046", "comment": "Malware payload", "value": "5a42760428716e1c41c2b3edbe8ee253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940855, "uuid": "f6df1d7a-90c4-454e-83e8-5971f87dd9a1", "comment": "Malware payload", "value": "ccebfc4aeae8aff956f2d08499dbfa1a7dabab363bdfa232d1894be670706928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940855, "uuid": "0162c400-59e1-47c8-86e2-450d798fba05", "comment": "Malware payload", "value": "f405b3231311a6b4730d33b729fa013208117d56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940855, "uuid": "9455e451-3f56-44e2-be7a-4c91e06c4e8a", "comment": "Malware payload", "value": "33e888ef57536a74e1b85b16c5150be28c5d96c426e37433e54cf7a9e9f79f463faa5a8be067fb29c492ab63f5072b12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940855, "uuid": "bd61cc59-8b51-43ec-a274-7b31bea3e4be", "value": "T148F6331058EE7E0AE80916F07B2C3809347C74E5DD03509BFEA17646BD98BCA25F77A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940855, "uuid": "7ee33453-a0aa-4fe6-8e7e-ee1e1623cfa4", "value": "393216:fexhpix35enPePN89VZC1VlooNo1qFuF1yfxhjnL:fe0tcnPeUKvbNo1q4yffLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774940855, "uuid": "4d734c84-8968-4a7b-9e03-3cdfe6472dcf", "value": 16671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774940855, "uuid": "f08a5032-0284-443d-9a32-48482a8c60e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940855, "uuid": "364a427f-3f93-43e4-b34d-a36dfb0fbb99", "value": "ccebfc4aeae8aff956f2d08499dbfa1a7dabab363bdfa232d1894be670706928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3814f0a0-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959291, "uuid": "fd6f0c07-8083-4b75-a7fc-35b90f7e1b59", "comment": "Malware payload (Mirai)", "value": "de7396947636837f81a31cfe1eafaa39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959291, "uuid": "55be0313-dc8d-4926-bb34-016fd3debaa3", "comment": "Malware payload (Mirai)", "value": "ccf1a20c45731e3cf2b8ceb544735a854411e3fc8c388ed86c9f1a5ceb0bcca2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959291, "uuid": "019886de-ae0c-438e-b4ef-74d4cdd45013", "comment": "Malware payload (Mirai)", "value": "8b2c645eb506ef0d7c91cfd160bc7aec65dd531a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959291, "uuid": "f4070854-1f00-4358-8061-b9fe530ed01c", "comment": "Malware payload (Mirai)", "value": "c7943257f844f6f98f36c7bbb3aef92666f56f63b13d713898d0e738bfd366aacfda2fbfd1ba9841e8262fa46132f712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959291, "uuid": "40c09440-5318-41ff-8aae-0baeb43a9aac", "value": "T1BE73F907B88589FDC046C134177FB93ED926B1EE523CF2E76BD4AB12284AE614E0DD58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959291, "uuid": "c4ac0577-f60f-4c56-a6f0-8340c9d72ffc", "value": "1536:29xoI2IMJFKHF57MgxHP+0B1XuzXeoKzkDRnyEpSMNTyB/Elu4rY+F:IolDJFKHF57zxHP7bXubeoGsnSOTyB/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959291, "uuid": "b7495852-fea5-4c48-aff4-b9f4d16d7591", "value": 75008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959291, "uuid": "fc035438-4d49-408b-a398-868367fab4ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959291, "uuid": "f3b5279e-b140-4108-adb8-0976d566feab", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db3e990-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959408, "uuid": "386659a4-fc79-4f8b-b661-d72cd3dfd9f1", "comment": "Malware payload (Mirai)", "value": "289e4a99d7a22168085eceaba05ae3a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959408, "uuid": "a8c4751e-493d-4319-8ac9-4a8af48307d0", "comment": "Malware payload (Mirai)", "value": "ccf7ad6cc52d0f0622bbe8132f9dc2dd359273f555fc01e16a9a5a1b38e16da7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959408, "uuid": "d1d9f75a-cf4b-47eb-8c20-407a8bb9dbbe", "comment": "Malware payload (Mirai)", "value": "17737f52fb667eeca8f936003acceeb4bca5bb4b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959408, "uuid": "ff706513-2547-4f57-9142-c2f035b6a7ad", "comment": "Malware payload (Mirai)", "value": "1b7f5782ee5c25d53d231bb04e29196f9a06d8d05aaaf0740d59916622e84149eeb9e543ec27dc83a7c801018f6c5168", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959408, "uuid": "5b0f9433-8ba7-4cac-b449-9dae9fb88c2d", "value": "T1B9730981BA43DEF3E81711F502B7DB365A32FD3A083AC5C6E364FCA16A515C1A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959408, "uuid": "0f59a41e-b961-42f9-8f1d-dc729324b6dc", "value": "1536:RcK8MffyU5RL+r9RS3TlU0f/wEBOVkVgu3Urpbr5ag1416mEv6+8p:RcHCfyU5MuTlU0nw/Ygu3Spbr4q4HDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959408, "uuid": "3ab9c86f-7e2a-4b5e-af1f-954902ccfddb", "value": 75560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959408, "uuid": "b0a82b94-b275-4ebe-b40f-2fb4357d9d32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959408, "uuid": "bdbdad18-84e2-4d29-893f-175d55b4744f", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc68389-2cd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774942146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942146, "uuid": "156870a6-7d14-4727-86ae-832760405fa9", "comment": "Malware payload", "value": "63d626aabc1676888531e002ed918c96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942146, "uuid": "70cbe580-a90f-4190-a98a-7d554f70ba56", "comment": "Malware payload", "value": "cd821bff185eee57b0be1b9c3257287a7d3b6084fdb13123eb4fc349527b9e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942146, "uuid": "a8dce8e6-9753-441d-8deb-5ea70f3b7b91", "comment": "Malware payload", "value": "c2cc842e4ddc33206af261bf7e216e1d280ed664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774942146, "uuid": "0c266748-f1b6-44b7-8625-2b827d928f25", "comment": "Malware payload", "value": "ad50c35fb018f230bf3ae45366e224ed715b4c5b320dfd35f7e0a41b78cb01e7eaf6f87d5879e982e3c9ccfdc41863a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942146, "uuid": "4fbc9af6-1788-42ee-a108-fded7c3cf5bc", "value": "T14CD292017BF84628F6FF4B355EBA2510497BBC9A6E31C64E098240CE0D75B90DEA5B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942146, "uuid": "d9807d23-e754-4ac0-95e1-ec47f75c4607", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942146, "uuid": "a0ac0e0a-783f-4dda-abe0-459f05e925ee", "value": "384:Y5rtgtKxSPw1sSZDrW9u36oedobByfVrc8/fDYsD8Nx5xAeJjhYKd:NStWkUrtDYsD87AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774942146, "uuid": "fa1556a7-688e-4b06-97f5-44d8d84c6a11", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774942146, "uuid": "c691a64a-780b-4402-a28d-e13e6a7317d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774942146, "uuid": "fe03bdf8-7185-4e85-bdc9-78c483b4bfd3", "value": "cd821bff185eee57b0be1b9c3257287a7d3b6084fdb13123eb4fc349527b9e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2b8a02-2cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774960323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960323, "uuid": "00821a75-094f-4ec9-be1d-1895c3458ffb", "comment": "Malware payload (Stealc)", "value": "3a2df7ed9392d4eebb7a170d9b4e4591", "object_relation": "md5", "Tag": [ { "name": "5-10-217-60", "colour": "#46D719", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960323, "uuid": "3394bfe6-93a0-4aee-9a5a-f01a0360dccf", "comment": "Malware payload (Stealc)", "value": "cdb373dede5ca06fa8ef4c4db2a62b3bcb71945db31597c983f4d151f9b148be", "object_relation": "sha256", "Tag": [ { "name": "5-10-217-60", "colour": "#46D719", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960323, "uuid": "a5e0b51b-1ac1-4fd5-8284-6fc6adfdec85", "comment": "Malware payload (Stealc)", "value": "3b2727bffc3ef86af89d2a834fae9c36b720b83a", "object_relation": "sha1", "Tag": [ { "name": "5-10-217-60", "colour": "#46D719", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960323, "uuid": "aafd6585-84ba-446d-b95a-0205d0e9b93b", "comment": "Malware payload (Stealc)", "value": "829e77f90770073ea09ccb059120dc824b0308fa3837fb01ba611e3998a2a2a871041b7f2ce418b1f04f23e23e38b194", "object_relation": "sha3-384", "Tag": [ { "name": "5-10-217-60", "colour": "#46D719", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960323, "uuid": "7182d2e1-7fa3-46a3-a189-12a9b995709d", "value": "T196957C1A7C90087AC4A9533588E755D37BB6F8590B3223C72E4CAB393F77AE05836764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960323, "uuid": "a8482778-bd98-48af-9572-81b950cfd98a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960323, "uuid": "294a1010-e8e5-49b6-a278-b9b4c055691b", "value": "24576:fxQgwQ0qIn/GVe4lEiOMSJ01Usrwhm4YvJIOftuO81QBYqG6WcRLSNq:fxWQ0FwlJ4wUvm3zIKYOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960323, "uuid": "2131746e-a1dd-49c7-b504-3c28530a4e38", "value": 1966728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960323, "uuid": "1969ba35-69de-41ae-b3d0-2d5f04677608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960323, "uuid": "8b8aa0bc-240e-4a2b-8633-d96b70fe2b85", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47fc945-2d3e-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774988303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988303, "uuid": "d3f93abe-2d64-4a72-95e9-1aa8a470ece7", "comment": "Malware payload (NetSupport)", "value": "75919229f4ec647c86d67057b273e6ca", "object_relation": "md5", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988303, "uuid": "cd35ff63-4566-4584-ba18-da74633d33d4", "comment": "Malware payload (NetSupport)", "value": "ce000e83cdf7ee21e9eb2ec81ff65b6d6b553ae8d22251e8a46c9319c84fe801", "object_relation": "sha256", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988303, "uuid": "63fd5bce-befc-45f9-bb91-5c0813e01a60", "comment": "Malware payload (NetSupport)", "value": "2b03f6711b1ac28c3fb21417b9dcc81ac2e3ea52", "object_relation": "sha1", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774988303, "uuid": "57ba4b7b-83de-4bb1-b9f4-f02afa2842cf", "comment": "Malware payload (NetSupport)", "value": "121a54c48798689d85e612bf1ebcdc2c15a39a9a46f67c72b5e092cf2f35f967be83d5a8a3e8a4e9f9650538fac2e5fa", "object_relation": "sha3-384", "Tag": [ { "name": "151-240-151-158", "colour": "#FB0803", "exportable": true, "hide_tag": false }, { "name": "193-24-211-242", "colour": "#35AFEB", "exportable": true, "hide_tag": false }, { "name": "moskuiopa-com", "colour": "#BBE913", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "qerovantvcvba-net", "colour": "#E9954D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774988303, "uuid": "78edcc04-f5aa-4b6e-bf32-9cc0d83d947a", "value": "T11B967CB88B84975EAE6E1A07E078571E67F37F26D09271FC5A62370B266FC081639C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774988303, "uuid": "6eb5cffb-8e54-44f4-ad70-ad2b4a0a1d07", "value": "49152:72+yw7k1IvGaA1UzZtUUQEoxzhmYIDO7HP4in0RFblMKkp1max1:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774988303, "uuid": "c6c19be9-a089-4404-aff0-0feb71098c05", "value": 9411103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774988303, "uuid": "7aaa4d35-71b0-4222-87d2-f96be81e99a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774988303, "uuid": "a892a056-ea0a-44af-8604-59b4170dfd26", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff3dbce-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959573, "uuid": "b89704e9-bfa1-4f07-8bd2-39f93f14e89d", "comment": "Malware payload (Mirai)", "value": "cfe905c5b37cd3fcf0c18ef94ed1ae3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959573, "uuid": "d97d206c-4e7e-47df-afc8-a85fec773cec", "comment": "Malware payload (Mirai)", "value": "cecaed0ffe519c83d77655e1c2f3409fa795fc97917fe9a258f2473b1f84788d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959573, "uuid": "42f26db9-223d-4c30-9388-c16d3ad78c60", "comment": "Malware payload (Mirai)", "value": "fe046390241e80cf0ac1103caf440c96b0a544f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959573, "uuid": "3d5d55f1-0540-477f-91d0-7dd59ae87f91", "comment": "Malware payload (Mirai)", "value": "1ef89d39315eb6e7d3a2b7e19cee20dfbc031507e43cb54612e19f8bda2d7b7b42254b6a6b30539b20d3e5fa83d389b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959573, "uuid": "0ce8b22e-9ee6-41a7-94f8-66865eca8d54", "value": "T180C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959573, "uuid": "e032e378-4709-49b8-9eda-bce5bff53b5c", "value": "3072:gf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU48qe:gf0tJBR4NSALD7rnCrheiDqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959573, "uuid": "93c591e2-6a32-4a29-a560-6c302b6afbee", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959573, "uuid": "a37cb4b1-cf7b-4818-b340-67fe646bbd74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959573, "uuid": "3f7d6436-7503-49d7-abc4-967768765948", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06132e61-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959207, "uuid": "14b1a53b-c82d-4f59-afc7-8146f95f9c38", "comment": "Malware payload (Mirai)", "value": "160d0a15d530fc906c4cf874f0a1e677", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959207, "uuid": "ccb88789-5192-4b1d-8dcf-659244d08ce2", "comment": "Malware payload (Mirai)", "value": "cf4a7efd5a9eef3fa50ba1463aa7ffef36548c11486c76b43b90a83ae304d29d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959207, "uuid": "e135636c-cd4a-4036-9af1-848679c9efc7", "comment": "Malware payload (Mirai)", "value": "7a65931f4c69e89adfc3590e99c110ec39c95249", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959207, "uuid": "7da80596-094b-4066-a701-45271a8b962a", "comment": "Malware payload (Mirai)", "value": "5e587e7857419423b2b48a0642b9c6493fabf3707c6bc843c7c6f6f21b7b2db2ed657aec232fa3838db758cb7421a558", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959207, "uuid": "8209df4f-b09d-49aa-8124-18a59f1dd148", "value": "T1A8D2D02CEDA95889CD786CBF8D090766CD1120C0316D4BEAB301CC59FB6B98E7559DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959207, "uuid": "8ffd1728-d700-464d-ae0a-29c0e3da11ec", "value": "768:8IzUjM8UgTFbCgNjNJG/KUy+g/gJ14Wd+:1Uj8gTVT+lLF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959207, "uuid": "3ee95a26-c33a-4d01-83c2-26ca82c68cb3", "value": 28592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959207, "uuid": "abec68a7-04ea-417c-98e1-4983e8dc8f24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959207, "uuid": "762e5999-e516-4832-b8de-2d2a0c2fcc2b", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc58211b-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959191, "uuid": "bf6f9290-2fda-4a8b-ae04-2af6a7298790", "comment": "Malware payload (Mirai)", "value": "4d210b6a01762b8bdd55ab5153825c29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959191, "uuid": "81df42ff-9454-4642-a12f-8485b401ed41", "comment": "Malware payload (Mirai)", "value": "d04a50371f6a9b25d19475bc8455997d2a2ce339534373439ebe04220df3eecc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959191, "uuid": "2bb536eb-1024-4a83-a0d2-921a68eff6d2", "comment": "Malware payload (Mirai)", "value": "dfde0e5e0efe2dda7f60d032cb220fea0adf6764", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959191, "uuid": "6c28d4b6-2f3c-4c60-b167-677f400fa290", "comment": "Malware payload (Mirai)", "value": "42545b23b6d185fbc82b07fe217f927e71a5046a884a4b41143eb0f41f2d4c7260951fe50b8278cc07ec740c0413b83a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959191, "uuid": "b1d82ea6-d5b4-4a5b-9b70-1fc9e480b550", "value": "T1F6D2E132422ADC77CA609ABADF6499C52B4D277DE5F97434001141D1F6ED6C22AFE8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959191, "uuid": "91dbc512-3225-40de-a377-bb96559427fe", "value": "768:WAX6nz/BKOdwVYec1UMk7SvzOXDt/iubW2QpPDAJqoDp9q3UEL5f:HXQ/BKOc35eviXDt/iuCPhwDcLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959191, "uuid": "89095988-034d-4b46-89e4-5211de82c4dc", "value": 30440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959191, "uuid": "2ead23d6-7bdb-4b1b-b40c-983f11d8ec84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959191, "uuid": "b770eb46-4633-4e17-aa9a-36e523bf4ad5", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb5a4f1-2d14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774970170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774970170, "uuid": "82d7d98d-ce94-4f76-a33e-f82a31870318", "comment": "Malware payload (Mirai)", "value": "fe5bb84ab18659996938b1e8f8897023", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774970170, "uuid": "5050d49a-e787-42b1-a62d-56022ab2bb26", "comment": "Malware payload (Mirai)", "value": "d07587127b553dfcb94fb20cca4f1830debe619a735759359a2bf4f96aad406b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774970170, "uuid": "3d22ce08-fb71-48c3-97af-f0660ed88181", "comment": "Malware payload (Mirai)", "value": "2485aa6925db0206fd9b48157b2f8739fea7e31b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774970170, "uuid": "84381ece-2bbe-4551-81a1-446302088503", "comment": "Malware payload (Mirai)", "value": "c99a88b75aa878e8c4332853d597bf4c90b934e6ab20f011c91908855f95c79e54acf70424845d9c9df295d10b0f725d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774970170, "uuid": "cc7991c3-c120-4b64-ba0d-fd00702f39df", "value": "T13C4423D9D84BB3D8B939AB3A584C0349D3610B10435DFA37281E19B955ADBEE1F18B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774970170, "uuid": "42ad4f30-1b5a-4900-83b2-30bef6e23a2f", "value": "6144:VSoE6VZzHWWmm1dsbHFz2IY/AmzIW0uPcUAeqqrprYNirdto8Cy:9vVZz+m1deHFC3Lziu0UAXTirLoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774970170, "uuid": "fe8e873c-62d2-47c4-8e05-499a6fb14d3e", "value": 272052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774970170, "uuid": "ca38f376-5c23-4913-a1bd-d65b013f6340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774970170, "uuid": "2bfdbdee-1a15-4789-b40c-51b00eac8ad4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce26faee-2cbd-11f1-a769-42010a9c0008", "comment": "Malware payload (LaplasClipper)", "timestamp": 1774932914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932914, "uuid": "5eba5bba-7e72-4b64-ae4b-81117f87fddb", "comment": "Malware payload (LaplasClipper)", "value": "15943aa6b04386a67db8dccf4097c682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932914, "uuid": "2f6ef322-ed73-4a90-a886-41286b0569ee", "comment": "Malware payload (LaplasClipper)", "value": "d10544dac98f47873ec5235c504878ce64b8a0f3f5a2416e44ebe03a448ef4b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932914, "uuid": "1739d1c1-ae08-4625-bce7-6aba3ffa3317", "comment": "Malware payload (LaplasClipper)", "value": "cb598732bf85bc70539cc0061647764a7c3abcf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932914, "uuid": "3d1219e9-d8bd-488d-ba28-762fb9aed1a6", "comment": "Malware payload (LaplasClipper)", "value": "37c487bf9644925abccb694472b40c38a584a810e5c383f3e93d5a558405af361a8cbd40fb4574f05e4fa2ba7ba6e0f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932914, "uuid": "d7d0a6b1-af02-4f63-9483-326fe64c6039", "value": "T1EBF6332879F3D0C5E69AD9703D9AD135188B9DE08925C82F3AC95D5F7EF8080884DBBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932914, "uuid": "dd1609f5-7c3c-4a72-9dec-1de91717a75a", "value": "4eb67848fdc216af3b9f0d91f224f79c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932914, "uuid": "ada98038-0229-4928-981d-d36ee7821933", "value": "196608:9NZ28BX3a2ztDlgDkLzh4WyAI79uxcq9lN/PmFV01SbLa5TlpZzpmf17Y9Yfzt/j:9NZrjtLzhBJxB97mFDO5XFmS+zlOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774932914, "uuid": "857da7a8-8110-44fe-9a75-5c1348258084", "value": 15728640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774932914, "uuid": "d73ea586-a36f-432d-9e0d-80a2a82faac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932914, "uuid": "468b5511-5558-45ec-8d91-e117524e165d", "value": "15943aa6b04386a67db8dccf4097c682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406c332e-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958875, "uuid": "da8e35e9-1435-45ad-8460-b62956a0e66f", "comment": "Malware payload (Mirai)", "value": "fdf08fb4b17ebf560facec38f83708a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958875, "uuid": "5c5aaa3c-97bc-4a3f-8f13-61d289172c7e", "comment": "Malware payload (Mirai)", "value": "d164a1b10d1f32f97f6c56aa0756ec0e86867beefdda0ebc0e74fa62f3049480", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958875, "uuid": "19612f75-1ddd-4bf6-9172-8766b6c44a48", "comment": "Malware payload (Mirai)", "value": "ab4c65dc25a266efd4a96f6ef75d035a459eafc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958875, "uuid": "4efc6c49-2807-4ca4-b42a-ef7f0f13ea6a", "comment": "Malware payload (Mirai)", "value": "1e71275cea46bb3c4a24e7cfaf4408cc5b01b378dfdbee12e6c4ed90bcafb0b999f631670d6f010c13780485bb4e9d13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958875, "uuid": "e66fd087-d48a-474a-8b51-9f754d4f8631", "value": "T1B7639E25E00A9DA0C08A4634A0E5CE380F23BDC596531EBA9EC545F65847DFCF619FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958875, "uuid": "e94dc897-ccc5-4f0f-9b51-129cd4996c6d", "value": "1536:Hawl1p2qQAbjwt2RykHJ/ixY/NMB8WNb4/jhCpO:Hdp2qQAX/Hw0W2/jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958875, "uuid": "711c24dd-cd1e-48dc-bab5-84ffe5e8a172", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958875, "uuid": "d1c7a83e-01c3-4807-99ce-6c38745761b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958875, "uuid": "d1c6ef08-d6b6-4908-a831-4a07ee60c447", "value": "jade.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af17f97d-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959920, "uuid": "973ffb9c-39f7-4bbc-9145-63c58d89aebe", "comment": "Malware payload (Mirai)", "value": "dbd15fa2c771215643412ab00afb3072", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959920, "uuid": "3c121c57-d6af-4dc7-aebc-377bf954186b", "comment": "Malware payload (Mirai)", "value": "d1ac51a061ac1939fe10cbca294221d4842a2541b9656c5ef933744b16e8bfff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959920, "uuid": "f7871386-aba4-43f8-8727-ac4310163ecf", "comment": "Malware payload (Mirai)", "value": "cf44071979fcc65b065f622f6cfeaa1f83c63b2a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959920, "uuid": "82acde89-528f-44f1-91fd-d0eb4ec40627", "comment": "Malware payload (Mirai)", "value": "d13472d3c7841f422982e13adcc0c51d47c8eaadd91531cc7b0b89748d7b1ed3b8016ff5b7130d0282a6a5c51f45b438", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959920, "uuid": "cff14089-0238-49ea-8fb4-6c5714daf0ae", "value": "T1B633F1BAD5C3B833D670A438F50DD4D8CA4E1EFAE57F40B252849A9C4ECA60175AD2D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959920, "uuid": "605712fe-dde4-4a56-8213-09f74a990673", "value": "768:ywsVxywLC+dmEEGJZacVEii+sjr3aVzVRjZQX6SFM9q3UELudwl8KL0hoI+TZJ+I:yw5WuGHacW1+2sVdZQjL8wKeo+eI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959920, "uuid": "e6c37c9e-52dd-4f4b-9b43-5f15f5bd6678", "value": 51988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959920, "uuid": "f4389dfe-ffbb-4e7b-aa58-c084520ec7a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959920, "uuid": "f691fdef-14f7-4aba-b0d1-2af7a4af96dc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ab4f33-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959582, "uuid": "5cc166d8-2e3e-4646-881d-6f56e9cf8915", "comment": "Malware payload (Mirai)", "value": "fc00f4cc694aa606563c17c4aea10c63", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959582, "uuid": "07294ad9-69a9-4751-8afc-59aa3c08e15c", "comment": "Malware payload (Mirai)", "value": "d24964dbf3bdd5ad822bcd66f4207275c238cb940eff4628dad7c6559648bd22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959582, "uuid": "56cf59a5-d582-4b56-b108-1e929f78551e", "comment": "Malware payload (Mirai)", "value": "d766e1a946980423039dbc02b2429cc4af74504b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959582, "uuid": "460836c5-7660-45f5-b82f-7521ce293c20", "comment": "Malware payload (Mirai)", "value": "d8652234b8613b5035033b60f63235e900a22ea7c01cae3acf95ff0aaa9851e24e990e8e8e15dec83d7c417f9a7f6261", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959582, "uuid": "598a11a2-9f9f-4c89-9fc7-bf26d8326d4b", "value": "T180333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959582, "uuid": "68a90923-f339-46de-99dc-f99477d5b104", "value": "768:twzbCo1eCZWUJ2SSpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98TN+s:twdt3SpOzwLMU431ANA0BLBCXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959582, "uuid": "c014aa88-be50-4445-b846-d4b1021dde8e", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959582, "uuid": "08316313-95a2-4d82-86ff-dbb2abe35a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959582, "uuid": "a1eb0fb8-5005-4ccd-8a30-c79e0b628acf", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49acf399-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928826, "uuid": "1878726d-c591-44e5-a7b3-26ee74dca890", "comment": "Malware payload (Mirai)", "value": "e0d700214b3cb4fd07b87cc1994417a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928826, "uuid": "62105fa7-6dc6-4ecd-8f4b-fcc35ff2e343", "comment": "Malware payload (Mirai)", "value": "d2976d64150f9e675361c333c75810bafebe861571dc7afef99dffef12c5ca92", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928826, "uuid": "56141409-92b7-4037-be3f-fc79fb3cbef1", "comment": "Malware payload (Mirai)", "value": "0bd39674297c6d4612957e11ba4014638b2f454c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928826, "uuid": "723f8790-aac7-4dce-89d8-dc3bfa32f7ed", "comment": "Malware payload (Mirai)", "value": "605912611147af567989f0ea6f5e085333cf939bb1f5bceb5514b9d39c5e9228211701bf96fac8d151c2b0deffed1d56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928826, "uuid": "a1513d24-18c7-4719-993e-cacd344d2e23", "value": "T1E74302D0177527CC5371D87539ED305F8228292E72962D102EE7818AF85A62398B7DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928826, "uuid": "2d8e9123-4271-4dd2-bbce-739f83182f09", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvx:8D+CAXFYQChaAUk5ljnQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928826, "uuid": "7c244ab3-23d0-45d2-8e63-acd2185ee851", "value": 59396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928826, "uuid": "2e33b25e-48b8-4064-8f2e-235e7fe09a3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928826, "uuid": "c5d78458-874e-435c-acc0-3a8699458e4d", "value": "mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfb1e2c-2cef-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774954065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954065, "uuid": "5816649e-2841-4ca3-b414-07fe6c091cb5", "comment": "Malware payload (AgentTesla)", "value": "224714103ad06b44eee1e581a8542c13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954065, "uuid": "377690e9-57cb-4e98-906c-13d04bca1f1a", "comment": "Malware payload (AgentTesla)", "value": "d2d8a8caab7b31d6c38b9442cfa6e1619f7b9d348693be1ef0ce5999a12ad580", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954065, "uuid": "e19547f9-db01-4798-936f-7a28a5af5ff1", "comment": "Malware payload (AgentTesla)", "value": "92d9f6da717684a074784a422788fb7608e1066e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954065, "uuid": "dc8d2801-2f18-4711-a677-df3d9c060b78", "comment": "Malware payload (AgentTesla)", "value": "53f019e42b8974a15f64b54c831a864be26f7289f617f0d75e11bcac8b212393f8b399d2d5330ff296ac08ce71906efc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954065, "uuid": "744b619a-e1be-44bb-89b2-ac17efe9ce61", "value": "T16B6502168EC43FB4CFAC661D50FE150EA3E04ECA505AA58AE733FD06FFA760452175A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954065, "uuid": "786f18ca-8a64-499b-b033-624c0ef10dee", "value": "24576:jfVQxpqnGAKXMeOgwSPU4W+wJhp/OhvhcN9IPIkzdL/T:2fqGvWRIPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954065, "uuid": "09cebd84-1dc1-4f76-b09d-d7e55aeedd44", "value": 1424560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954065, "uuid": "144b2860-7b0c-4724-a94a-bb38040b8993", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954065, "uuid": "13b9145c-c6ed-43fc-bd9c-773efea57ac6", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f8d4b7-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959227, "uuid": "ad375cc0-0d02-4f34-b86c-d0c0247d3470", "comment": "Malware payload (Mirai)", "value": "1553574b7ccbcd54f05b88c1518190bb", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959227, "uuid": "b2f7021e-6ce1-43f4-8055-b1c45ff69ba7", "comment": "Malware payload (Mirai)", "value": "d3f9064327fa42deac47114ade57446f32b9b356681be33d7b003e16d9cf4204", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959227, "uuid": "e3cd51f1-7ad5-46b5-a82a-bff19b923c8a", "comment": "Malware payload (Mirai)", "value": "c74e75507dbfa00d4df20cf87ee596c7b29a353b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959227, "uuid": "64fcf428-b4a5-414f-8aa4-ace15587ac7c", "comment": "Malware payload (Mirai)", "value": "a099ad105c6ffaa4bd8ca0cc47664dcecbc83b47a3a8ad4847269aaca3ec3afef855a37b1df39d3b758bfba38d2d63d3", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959227, "uuid": "12c93174-f78f-4091-8f6f-d48f64bed81b", "value": "T187B32B0BB25144BCC185D071D1AFB037D935B4E51A21DAFF3AACFAB52E42F886D05B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959227, "uuid": "56eee487-2e15-4996-8c33-ffb0ca9b403f", "value": "1536:4cr6axz9CYWgUm7tIM826Fb6o6PgwN6xweK9qFlUMhYJ8j:4qHlRUm7pBUD6YgqjUfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959227, "uuid": "ad157977-b56d-4d84-b848-1dc8cc4e999e", "value": 116632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959227, "uuid": "9ee61660-73e6-48b4-9e0f-20ca17ba843b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959227, "uuid": "cb25dc99-cace-4dd6-951c-94f64b0c521a", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224fab95-2d11-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1774968703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968703, "uuid": "2b1c4e10-e76e-4698-90c3-4bb0eaa56d8c", "comment": "Malware payload (Arsink)", "value": "7fe97e0310e2dbb29b7311fdfb5d3625", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968703, "uuid": "dd873760-93c8-4ecb-bea7-438bad7c8147", "comment": "Malware payload (Arsink)", "value": "d41a27ee5d4b12f6c94e73cc453c69b20ff92ce29823b0ff5bcc50c0d61f826e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968703, "uuid": "36614d7b-3906-4563-a063-ea38e23ba13f", "comment": "Malware payload (Arsink)", "value": "7805cc849328753a9d7d027a22d0e9676a825f14", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968703, "uuid": "4189b143-8401-4723-8b65-062158d8c392", "comment": "Malware payload (Arsink)", "value": "af23eaf2035494821f1f3bea8eb12c50777b16a664a629239db325b7b092caae88367cb99871bc6364a1b3a0ccbdd7cb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968703, "uuid": "826cee27-d0df-4868-8d46-26a819a4f401", "value": "T1BBC312658F2CA43DEA3FE534565B5B9B7F719FDEA48815A7080054900CF27B22C0B29B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968703, "uuid": "51d19206-df79-4e24-99ac-c918ab5877bb", "value": "3072:xHAJZB5jS+jkATF1ncX/2XWJK647IgmSoaG5VQjOpNyEi:d2ZBs+jkucX+G/43mhqCpNyEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774968703, "uuid": "049bf702-9088-4c82-a1f3-a2766455d83b", "value": 119568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774968703, "uuid": "b598bdf9-1979-4c3c-9dfd-c5184d59da47", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968703, "uuid": "f2261915-3eb1-45f4-8a22-ea12b7052189", "value": "Free.Money.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c12f641-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959405, "uuid": "e1ffbe64-e82a-4112-9d45-c845626012e3", "comment": "Malware payload (Mirai)", "value": "ea5e78667922bbe457c520664352f63f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959405, "uuid": "201499f3-8804-4259-8f71-41220ac0a781", "comment": "Malware payload (Mirai)", "value": "d49fddaa3a223aae52716aa3a1f88f1e53d470fd9591447270578382ff070f62", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959405, "uuid": "cd280bcf-ec1c-411a-9bf4-3c7ad06b1b09", "comment": "Malware payload (Mirai)", "value": "1f356142c41dd2e4f77fea4a786f071b541b7b2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959405, "uuid": "f46e8582-d74d-4890-ad83-8237ea88d9b1", "comment": "Malware payload (Mirai)", "value": "6682610466790f4ac26981174c19732ce2f5f2aa43a6e7880f8f8ae94a7aadcf04548d1e8af8af08b3864e2ec07a746f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959405, "uuid": "dc86821a-83d6-4a78-81bc-30d06917b0f8", "value": "T1079329227E760F27C4C2A8F652F30B30B5B2AB5B28B8854A7D715DC96F246C032577B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959405, "uuid": "2d7b1a6d-374f-4769-ac7a-c570f64f912e", "value": "1536:5S8MSzlPyzhCJuWsZIJfQlSYJRDRtDogENWq52YMAdhctrr:5S0A2jWSodpxENlyjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959405, "uuid": "d952d10a-fbe0-43a8-84ea-1ed928e93679", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959405, "uuid": "1f97c9c9-f2a8-429a-a3be-864d60f38884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959405, "uuid": "06ccb9aa-5685-4933-a7c1-dbe15292aa65", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc6d1b5-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959193, "uuid": "b3b83eee-d91f-432d-a656-c61bb761559c", "comment": "Malware payload (Mirai)", "value": "0cf8ec8d5af0972b66ad9abdd276e22a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959193, "uuid": "4cfd3f13-8407-48b9-abfa-b91f75b814fd", "comment": "Malware payload (Mirai)", "value": "d619e3024f32eddf2054b7198d8820d5d2dd5c12d27920150317d13f75ee3c4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959193, "uuid": "0985af26-c422-47ed-8170-44ef0150473e", "comment": "Malware payload (Mirai)", "value": "e138a872f12d68826d757eac4a92366adc3f937f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959193, "uuid": "ff375e8f-9f91-44a3-a288-d4b48251c490", "comment": "Malware payload (Mirai)", "value": "4a33b0747f72e02bc845d11c0c5a0eb0ae52197419c2ae679b7e4b1edf7aa21cad7f75b60116a569e0d80e110ea88fd8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959193, "uuid": "cbe725ce-073b-4b3f-84d0-584f53a71928", "value": "T1F523F1F0C174AC61FC81EC3ECE644C4725252A7CE1BBB0623B619F38AD9A060177E64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959193, "uuid": "a8c6755f-8f6e-462b-8a30-cc966200bb22", "value": "1536:OVz6m1gETHxaSpV0WAgcNw/yiHLhxQXsVaD:GPgETP/7JLhxQwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959193, "uuid": "5e173d40-5920-41a3-a89d-deda8e626852", "value": 50060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959193, "uuid": "92731964-825b-461a-8be9-4625a6685cb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959193, "uuid": "c59af995-30ad-4244-a221-32e6853cfc88", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dd27dd-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774989271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989271, "uuid": "af4f679e-6fb1-467c-a0b6-31b437cedf04", "comment": "Malware payload (Mirai)", "value": "46692396b005ff407a1cef0e41d6adb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989271, "uuid": "ae688ac5-1b39-423f-9ddc-1246b3b36ab7", "comment": "Malware payload (Mirai)", "value": "d66c95602d1fc469ef09fb33d2c48294f54732c36af91088161e8773ed8daf7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989271, "uuid": "b099ed98-f23f-4b08-84c2-15863c57fb66", "comment": "Malware payload (Mirai)", "value": "bbbab238e67c74c401cef2001c0ae5305f631fe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989271, "uuid": "74e8ba99-de5e-4bda-9cad-3dd417b9d47b", "comment": "Malware payload (Mirai)", "value": "cf149b4b65c6bed4a227308d7ffc6fa0b6a1f14c571ce9346e5799c7348c08df8dd230b27c16e58ff0002c8d7a0b3be7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989271, "uuid": "844ee7e6-8621-4735-9feb-14c37c397a54", "value": "T17553A4197F610FB7EC6FDC3749A92B0525CD650A22A93B397D34D828F70B61B09E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989271, "uuid": "3d27bf18-b85e-4577-be8a-9e460b56ec1d", "value": "768:8CfAhntqMS0p/nddYlnv9GygQLI+2eBONJnjX4a58Veven/emHxAgT5Xi3UgmN8N:8CfAhsM/g97TO7XzQCe/JRAkgmyjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989271, "uuid": "a000ad7c-ba0a-4b7e-8dce-7262255d6543", "value": 61528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989271, "uuid": "9870fe4a-5b52-4ca6-9f37-e830171a73b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989271, "uuid": "3831c78b-b80d-4a05-9b37-544d7a1d485a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6966ce-2cb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774929400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929400, "uuid": "a6fd3e37-ca15-48b6-90b8-c5755fe03c2d", "comment": "Malware payload (Mirai)", "value": "a4ce2fbb491b3f9f6baa2b6a96967dc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929400, "uuid": "c317c3ff-b260-4629-9ec9-edc0f0b5b521", "comment": "Malware payload (Mirai)", "value": "d675a732e91a71e192c49e0e7a91ab83dc9a91f5aa734da2b4e999d39a8fa0e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929400, "uuid": "3beea651-adb2-4229-9fc0-590cf4852898", "comment": "Malware payload (Mirai)", "value": "17f54e70da46df88ef46b33ea21cdf4ec030aa06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774929400, "uuid": "6cba07d0-5f06-4ffa-afc5-81462b8f8601", "comment": "Malware payload (Mirai)", "value": "8fb58dc7fc4ca2a79c6caf13902883aa5a39dc6674faf9fcb5e0b1da0b3a5c940465171dea3a0f8d6c0a1b59d935f1c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929400, "uuid": "23ba332f-31cb-40b0-bd17-ba880c0fc9bf", "value": "T126464845BB2C0923D6530DF0993E43D5F3263B4382B1A22B6B0F67473179A36A6D7789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929400, "uuid": "3dc06bed-ef83-4a45-8e50-df430faa21a3", "value": "98304:o/3k+pgSj410N9NVvcNeAkd5l09azEAx1eyAcYCxtayltoYCdBvdu7wUUWZhQdke:N0NV2Cb3UaeuygDrOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774929400, "uuid": "29a1847d-b6f2-418e-80b6-b9ceed1ceb3e", "value": 5530764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774929400, "uuid": "a2dbe365-81ba-45e4-abd2-554b7a163924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774929400, "uuid": "8b0e6753-6dcc-4841-8fb5-b3381a074462", "value": "wlan.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be54ebec-2ca3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774921720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774921720, "uuid": "a841cf25-c6aa-4899-96d6-80ef5118847d", "comment": "Malware payload", "value": "aca47d7d203113058dbe108b6f0ee2ce", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774921720, "uuid": "a5f5ac5d-6a39-4895-804e-4f9891e0f5b0", "comment": "Malware payload", "value": "d67e62bb3ebf9f27dfb8fbd20f88748bb898f5a70265b386a64cb92fafefe0d5", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774921720, "uuid": "e5efc6ed-4578-46d0-bede-afc6c59c2d82", "comment": "Malware payload", "value": "858174e1dd4bb6168e8dff48cbc82117d84180d8", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774921720, "uuid": "b0d0a9d5-ea26-416a-97de-96d94cda0dd9", "comment": "Malware payload", "value": "34fa7dec7ff581da947d2fade08a4b75003268b9061ac575a5322a2366ed506cbf8234f9fc5629c914ad783a8fc0dd98", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774921720, "uuid": "7776239a-61de-4e15-98d9-94ae21536a5f", "value": "T1DF540253827684A8EE624370D5AE2E86B8DAC4B34AC560B73639CDC63F5DD71F9140F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774921720, "uuid": "a5ea228b-34a2-408f-ad0e-9fddb0141003", "value": "6144:v0Sd0Uf/uYnDs5IRMxDEDPTHHDsd6UpYICZl:v0SyUuSs5txcPTDnUpYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774921720, "uuid": "cea4d672-db67-4166-9bf9-4893e61fde49", "value": 293217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774921720, "uuid": "5c65d807-c4c9-4221-b570-2a910161ea5d", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774921720, "uuid": "862b8756-73d4-4dec-a3cb-223e3470a8ae", "value": "virud.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a9bb3d-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954485, "uuid": "5f15360d-6c50-4124-849d-71595d125db3", "comment": "Malware payload", "value": "30bbe08eb1138b93f956134e5cf78fc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954485, "uuid": "0c85480c-0501-44ef-891a-31cea82f4ad4", "comment": "Malware payload", "value": "d75a8efd9ab6ce7f5e6fd25b6deab80cfcebef959ef45e639ce0f3090a838096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954485, "uuid": "8c7cfcd3-624d-4a2e-9696-8a429c068b6f", "comment": "Malware payload", "value": "75818bdb22810104505b7c178b820005fba5b1c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954485, "uuid": "c13ffc40-f355-44b4-b098-ecebce1fecad", "comment": "Malware payload", "value": "6564ddc3813817f732f56cf06662284b1d717e277bd1f9977a9db8a0ba0818cbe0ee830c20530f3c6e0db8830d2c97d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954485, "uuid": "c9ffaee2-d48b-49ec-9f8c-e3fdc8d5c3e0", "value": "T1B2844B0283FA550DF5F34F98AB3A44605E73BE5A2E39D46D16A8240D1AF3A148CB57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954485, "uuid": "236564fd-7888-4fd2-8247-fdd990d9b2ff", "value": "6144:lE0Mjx65qvxE7APv7JqI55MlvoQBUshigOlLiU3RxE+K6IwEps5p+E8rzg6K5llJ:lE0Mjxwqvi7WJ5WvoyUssiCe76oXrsJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954485, "uuid": "3236e6f7-a6cc-4939-8ab5-68c12736846d", "value": 382648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954485, "uuid": "2f04ec8e-e068-4c04-b084-5039da233e2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954485, "uuid": "c811cdbd-03f3-4998-b1b6-64d08535c44c", "value": "Quotation 16266-V3, 81978.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6d072b-2cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774934392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934392, "uuid": "ef1dfe6e-1a80-4e33-84f0-5a8b535b5f02", "comment": "Malware payload (Mirai)", "value": "aa60f016caaa7a3ef64c1d561963b304", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934392, "uuid": "d2374027-563e-4563-92df-a274e09505bf", "comment": "Malware payload (Mirai)", "value": "d76b1b0f9045dafaef132350a8ee36fa7ea66d430952f5832b888cae73778f93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934392, "uuid": "95a29a13-a0b3-4beb-b005-919f9328a6f0", "comment": "Malware payload (Mirai)", "value": "1456297744731e0be0e783a5f22b565adbf6b926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934392, "uuid": "3f5cfb09-e43b-47ef-9bf8-02219f1acd8f", "comment": "Malware payload (Mirai)", "value": "9dc668b74a8e6385a7de3c9a46cd20a599a7d7f528ede0c06f69913fe924ea676b90735ec1f1e4ea7d91fa94416c7340", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934392, "uuid": "f1ee9bea-0a8d-4729-b128-751d80ac7e61", "value": "T10C044B42A742C6F3D5C31BF212A747210573E43A2F2FDA05E37DACB49A19588F61A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934392, "uuid": "ecb2501d-bf55-4228-8c94-96f10896d6f0", "value": "3072:zuJG6/GDBzcG0fUXR59RTowRxJKLIVHuV1szCGqISJZHoEyU1taI5ZUa:zuJGRlzbr9oAxJpHdqISJZHoEyU1taIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774934392, "uuid": "642110a0-3704-4cec-b0e3-870056b0ebfe", "value": 188966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774934392, "uuid": "8c880dc7-a1ce-43fe-a19a-aba7da84def8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934392, "uuid": "b1cbffdc-5cd5-4ab7-b245-c1615d5e9986", "value": "bot.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25284a3d-2d1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774973003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973003, "uuid": "f8955b88-e498-43ed-9c22-4bfcdb59bfe7", "comment": "Malware payload", "value": "d6cce7e3a4bf64dcfa7d48a55530d4b4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973003, "uuid": "f147789c-f269-4bab-9e81-59d001086899", "comment": "Malware payload", "value": "d778ecb3738036fe02b0cc768417d7f4101d2c22111ae3c4cddc6489802b2d4b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973003, "uuid": "f84b1fbe-8b3e-427e-831c-9be0b9ea3ffe", "comment": "Malware payload", "value": "bb10c74d333bcbd56fcbfc8e6da7ab6c574e759e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774973003, "uuid": "c78b0d36-5e4a-4cdd-aa0f-dd504ce6e971", "comment": "Malware payload", "value": "0f437749067e65eb8e9987bf5ded14dab6672107eec26b2e3008f1f3e366797b50dac2783910ac11a1b6d33ec5956fa2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973003, "uuid": "16d9d2fd-668e-47de-bff7-39b3c4fdb6f7", "value": "T12D94236BFE52D683F12679BC5104AC42519A662DFDF4A07F0C0822A7DEFADD84F4294C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973003, "uuid": "219e52a9-945a-4b37-bd01-66f6276657b3", "value": "12288:Cu523X/T4MHn1Bn/wdcvFRD7ecL1tMsS+:CuYDHT4q7D7B1o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774973003, "uuid": "2c6f4b33-c849-42be-b41f-9e398c2c3f7e", "value": 431618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774973003, "uuid": "0a1701b3-f0c9-4043-80d4-659975bebc46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774973003, "uuid": "8b52fdb2-7eea-44bd-8f2f-3309c4dbc3d1", "value": "password. qq (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f310471-2cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1774934419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934419, "uuid": "62c7a445-86da-4e04-86fe-c648c6a23c60", "comment": "Malware payload (Amadey)", "value": "70a0a04fecf9557078155616e13544f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934419, "uuid": "2150bc2c-acee-4905-8178-64754e24613e", "comment": "Malware payload (Amadey)", "value": "d77bc0bb3018b6cc834c1af1eefaa1c0b906314308d6ab88588f8d41eb62090c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934419, "uuid": "95f785b4-51f4-42ad-93a5-7fde6c0e834c", "comment": "Malware payload (Amadey)", "value": "a005dbb1871e019e6cf3d80a1aada9f35dbd8ddb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934419, "uuid": "614ff5eb-6888-4bcd-b922-d111a063bb7d", "comment": "Malware payload (Amadey)", "value": "d2156ed4f3a7aba8368db960d37d56eed8a521524affd011f236a235aa2c5242f7fc2401d22afe9385a0e07c5a9a118a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934419, "uuid": "b9240e66-ae1d-4a3b-95cf-e852dbe9a704", "value": "T149A002221851076D4B1DA194EB74D5918A20048049E369B67A8067CF6EF1DB4D754826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934419, "uuid": "3411350d-669e-460b-989f-46d7018a2ac1", "value": "3:VSJJFIGFhPPF8L8VDv7AEyOGUn:s8GFhPw8xjzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774934419, "uuid": "3d73d2ec-931e-4476-a508-9fddb8a1b9f6", "value": 61, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774934419, "uuid": "d645fcc1-e8c2-4f4a-891a-9ced0e279927", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934419, "uuid": "504e51ac-87ce-4cb6-b2c0-386467bcdb01", "value": "cmd.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde425b7-2cdc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774946255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774946255, "uuid": "788e3795-7a46-4b18-b849-929c6309d1ce", "comment": "Malware payload", "value": "5e037b0ed6ffce4133937bece56d52bc", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774946255, "uuid": "3e2d96f1-af93-4de8-b1fa-1bcf4910f4c7", "comment": "Malware payload", "value": "d7ec72f2a254222a970caa80a7d78b6576b54e1c500a69d00b30451ee17575a1", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774946255, "uuid": "ed0fdbd1-4f54-4c0a-b122-ed18205e2911", "comment": "Malware payload", "value": "57f0bf581e6fa3bef923212194dc186cb5adaec1", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774946255, "uuid": "a1a2f417-bcb9-4206-8fc2-537ad1996301", "comment": "Malware payload", "value": "66aa8105d3f434daab181931bed105d16333dab1cef43df93f892639810692ab13a84af81db48eaff79acd477510a3c4", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774946255, "uuid": "91b39594-182b-45ef-a06f-6efabc394ac9", "value": "T148A15040BFD0E2DD33670B3F653EC485E36D896F18D045AAA302DCA27950066FDA1EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774946255, "uuid": "eaf180c5-db61-4a31-b580-d0ebe5867fef", "value": "96:MYyOgl72RPb3SoaWA5ZYTU79YqTPZWrIs5izr8qS7utbfSRRkVCtVnf7gaENn3SK:0OOSFLSoaWAb0UdcRvVnzgaENniIRfq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774946255, "uuid": "067d7750-4adb-478a-a11b-5828fc2813be", "value": 5050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774946255, "uuid": "d14c1de4-c03c-4b84-879b-66451c6421f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774946255, "uuid": "061fd915-38c0-4553-be8b-bea0bb69b129", "value": "pixel.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f497adeb-2cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774960466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960466, "uuid": "6b9ac5c9-0374-432c-931d-1c0e5fc4cd7f", "comment": "Malware payload (ACRStealer)", "value": "2bae03ff250ae5532953059085ed8823", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960466, "uuid": "cd2757b4-447f-4e1d-b38e-da78ca6a609b", "comment": "Malware payload (ACRStealer)", "value": "d8c6f60822368cbd500da3661e15c598a873c2f1f201efd4ea9c5efd9952a99e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960466, "uuid": "bc9571e2-ce69-48a6-8d90-ad8c06dc5467", "comment": "Malware payload (ACRStealer)", "value": "1c8f8167cfae476976522f164b8da1e5c4af8067", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960466, "uuid": "da078428-4c6b-4cbc-b432-274887c0073c", "comment": "Malware payload (ACRStealer)", "value": "7a56cb2704d1967a8440d7a9ebbd36773fa6840b9c308dcf9445108c42e09ee607400828064de59ef138efcd0b6667b2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960466, "uuid": "48dada15-2a25-4163-af80-ab75d8d0b197", "value": "T13806AF32F506B025EDF214F393FA0AB619655C587B2AE0D364D57CD482728E326FD28E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960466, "uuid": "36403136-a540-47dd-b59a-60ef9ee09379", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960466, "uuid": "e1533cdc-f23d-44e0-ab8e-0c538d6c5351", "value": "49152:KGWShKAK51yVYuFhM+IQXT7IeWyHPDMZnlPqnkcDib/B3QmXWwx/wsLj6+Ey:K0Q51GxhiehH7MZcniemXDBwsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960466, "uuid": "dfc8cc35-08b3-492d-b093-c1f45d889f44", "value": 3706880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960466, "uuid": "274c6067-35c7-46ca-b633-7ab0119453d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960466, "uuid": "de625b93-19ec-4976-99d1-3bad000abad4", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5c6515-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774959083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959083, "uuid": "5423ff70-b9c2-442a-8487-8f2e188a0e5a", "comment": "Malware payload (QuasarRAT)", "value": "8bfc169a02c9f443d92d8420a49316a5", "object_relation": "md5", "Tag": [ { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959083, "uuid": "a9bb01dc-c54b-43a2-8f03-2c3702ce5963", "comment": "Malware payload (QuasarRAT)", "value": "d93f7cb5d7e03bdc168bcf05ca7e1fdeb46f6c9d56c1b7508912db0e4ac0f45f", "object_relation": "sha256", "Tag": [ { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959083, "uuid": "699bb1c1-dd75-4dd9-adaf-64d2cb17677f", "comment": "Malware payload (QuasarRAT)", "value": "7fe90575b66b1ffd0a2a2b43edbde5932ea65a79", "object_relation": "sha1", "Tag": [ { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959083, "uuid": "ceb3c10f-be5a-4eb7-9072-277c146f8884", "comment": "Malware payload (QuasarRAT)", "value": "6a183304dde674391028ea79e32fab48987ee25426111f819bcf54cb68328f908bf392a7de59aa12d2ee8f3892dd5ea4", "object_relation": "sha3-384", "Tag": [ { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959083, "uuid": "de1658db-838d-4a44-b861-99a468b1a0da", "value": "T19452782C09BDFA5993D9E307E699F7236D461CAFD2B975172AF38C68A0024C045EB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959083, "uuid": "cce23ab9-3cc8-4c64-a763-288e01ba500b", "value": "384:CVyn2ZF5Rf2uFumGFkUzFlP57ALTQGJrNO6JTQoYQgd9NcjrG13egTnFSWsu9d3D:CVwIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959083, "uuid": "0cfdbd1c-7f9d-4478-99da-20cc519aa01a", "value": 14090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959083, "uuid": "a58f22b2-df21-47a9-8ff1-73b87bc0523f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959083, "uuid": "c7fcfc28-4231-4db2-a57c-0e8136f3e7a5", "value": "d93f7cb5d7e03bdc168bcf05ca7e1fdeb46f6c9d56c1b7508912db0e4ac0f45f.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b37d1a-2ce3-11f1-a769-42010a9c0008", "comment": "Malware payload (ISLOnlineRMM)", "timestamp": 1774948972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774948972, "uuid": "7608bd34-fdc6-4d6e-a9fb-d45037d9623a", "comment": "Malware payload (ISLOnlineRMM)", "value": "d7eae571fc82ddc15a63a121d0f22e49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISLOnlineRMM", "colour": "#27DDAD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774948972, "uuid": "12a933c7-b042-4efa-9bbc-1831fcd22b72", "comment": "Malware payload (ISLOnlineRMM)", "value": "da422cf46b3092b4c7dc91ba70b9b49aa0d3693ce54740dbf70710e61b1d4b61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISLOnlineRMM", "colour": "#27DDAD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774948972, "uuid": "e0bc754f-16a6-4099-8c37-10bf07b7e197", "comment": "Malware payload (ISLOnlineRMM)", "value": "7bfbb6f12765c9e1d1c4b4fb813d3161822bf1d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISLOnlineRMM", "colour": "#27DDAD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774948972, "uuid": "8f8fc2c2-3a11-4fd3-bf7b-01738538ce7e", "comment": "Malware payload (ISLOnlineRMM)", "value": "9573fa80b62b43abba49bd43fbf1c1e98d1e8ea2d2bdb9ca16a69beeb21733ec8152fb52273342ba17a660048ad54b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISLOnlineRMM", "colour": "#27DDAD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774948972, "uuid": "3df16fee-b8b3-484b-b727-78297bf2f4b3", "value": "T1F4E41243D35AE4B7D82A1F788546AB658237DC693660D812E7E8FD7FF5F02C008961A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774948972, "uuid": "7ac49ebb-1d29-4282-809d-6aa8e01f36b7", "value": "64734cdb1c07748bf4a02729548341af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774948972, "uuid": "2a0b8d42-ce64-44b6-b0f2-e27eac4554a2", "value": "12288:8twi5cGAt3do9ZswEluF1Zf4TijST+696IRY5VwCKrivDgvt2dMXM/E47G:8luh3y9pZZomSeYY50uvskxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774948972, "uuid": "1534151f-f0b2-4268-a134-5667284dfbc0", "value": 692760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774948972, "uuid": "0aa04254-7058-415f-9d37-6d37622204b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774948972, "uuid": "cff827db-db91-43ce-916a-a78f7ed0d94e", "value": "IRS-Doc-1758 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df9c38d-2ccf-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1774940430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940430, "uuid": "c0dff2d3-cc50-461f-9dca-4361f86a9d82", "comment": "Malware payload (AdaptixC2)", "value": "217e86944372006f89b405b33d905884", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940430, "uuid": "e983f3c0-edb5-40f2-bd50-2f8ac31b20f7", "comment": "Malware payload (AdaptixC2)", "value": "dafc1cc5d39bc303562d8587b698b6351e843b77c01764efa8b423a36b88fa6d", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940430, "uuid": "34651eab-6e38-489d-94fc-c440cec2a550", "comment": "Malware payload (AdaptixC2)", "value": "5317e94e1e0363d44316f4b49fd68106db5bcb4b", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774940430, "uuid": "bc6a9e51-e93f-448d-95da-6ff271f21073", "comment": "Malware payload (AdaptixC2)", "value": "7f193090eb0acbc89fccc897fdf591523c59716e3f1562877119f1aca3ec0ef8b768779e715b6cd0fab7834b38ac91d2", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "Telnyx", "colour": "#FC1B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940430, "uuid": "c89c1ccb-1b9d-4925-a76d-f6bc705d00e6", "value": "T15F933136D7B3C4ADC0AED638AB43A4B3B8F07C5D4534751A4781A6123B5BD386BBE184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940430, "uuid": "0da882e5-715a-43a3-8b10-19c6d6fcb874", "value": "1536:eIFq6WWTlqcoRZM2yHxSsUWFUy/29kJSw0o0A2VPoDEanE+6Uh/W6RISC33B9cYD:7T8spf26NI7R2NREn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774940430, "uuid": "06a12fa7-0f7e-4483-8e36-150382ab8044", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774940430, "uuid": "c96690a0-eff1-4b78-849d-cc3b8a957eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774940430, "uuid": "a48ab230-6b0a-4956-9229-807c8dddd6ad", "value": "dafc1cc5d39bc303562d8587b698b6351e843b77c01764efa8b423a36b88fa6d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821efe03-2cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774960274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960274, "uuid": "d337ee2b-724a-4edc-9ed5-f7e472d09c5d", "comment": "Malware payload (LummaStealer)", "value": "cae8010d0b700369559ca150d58e78d3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-2308", "colour": "#52EDC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960274, "uuid": "61901632-fec6-4a0d-9dd9-f560329daa55", "comment": "Malware payload (LummaStealer)", "value": "dba2651eaf67a21427fe4648b5e9dfec6eb34b947e680b7eb2b8ad41310ce246", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-2308", "colour": "#52EDC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960274, "uuid": "a005bcac-dfdf-43f6-8f3c-ab98ceb3c4ed", "comment": "Malware payload (LummaStealer)", "value": "0d5f7ec2f0fe0fef995f1a7dbc694e991ca7a135", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-2308", "colour": "#52EDC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960274, "uuid": "2987eab8-f4cd-4464-b1ab-1c6518dfe428", "comment": "Malware payload (LummaStealer)", "value": "fa44b43c0539e8400402f7632b18aaf9e8b0058df63ca12aaa5c7ede595e89710b3020f077953070f54a7261f7f5c34b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-2308", "colour": "#52EDC6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960274, "uuid": "dcc688e5-ba70-4427-a350-a34ced921b23", "value": "T1FD07331FFE97421304890ACED5A0425DFD911CE7BBBDC843CABEE1A50B51892E65F398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960274, "uuid": "4517c9bd-2fe6-43ed-9da6-73b96a430e61", "value": "393216:giai/pJDud87jOuuMu7AQ73/hkyV4+E8Xf7ssWllqVPhX:z/7vnOPMu7/73/h5V4KXf7ssWlMxhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960274, "uuid": "b642f103-1f76-43a2-a074-b99e663ab4dd", "value": 17044723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960274, "uuid": "69a939aa-cfb5-43c6-90e2-11be2b5f6ed2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960274, "uuid": "503c6f00-7e15-4dfe-aa50-4f2562159d76", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db4707c-2cc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1774935383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935383, "uuid": "3acea3b9-262e-43fc-ab74-39b601f31058", "comment": "Malware payload (Kimsuky)", "value": "471faa43f4811a0250648d586cb3eebf", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935383, "uuid": "6b845077-a565-4604-b023-ec52acf6d42e", "comment": "Malware payload (Kimsuky)", "value": "dbabe32a48e1aaeaaa761ec09c8bc59e82decf13361e392a8d9b7c4f82d58cd9", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935383, "uuid": "d04a96de-91d5-489f-9f15-4197cf2086cb", "comment": "Malware payload (Kimsuky)", "value": "1527e74b89c59e6f19f2f082a49098fdee94f329", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935383, "uuid": "37c08b2f-8807-4c23-b4f1-de87c5b78106", "comment": "Malware payload (Kimsuky)", "value": "0fca5a10a8bfc6a8478529ede147a09c27b23c4fbb1c5da3401c67e1dc81b108be2da1674c13953467eaf110d8c333f6", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935383, "uuid": "8fd0883c-126a-4e9a-b405-752e05a8d1b9", "value": "T1BA51F114B35AC681C056C7BBCEE97D1BA135048FBD105A3880EB5E4CF9B553EC8E61DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935383, "uuid": "d09706b0-72b2-47b9-ae67-1a5a33f8564e", "value": "48:s7Bkj7BFBJtBazgI7wA9tc/9EDM9VqWxMT4b+i/se+iNnLF3bXckMTE7pWd3HmXJ:s7+j7j3tiTsA9tc/9DVqWx+4bJ/seJh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774935383, "uuid": "a3cf58fa-1cbe-45e1-9de5-e500523e7dcf", "value": 3002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774935383, "uuid": "1b35d5a5-728a-4bca-9e91-6168b0e600aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935383, "uuid": "6fcabe67-0f22-43ae-b909-c217f814e478", "value": "bpvme.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b61844-2d0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774966260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966260, "uuid": "a1ba10fe-4dfa-4db7-b1fe-79e0c81352b2", "comment": "Malware payload", "value": "8d0824773fc23c74f5b7340b9c558fc2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socketusercontent-com", "colour": "#BAB244", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966260, "uuid": "d550b4a9-bc6c-4fb4-b2a3-bd3a1825d6ca", "comment": "Malware payload", "value": "dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socketusercontent-com", "colour": "#BAB244", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966260, "uuid": "9697a287-6e16-4a71-8a13-5d9d5fde7048", "comment": "Malware payload", "value": "24a8425476dcf8106ff86e5a5dbdfe56767c3f83", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socketusercontent-com", "colour": "#BAB244", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966260, "uuid": "6bee0bfb-e16e-4bbc-8b3b-26774d829853", "comment": "Malware payload", "value": "84eec841bef3ca56bc67141732f6c29e85430848e3f07d32c45676da2fd6ed3064e03d001cd53bc2b238029dbfaa5bb6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socketusercontent-com", "colour": "#BAB244", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966260, "uuid": "29ec3cdb-fc78-4b05-87d5-6afde37c309c", "value": "T10E064B8375E1E87383CB44D1F42A4442F3749A0D689D90A0F6D8EDEA64DD8CAE137B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966260, "uuid": "12efcee5-d881-4888-9c35-182d84741f00", "value": "98304:HEXA3h2dabIz9xzYVroLf9zGQolISBWJRDOsm9JCkaXsPQ8dsuDdCkLsJU0wo6Bh:gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774966260, "uuid": "1b5ef900-a305-4632-bd93-4cecfbfa6a04", "value": 3735207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774966260, "uuid": "d5a34e60-492e-4539-ba95-1ae9b0b477ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966260, "uuid": "306bf05f-1c8e-4f1d-afc7-34cf280c79e8", "value": "dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5af2f5b-2d27-11f1-a769-42010a9c0008", "comment": "Malware payload (VENON)", "timestamp": 1774978453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978453, "uuid": "9b336f1c-1a7d-4fc8-b1ac-2689ae46f3e9", "comment": "Malware payload (VENON)", "value": "f5a0faf233a32b9af424e6c12cad1588", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978453, "uuid": "4c49f22e-fb55-4d29-a0ce-de3508acca18", "comment": "Malware payload (VENON)", "value": "dc7c8f5cb67148876617f387df095dcea8598726fe5599cc1d3bab18932d372d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978453, "uuid": "18b0719a-bc18-46c5-9ac6-febd851af429", "comment": "Malware payload (VENON)", "value": "43da340f3501b4ba664417d0ea2b8455280bbf68", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774978453, "uuid": "7400a08e-0917-47f4-9bef-173cbde62de3", "comment": "Malware payload (VENON)", "value": "b75e85195b91f602d6f064fc6131b96440c1fae2c4411eef56d1421b9c1b57c6022c6a76517c138362e71f63323b592e", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978453, "uuid": "d915c9f9-17e7-4535-9800-81925c3a824b", "value": "T183A68E02AB8654E8C1AAC470CB4B8A636F2134DF07B5F6BF61C515962F79BF07A2C345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978453, "uuid": "b2137974-a024-49f0-aa9e-bc228bde7144", "value": "4aceb040a1b535976549387ede600ab6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978453, "uuid": "d787aabe-fc01-4d50-bf63-e78cccc19d30", "value": "98304:mkbTzb3U7Vud/gdBV/lHtQ16Yurb85TkEhU84+hUFn6fdGuqnwn+npXFK:T3k4ITNw6IzU84AA6FG3nWmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774978453, "uuid": "15c422fe-dd42-45f5-9d74-c99b45e979d4", "value": 9785856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774978453, "uuid": "e530ca70-de2b-4dd9-b133-a89e8f3ec413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774978453, "uuid": "f813459a-f467-4cf9-8e89-cf23dd541ae5", "value": "dc7c8f5cb67148876617f387df095dcea8598726fe5599cc1d3bab18932d372d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0026c12f-2d13-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774969505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969505, "uuid": "73d1b07d-1e9a-4736-91c2-e9efcd77f31d", "comment": "Malware payload (QuasarRAT)", "value": "7fb41c64fa990211795fef2a32dd7836", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969505, "uuid": "e0ec0e3a-bdd8-4dce-b566-25dcc6f62600", "comment": "Malware payload (QuasarRAT)", "value": "dc807e98a912e76bb17b82f71b21ae50375f3575316ba3751e733f1f35d537b3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969505, "uuid": "3ebeadfd-e398-4573-b228-23e580e8ac4c", "comment": "Malware payload (QuasarRAT)", "value": "b20e89407800cf275cfe4bd4fb85cfe423fab9a4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969505, "uuid": "61e7d7c9-575c-4c82-9225-478fce7ea134", "comment": "Malware payload (QuasarRAT)", "value": "d399a8ba98b2166e7839e3d4f762adbe73ecc6d07f0d83775cf228aeef38f921dfc4c38336584ebc1a73579da19ab37f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969505, "uuid": "7c8b78cd-4cf5-48d1-a95c-09115fbd5352", "value": "T10545121A3D22FD5D75340243FA112E843C9A7707F4F96BE499DB09A8A16D46A3FBC12C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969505, "uuid": "6c91d0a0-29fb-41f5-9606-f1e5211c97cc", "value": "24576:uAShSEya6kj0/YwtgCOLS2lXa87pzuqyWAKJKbN74AROUggC3dCI:0krOLSSUTcAdCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774969505, "uuid": "3aa8e621-f690-4dd8-8c70-cd9e60aacc99", "value": 1224211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774969505, "uuid": "55bed2a2-8580-4dda-83db-df9996af0976", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969505, "uuid": "d875ab1a-7b40-4f22-bde4-1b12ac2608ee", "value": "dc807e98a912e76bb17b82f71b21ae50375f3575316ba3751e733f1f35d537b3.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243a415d-2cef-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774954104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954104, "uuid": "d8c91960-7995-48ee-ac2e-1c0166e7d771", "comment": "Malware payload (Formbook)", "value": "4e7ded2cafee4c1dddad19529250c84c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954104, "uuid": "7e6e9750-eef4-4321-897b-c5f2acef9a17", "comment": "Malware payload (Formbook)", "value": "ddd653854d3fefd8deb33a2f989777a73b18a6149f0e31a79e3694487bd8f5fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954104, "uuid": "a9c663f1-6262-419a-884e-d0c461dee2a7", "comment": "Malware payload (Formbook)", "value": "74e106468bf41ccde51fec70742be3109257b385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954104, "uuid": "c8b3b381-88dd-4f62-ae7b-86a3e81981dc", "comment": "Malware payload (Formbook)", "value": "d729a8699bddb3d8fcea3d89ad189a625954b78ee1d6c4b2db1ec8a39912592d410cfe800ddb43299fa5b988a91a3426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954104, "uuid": "06121157-81e4-4b9c-8909-b6f483ff9c2c", "value": "T1AD9502118EC46FB8CFEC5A1950FE161E93F10E8A941AB58DEB33BD47AFE7A00411B558", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954104, "uuid": "a82a636e-7b45-4926-b0ca-7043f21f9bf1", "value": "24576:s2tUlodtFotyG44PViDQadtZh4C2q+sIwsxxcik9I5Kb/y+tMkmMAjp9O+TkF1Fm:lrFhnYCeup+wFbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954104, "uuid": "bbe14f12-b230-48cb-b0c3-01bc1b7ab054", "value": 2045440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954104, "uuid": "a0166a80-823b-4da5-8d75-0b7eb10ca0d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954104, "uuid": "e89b2641-efd9-4e01-842a-742b981960c2", "value": "MEDUWK377101.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0349394f-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774954478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954478, "uuid": "7f4ebb72-a080-477f-a26c-6de00e30c7a1", "comment": "Malware payload (AgentTesla)", "value": "b795c1378f42250bd6e900ad0d704938", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954478, "uuid": "81d373ca-d69f-420d-8027-a037c7abe539", "comment": "Malware payload (AgentTesla)", "value": "de63e0dac9cd8bfe25df3aed44fe5802fe142f022118b3e352c6028fccf9d2e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954478, "uuid": "7beb27dd-120a-47d2-9645-7d03bb9a81a8", "comment": "Malware payload (AgentTesla)", "value": "2a5c78254b95a2244b22fd800c1c057db135c802", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954478, "uuid": "d3d44443-8e3e-496d-8061-8069da9bb72d", "comment": "Malware payload (AgentTesla)", "value": "63511a713a2d308d9fee913172f90cc9f9792fe98a258177f8ea59eff237bd20f50bc1724440785efd190df387bbd5fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954478, "uuid": "0b175829-f573-4b9f-be2a-ad93c293ab83", "value": "T18E5373F1816D40B488ED69BE4B19F04ED846DC95B2110568B3E7ACFDF73A4B7CB404AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954478, "uuid": "6cd8f276-e153-40ff-9935-ed3761324506", "value": "1536:C1edMSznJkVUiaqn4tjqXcqpPJLiHjdU9/WdGfOtZe:cSd4hKdUQxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954478, "uuid": "daaac1bf-ce4a-408f-ab3b-c7f741a49b53", "value": 62289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954478, "uuid": "77457c98-2b4e-44aa-a29e-7a5fb203b7d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954478, "uuid": "c5d822d4-c0c0-495a-a441-415ecf795454", "value": "NEW ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9484afd4-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774979632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979632, "uuid": "d1b4eb63-4941-4ed3-9887-0caf7f1b2882", "comment": "Malware payload (AsyncRAT)", "value": "cecc0b843dcea78ba859efbb922041ed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979632, "uuid": "5b3d9a45-c355-4a35-8687-b2769e6b333f", "comment": "Malware payload (AsyncRAT)", "value": "e06dd348a334de7e2e43ef7a3739d4b4cf792b615595262aa212eec4e3005564", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979632, "uuid": "f4ed7c60-aab4-4067-830e-c2eea37feda4", "comment": "Malware payload (AsyncRAT)", "value": "b91485e44591972ce74c2d4d62d04b348390613e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979632, "uuid": "81aa0082-1bfe-4398-a916-87996c09e9ec", "comment": "Malware payload (AsyncRAT)", "value": "56a99686ba084a3913577820281da0350cc678a15b22f043bbeb5e2452ee5f1ac8678219e50bf418cd8dacae6851c536", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979632, "uuid": "efe666e5-f69a-4d1f-b3cb-b5c085b8202f", "value": "T1C44142421CAAA5310136C777B2244186FA5E23870F81FACD7A95808D2F5D2A7CBDF985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979632, "uuid": "82ea0465-0e87-4049-a27b-c71bd456e6e8", "value": "48:1o/BfScAObEpEu+3tj0udzokhin49J194JS9aCdJ1/pHhBaJr:1o/nEGXj2khisJ344aC1pHhEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979632, "uuid": "7df22b6c-334d-4f71-835b-ab8751f04eaa", "value": 2282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979632, "uuid": "9a1ae929-e4e5-4727-823d-72dbec336314", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979632, "uuid": "28d90fbb-fe17-475d-9c06-dce67c0505a1", "value": "UKM301.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7945b17-2cff-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774961250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961250, "uuid": "8a7fd212-aa32-4149-a9ea-4bf8ce371da7", "comment": "Malware payload (QuasarRAT)", "value": "f5b8e78d2e72bf18cb527d45cc244612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961250, "uuid": "3561e789-ec86-4065-96cb-950f4733b3f9", "comment": "Malware payload (QuasarRAT)", "value": "e0c0ff1a67b4aef85616887a3dc62612a20d599a7315fc29eacec29c8306783b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961250, "uuid": "47dc25c9-6954-4bad-b630-95f9d659ffdf", "comment": "Malware payload (QuasarRAT)", "value": "9ab8638e3f1a1a5d3f4aad98db9cf02b9062da0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774961250, "uuid": "0b269fee-836f-45b6-b8ea-09c2500a4cc4", "comment": "Malware payload (QuasarRAT)", "value": "e5c29da2624305670bb985ccf17d769d0859631e5b43085fc3ae45e4d520589a3b9914dddb843ce8d2a840c43e955764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--ashduasdoasdoasd", "colour": "#044C4C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961250, "uuid": "34595e99-a2f1-4ff5-96bf-91e5f1d9e313", "value": "T10025D09173F4960BE1FF1B75A4B249494BB7F8129A36DB4F0C88906D1EB37808E117A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961250, "uuid": "66bfdaec-c1d9-4987-be44-bcf569c24388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961250, "uuid": "20c9fe08-d23c-4e05-9b68-0ece85e46769", "value": "24576:zF/pXxJzck+uGW/yFoBkkAQmiUBgQGtpUPM:zF/pXTYjqqanTFjQGpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774961250, "uuid": "bfd63d69-2529-42c6-8f07-ef6df9a2df1f", "value": 977408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774961250, "uuid": "cc8aeabc-ce44-4f6f-ab65-1f06a50c1f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774961250, "uuid": "929831e7-a9f5-4ee1-9bfb-98f05694ba48", "value": "Pulsar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3606b5b-2ce2-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1774948868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774948868, "uuid": "60104190-7b00-4d51-b9ef-e0fe6157d2b3", "comment": "Malware payload (a310Logger)", "value": "99e3c9616a8601aa76db93f1a40fdd2b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774948868, "uuid": "14c6a40a-6639-441d-be6e-25e4693a2476", "comment": "Malware payload (a310Logger)", "value": "e0eae228c7fa4bfbafa89d34d274653da2343a25e9881f7b827ae1b194d37113", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774948868, "uuid": "e2791a5b-febe-4770-8cee-bd4c1abd6317", "comment": "Malware payload (a310Logger)", "value": "218cb2e899689903c2e2d1384e3e5bb4587d1076", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774948868, "uuid": "0a458abf-da3a-4f46-b924-732899748ecb", "comment": "Malware payload (a310Logger)", "value": "df6182a18494852acfa9aaaa9c486c019c0ea32c1a214aa3a67eefbcd728976667e2ffbf5deb589ea0830b337a81f1bc", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774948868, "uuid": "ead19bee-ed4a-46d3-a78a-039c4ea8db0c", "value": "T14355CF0273D1D062FF9B91334B5AF6115BBD79260123A62F13981DBABE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774948868, "uuid": "b388dc81-3798-448b-9a9e-560bc058584f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774948868, "uuid": "5006f865-3512-4bc4-8903-59fad34f4abd", "value": "24576:r5EmXFtKaL4/oFe5T9yyXYfP1ijXdaw3guh5H7+YzWJiXQOEGJ:rPVt/LZeJbInQRaw3xh1+QWCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774948868, "uuid": "2c4a94c9-204e-497c-a070-6b89c3785ade", "value": 1329152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774948868, "uuid": "f5b8e8bb-2e97-42a3-85b5-ad274c6b4a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774948868, "uuid": "5aa3e2d7-a894-4f4d-8b6a-cc6fb5928ec1", "value": "Halkbank Ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8344b8-2d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774966011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966011, "uuid": "976fdfe4-ff8f-4f89-bc49-50a955a6481c", "comment": "Malware payload", "value": "7658962ae060a222c0058cd4e979bfa1", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966011, "uuid": "b08cda38-2a72-4e90-9214-53d56378b27c", "comment": "Malware payload", "value": "e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966011, "uuid": "3bf5a64d-43e7-48e2-b20d-f5758a97fed5", "comment": "Malware payload", "value": "b0e0f12f1be57dc67fa375e860cedd19553c464d", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774966011, "uuid": "af36a32f-a586-4091-9c65-fbf616845222", "comment": "Malware payload", "value": "29ce7780cfd677731b5991d601d41aacdb0f56d936f4b19d00ed020aff5c60bf78d7d09f7cf5da0936876b2c83631c95", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966011, "uuid": "343f5bf1-b6cb-476f-aa0f-12f8264f3b28", "value": "T1F6911186BDC27FED2326B9B878C2D168DE5D8CD1C943B0D6D2563B1328188A857D0B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966011, "uuid": "3580bcba-8b0a-4f77-9c3a-6ffbb61e651d", "value": "96:V0BwY31H/x2Nov7NMUtjlNU0kCsSuckO6Jg5yD8pm:V07H/x2NSBNxjl4S9t5yopm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774966011, "uuid": "71c47045-eeb9-481f-bf19-447a43ea267e", "value": 4209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774966011, "uuid": "21c6a0b3-5551-49bb-aa33-e6d37ee637b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774966011, "uuid": "33b02f5f-e18a-4160-9119-a4d11f858f93", "value": "e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9724df0-2cb0-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774927376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927376, "uuid": "08122faa-0d64-4863-9fc1-ad195c147d16", "comment": "Malware payload (GuLoader)", "value": "5f486fafb4720c0a4d04dfc0aae0e832", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927376, "uuid": "64ecfa17-1055-4801-9a5f-b78d0970b333", "comment": "Malware payload (GuLoader)", "value": "e1657c68bc63afdb87864be060e4064e8d7c1e1b5e7fe431ae04f6b7a5fb2413", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927376, "uuid": "419d3b34-c76d-4cc6-be48-d9a198156591", "comment": "Malware payload (GuLoader)", "value": "3a450b03412f8dc28242a626df35c00254c32caf", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774927376, "uuid": "aea6ddf9-dd5f-46a5-9f24-db9d6df148f8", "comment": "Malware payload (GuLoader)", "value": "ac0c78715b26225089d47cefae405734167c2e67011f64c9b72a45864c0efc64320987765be6d9255d50f839bff57a0c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927376, "uuid": "2e5409b0-3990-40d4-be32-89f70b2c4176", "value": "T18ED219D08C137FBB49E5662D5FC95175CABE12F266218032B04EDF04AB8459CA77C2EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927376, "uuid": "668ca4c1-aa68-4aa8-bdd0-ae29f41b1fbd", "value": "384:dmCnwSFGyebtBbowSjZ1pUKClMssC5N9LozrwbLwINcJtft721Q/5bsJjZkKEPB+:QCCbrFS91pUKwYCPuwbSZt7bsJvDPEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774927376, "uuid": "d60d7a89-4c9c-492a-b91b-570eb8e59e42", "value": 28642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774927376, "uuid": "ad53fa4e-c57d-407f-8fc3-95e4ddd67c5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774927376, "uuid": "a1a1d168-c9e3-42a3-ad7c-6fab0ae978bf", "value": "26033115VND4\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f415bee-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954686, "uuid": "d625513c-4dab-4d45-9954-1985b8ac1a54", "comment": "Malware payload", "value": "d25609240c2d967b63d37027289a29b9", "object_relation": "md5", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954686, "uuid": "e57d70a3-26cd-4556-945e-fd2728503770", "comment": "Malware payload", "value": "e24c7050368aa198c22f9ef75d3cacd435663c6d92c071aae79663c18e4c817c", "object_relation": "sha256", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954686, "uuid": "cdda74fe-5c30-45f6-af82-ccb09e99866c", "comment": "Malware payload", "value": "538608666c13c9f4c8ac334d98d31ad5df492c78", "object_relation": "sha1", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954686, "uuid": "2d0e040e-b1d6-487a-9722-a390231e1f79", "comment": "Malware payload", "value": "1ec84e09672ae62a9331aec57b74430eedf8772e64eaf73964e4a9c2e6446aec6acb068c65edf44d1dadd0ae756efb2c", "object_relation": "sha3-384", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954686, "uuid": "3fb86b42-eb00-4a14-b203-1003975933fd", "value": "T19651EF0137F12729F2F35E715077A6605A37BA62F952D7AD0440618D1CB2F18CA39FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954686, "uuid": "9f599002-4b25-488d-a4dd-3395e9dd0ba9", "value": "48:8Z4JtfsJJrl0dLXuHHH5RlD7V2JGn62R5x1aI4CVC1q0:8Zy412unvBpCcz411q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954686, "uuid": "ca2237c8-8dd2-4dc0-ac92-edbba9ab9fae", "value": 2860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954686, "uuid": "84693189-6584-498f-87d8-b75d557963a1", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954686, "uuid": "9bed870c-3ce5-4372-a4a1-fd60412a4921", "value": "e24c7050368aa198c22f9ef75d3cacd435663c6d92c071aae79663c18e4c817c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00d7b00-2caf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774926931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774926931, "uuid": "72320e35-b5c3-4eba-9b1b-4ad5a2f393df", "comment": "Malware payload", "value": "22ca54ba63f2e386fc988b0ac625464e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774926931, "uuid": "5942c3f8-f3dd-4b4a-8159-8d805ce0d825", "comment": "Malware payload", "value": "e2861128b3706fbd00d3fc36a2dc7899ef81a2f62b3e5d48c152c2a47a13b0d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774926931, "uuid": "51ae2647-2cf7-41a0-a3a4-f8b9bf5a780a", "comment": "Malware payload", "value": "77607674183e6a72f49f86f7b00cb7be85ef122f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774926931, "uuid": "ff25ab0f-7579-4a3b-b9aa-0997b5bb6c56", "comment": "Malware payload", "value": "d90db7d89c433a137945501cea9717cb06ee6b277c1b99d447c731004f4ecc0b7b7411912c7b3efd98fbc06cd45cff98", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774926931, "uuid": "475c2b83-8acc-41e0-953c-05a27c5a9683", "value": "T1C9036815729F8B1430735A8946AB07344BAF7AAE1FBE40C5448EDEC94FD35128C8B7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774926931, "uuid": "42359488-a143-4158-a074-858de0ce1969", "value": "384:12tIX9OtK8KaRaVMDYW6nwAa8KEAw2NxwpFC6Q5nG:12tIX9OtKd5VMiwAa8s7an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774926931, "uuid": "0dadcc54-d2d7-400f-8bee-51ad1aa32c04", "value": 40252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774926931, "uuid": "31ca1154-96ed-467c-a41b-7b186daba921", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774926931, "uuid": "bcf3dd6d-8f92-469b-94b5-f2b0d92b1ed9", "value": "ftycg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4919d320-2cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774958890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958890, "uuid": "2c5712ec-ae1a-4246-981f-6c1694e931b7", "comment": "Malware payload (Mirai)", "value": "5b524bd3bfaf424d0290b271255529eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958890, "uuid": "99e85b00-99ac-4c9f-9b1f-866986825aa4", "comment": "Malware payload (Mirai)", "value": "e4474ca62d5f68ab2993cf32edd404f5a75c366edd2cf463e5a1250a1157642d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958890, "uuid": "e6871f6f-b5d3-4c75-a925-30170da963ee", "comment": "Malware payload (Mirai)", "value": "5f584178d581523b50baa2e598b878408bae53fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958890, "uuid": "aa831749-c112-479d-bc11-31dec8311036", "comment": "Malware payload (Mirai)", "value": "68f3cb361d4b0cb3189f9e28d29d2d27253564ff2909f0e77e538e069c1581d2b09fb7d2c85d164961a7576d4f4d4c91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958890, "uuid": "243431f7-a57c-4ba0-a2d4-4f33757f63d2", "value": "T139734B4271280B47E5930AB42D3F1BE05BBEEDD031E4B684695FDB668A35E371086ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958890, "uuid": "daa6bad2-3d97-4a22-b022-93376f7619d1", "value": "768:k1OpIF906jcY+C0rRixDTAkdlS1ZEeB+uJmHHVPPfSoMeaia8746bHGOnrI+rRY5:5JXJrcUkdM1WeEpV6e74qFY1UIoE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958890, "uuid": "8001a9b4-a39e-4d08-9bf7-f1eae57824c0", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958890, "uuid": "81d960ad-73f2-4456-80c9-546d80f1c91f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958890, "uuid": "b471090c-1ba9-491c-8fc7-6280347f18fe", "value": "jade.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0107d9-2d0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774967725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967725, "uuid": "b2d4508b-b737-4319-92d8-34321bb63202", "comment": "Malware payload", "value": "8c782b59a786f18520673e8d669e3b0a", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967725, "uuid": "c1b51abc-5645-43d0-b17f-5b1e8ad8aedc", "comment": "Malware payload", "value": "e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967725, "uuid": "b166020d-4648-475b-a83f-9dc06f7e5e88", "comment": "Malware payload", "value": "ae39c4c550ad656622736134035f17ca7a66a742", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967725, "uuid": "8059eb3d-9ef5-4956-93a7-5927d721b588", "comment": "Malware payload", "value": "353d1816cbcfab00e33605354a447b13743e3a69915ff6263ee6a98b7712d429094cb58e436b88ae7ffa1a11dfb9d4e1", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967725, "uuid": "0a460868-4e10-41c0-a23e-0ed5f1949006", "value": "T1C4D022A15638C2164989E034B814E8946E052BA110993EF5BBD9F2890C827E1833982C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967725, "uuid": "b00f5286-4eff-4b87-8685-bc8932f0c2f7", "value": "6:rz8SFXF+RLgyKBM3S1z+ILh8JkziCVAV2o4VhRUaeq:X8+ERLgyaIS1HGuziCqVMhXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967725, "uuid": "b5838d8b-b8a5-44f1-bef7-b7afc79ae2d9", "value": 203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967725, "uuid": "68e99fe4-dd6d-41c9-9c73-b8e8a033c4fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967725, "uuid": "774b5ae3-6706-462f-9b39-0bf5d464ee38", "value": "e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e9be27-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774928811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928811, "uuid": "b75fcdf3-cf92-4c27-bf68-8e57fbb8604d", "comment": "Malware payload (Mirai)", "value": "52db00c476a8ddc60ae97daff29e9a6f", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928811, "uuid": "3635acb9-1e68-4eea-8723-248676cbb703", "comment": "Malware payload (Mirai)", "value": "e58f7172a560783dd333ecfd49d43fc3015ba48f24f186744be850b0e8fb02f0", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928811, "uuid": "7ef7a260-cad8-4f88-a4cc-edc77dc998e0", "comment": "Malware payload (Mirai)", "value": "114b9db50d62c71439d75f1dfe19c1e38bca736b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928811, "uuid": "5f9bcf7b-cbb0-42b4-8d7f-396ef5c4426b", "comment": "Malware payload (Mirai)", "value": "89bc231ecbbb817fc7c93f32e1952f008bcd138c14edd919b597033f09d0cab0c5a994be789ef55a1c6a8149e5841e37", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928811, "uuid": "a243bb51-9540-46b6-8f24-592020f1186e", "value": "T106245B53A70D0683D05B5DF036F727F083ABA91125A66284F60FFE845377AB1A41AF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928811, "uuid": "e09a493c-ec47-4780-8bc6-d871cd997819", "value": "6144:3DtI4xP1RHezprt2ikcKOYLxO1l0dv4mDsoY86eeaL57sc:TtISw72iHKZLxY0dv4mDsoY86eeaL57H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928811, "uuid": "2c29b335-7954-446f-b68e-19840c76ca09", "value": 214278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928811, "uuid": "124c7961-a6a2-457f-aa33-aa5044e6baa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928811, "uuid": "7af849b8-4bf7-4515-a90f-88b83254468b", "value": "bot.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e282269-2d05-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774963569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963569, "uuid": "24fec376-998f-4416-845e-2b6e963d132a", "comment": "Malware payload (Stealc)", "value": "f67ef2c94d307104842c0173e786274f", "object_relation": "md5", "Tag": [ { "name": "158-94-209-253", "colour": "#B2508A", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963569, "uuid": "d6dd31e9-1675-4bfd-be32-626b5ef0a34f", "comment": "Malware payload (Stealc)", "value": "e5bbc6227293e31ab70e1ed62467cb87a924e8d23ce0250eead3a5848bf634e6", "object_relation": "sha256", "Tag": [ { "name": "158-94-209-253", "colour": "#B2508A", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963569, "uuid": "15c8435c-bfa6-4dfe-a48c-efcf5787b1c9", "comment": "Malware payload (Stealc)", "value": "7568d4b1fb945a70e4b08ccd0b3d4ff390579014", "object_relation": "sha1", "Tag": [ { "name": "158-94-209-253", "colour": "#B2508A", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963569, "uuid": "27b97118-49db-4753-9f6a-feb20238725c", "comment": "Malware payload (Stealc)", "value": "e4cc105bc20a8a5452921bbe220cae5670f55ebcec36ffbf9e77e853a37e38d39cbaa1a5cfa320d98ecc873e8d27ea5c", "object_relation": "sha3-384", "Tag": [ { "name": "158-94-209-253", "colour": "#B2508A", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963569, "uuid": "97a2374a-34ec-4d9a-8d23-af2a6512f878", "value": "T10A958E0A7CE04AF6C679633248A291D67B7DF8191B32B7E73E5075392EB76E05A34310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963569, "uuid": "77667aaa-8e9e-43d2-8efe-5419f034113a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963569, "uuid": "6ad8f2c9-7c0f-4840-9127-8bc1e6f3230b", "value": "24576:9y0XZNtlJzirue6SvebcxUYJiHsi3z3GRWdtbbXwR4:9y0pNtZivuYUHsAzHVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963569, "uuid": "7a8b2d9c-016f-42f6-8868-5fbe9cb152f7", "value": 2044416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963569, "uuid": "3b7f1d2c-cfdf-40b6-9ba0-1e673716b487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963569, "uuid": "62c2e25a-7fb0-4889-a08e-3bb8fff63f41", "value": "Licence_Version_Loader_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aa3e38-2d41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774989276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989276, "uuid": "06964768-3384-43f5-8977-5010d50d5cd6", "comment": "Malware payload (Mirai)", "value": "ede34c63fccc0de523136163439fd811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989276, "uuid": "b1c8fe8c-a553-48de-b625-ea8bb3c2fd47", "comment": "Malware payload (Mirai)", "value": "e658ad0271bf230580f9baa32dfa831ff77ffbafd3278f4ea7f016c9746b9a08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989276, "uuid": "b84bc099-f7d0-46c9-b18d-cbedbd3baa1e", "comment": "Malware payload (Mirai)", "value": "1660973d499bdbd3736879210bfbfa63b86e0632", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774989276, "uuid": "c438046b-d245-4594-84ad-7ba67242a081", "comment": "Malware payload (Mirai)", "value": "65bacd69fd277fa5ff092519b8e71afe766421688dc0e6f7675cfc0ca9890d9a55c5d27902e1815bcaa2f67143fe0d7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989276, "uuid": "b85538e1-f60b-4564-b291-48d8a18c2157", "value": "T128230880B54F85F5D40B4E3040A7F63FDF71D82A40709AAEEF59DF32DB67A429209299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989276, "uuid": "004c2873-7ba3-42a3-8904-9afb8c3c7620", "value": "768:5Y6KUkGYYjQnNIJMG21HFRGf8D1okyE9c74rw0C+Ao/LbKYK8VpMF8x:fKUkGYYjQneMGOHFRGf85ok04PAo/PKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774989276, "uuid": "2355d75d-3c86-4b55-9872-22b92c4ca05a", "value": 46928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774989276, "uuid": "c40990a9-5e9d-499a-8f14-ccaed9d7b0ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774989276, "uuid": "c09c21ba-e154-43ef-9006-9a6033d2dcf0", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8bf736-2cc0-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1774934121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934121, "uuid": "e9b54240-e6dc-4304-821c-adf2ff27b341", "comment": "Malware payload (RatonRAT)", "value": "ac669bb8cec6ac367b2528ea83415449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934121, "uuid": "49f6cb2b-a662-4a1c-89ee-15ca3d103083", "comment": "Malware payload (RatonRAT)", "value": "e6d1376ef19f9995b16284474a0844f8a45e5e7a4ae554d2375cf890087d2387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934121, "uuid": "88ea6f89-3667-4193-bfce-6775f04f0dd2", "comment": "Malware payload (RatonRAT)", "value": "3fe7863fcd2297a7642e90743138878f4de329cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774934121, "uuid": "6aa13bcd-95df-4cd4-9bbd-71f15087f5c2", "comment": "Malware payload (RatonRAT)", "value": "b647fabdd62141c5f10be62148407497d7d76115212efdcb28b4a108aa9d489267a7814cb413013d69cde71c4e4ac42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934121, "uuid": "88852599-6635-430a-ae59-aaa8c9619bf0", "value": "T1EBD5010C33FACA08F2BF4BF4A87185654771FE179C62D76C59A179AE14B6F04AA10723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934121, "uuid": "dbf7a775-756c-430b-86d8-a6f08f0a4446", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934121, "uuid": "53266371-b278-4590-9938-ec83df15ff58", "value": "49152:wegVUlsHjkmiGWU5FLGpMZ7iKPJ5W16sclR0BxMfzaRw4OsL:wegVUuHjkDGjzqpgmwQ13uRxfzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774934121, "uuid": "951a85fb-1720-4954-a539-ce2a73b3f106", "value": 3003904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774934121, "uuid": "d61dc6b3-dc6a-4254-ba84-119d9341dc65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774934121, "uuid": "2f913e8b-1422-4cc0-b1f6-f91bd7d96816", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2d343c-2cd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774941586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941586, "uuid": "25d0374c-31e9-4e26-b3d9-b502f3e30128", "comment": "Malware payload", "value": "45ff0256244cf21ea83ea3dbc16a3afc", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941586, "uuid": "d2df4f56-65d7-479a-834f-abd3ba0298de", "comment": "Malware payload", "value": "e752b3d8a3d50d9886c77d1a2c7542cae8ea6c7407b4d41b3ebf864120e5974f", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941586, "uuid": "e217adf0-4fe9-402b-816d-cc200ee151b7", "comment": "Malware payload", "value": "0ea625cc14b96bc337654069fd362a48cf4dbc97", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941586, "uuid": "dd53909b-7626-486c-aa77-ff151c1cc708", "comment": "Malware payload", "value": "854178731e3a0ee5773e794cd1b8968cd1f3797c144a3c7689eed9050a1b02dbadb63ebf5b170407d1c78e9af5e40cdf", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941586, "uuid": "08701c0d-73ae-44b6-8efd-2558400faf5a", "value": "T1D162CFB458C7A8B1C92AC3DBBFA5254D5E359784ECC5EC9122C0D415CE4BD80FE252F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941586, "uuid": "5f585a03-4a99-4037-8f80-dfabe65084bb", "value": "384:lULeZ/7LSLnDvvT5rGe1vxBQGtPBoNepQk:WLeZPOnDvvAeYUpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774941586, "uuid": "fb44ba24-d5a0-4183-9123-a8954468ed4d", "value": 15049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774941586, "uuid": "51e620cd-83ad-4c2a-9e2c-49e7955ea2cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941586, "uuid": "7d3e2c8a-c437-4b8c-9102-7c056fcd0dc7", "value": "e752b3d8a3d50d9886c77d1a2c7542cae8ea6c7407b4d41b3ebf864120e5974f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8058ee1-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959962, "uuid": "5b28b250-532a-42d8-9e0e-eaeb153ec05f", "comment": "Malware payload (Mirai)", "value": "7ac23a9f9edfb9b8c2ba5777bac18e91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959962, "uuid": "90181c3c-4f63-4316-89dc-e7a3e33ae225", "comment": "Malware payload (Mirai)", "value": "e792220e89c5fd028d573dda9423df20cb09594273cce641382dcd4f812803f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959962, "uuid": "5838b12b-f88c-4b27-8278-4f063d6d760b", "comment": "Malware payload (Mirai)", "value": "a40ee1287a41f7c89a84c605959fb4861f6c6cbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959962, "uuid": "dd9db5da-2759-45b7-939f-4e24d5cf2161", "comment": "Malware payload (Mirai)", "value": "70cffa2394cd01d9a90fd336a8779cd5982d5492a4b91ef641ab47428f78e3f295f29c6f858d16b2e4d2c1a484b2eb79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959962, "uuid": "00b31ff1-f1e7-4f73-8f67-f62c46f9fe37", "value": "T1C883C60EAE258FBCFB69C23547B78E25964873C727E1D142E16CD6111E6024F742BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959962, "uuid": "0daf93f8-5afa-4be5-a812-fe619e99c8f3", "value": "1536:2fQXeit1xZ8JYgSV15UaNXhRNEHHLVlTKmF2HGKGTlJLkKx69E:8azwzSV15UaLiLT3jLtxsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959962, "uuid": "18a65ce2-8d1b-4332-b389-11964c1ef550", "value": 84756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959962, "uuid": "ffb2926c-1d07-4fbc-a5e5-458465ce8d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959962, "uuid": "9d55b244-82f4-4a53-ad65-5dd580ef26eb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cc9b12-2cbf-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774933455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933455, "uuid": "899d43c2-bb3b-43a5-b10f-c7b4e8388c52", "comment": "Malware payload (SalatStealer)", "value": "dbbc7b3aa168023fc8a6414f6effd311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933455, "uuid": "275ac01b-fd1d-4c7d-b518-d5ea15d6eeab", "comment": "Malware payload (SalatStealer)", "value": "e82e96a761ef54dba9919b0e497e3819396b029f4254159057861ed69b07de08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933455, "uuid": "3bf28764-aea8-4b6b-9993-e7827ddf5bae", "comment": "Malware payload (SalatStealer)", "value": "0fb56a3e639d506133f90d50464ad4646d07a2a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933455, "uuid": "6d711477-8607-465a-a0fc-8f488c570d40", "comment": "Malware payload (SalatStealer)", "value": "f125eee3013df1562b9a3b652ea373b8306769cffbfd930f3ec17a22b815d9e3e8ecdaf76ab7811b03b5fd7d648bad4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933455, "uuid": "3748eda2-fc87-4fda-8119-b1d7c637e42a", "value": "T117C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF8776911C6A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933455, "uuid": "da050889-6526-46b6-8cc8-068f557b82d0", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933455, "uuid": "3030c8ec-2f3b-44af-8951-9889ea415d4d", "value": "49152:estx6j30pM0hXMzg39Zp6okCW56lYBV/0dlnnTfhidrKou1GaP5fOjQPHXHkgCjy:txA37g378XCbKIbl0ax9HRR43CEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774933455, "uuid": "c0dcd1c3-6d23-43cd-94c4-502a4dc24825", "value": 12570624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774933455, "uuid": "969ad3cd-684a-4484-b2b6-056610ae01f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933455, "uuid": "5c40e9c9-6c86-4c59-bd77-44b893211648", "value": "GLOBAL.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1102d0-2ced-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774953449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774953449, "uuid": "160ca478-d9e3-480f-9693-3c5b1240e6d9", "comment": "Malware payload (Vidar)", "value": "9c0bc293d9153a7ee211d4bce74d5f0a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774953449, "uuid": "c512926a-da7d-43de-a32a-d483a747ae9f", "comment": "Malware payload (Vidar)", "value": "e845328f2b8d9c681134434e2ac9f5171e71deb8a802e919638a88faaece76f2", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774953449, "uuid": "58b276fb-a44a-4dbb-a806-901160ca562c", "comment": "Malware payload (Vidar)", "value": "18bcce947c8b95d082986e2f2f78e800aed2e654", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774953449, "uuid": "8fe4bea1-c65b-4061-a746-7f5f98b94508", "comment": "Malware payload (Vidar)", "value": "96a7f611ac4e1fda0b186f686d210df9a17d9f3e36e997c1db2169de6f229a20a2830c89c9615417e70993f3739f35e0", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774953449, "uuid": "776af158-ed4e-4406-bf63-e209b72db442", "value": "T1B4958D4B7CD144BAD06AA33348B26182BB76F8191B3223D32F50AA783FB7BD05975754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774953449, "uuid": "5e91ac9b-978e-4c4e-a634-8f629137a1ea", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774953449, "uuid": "cf32c6c4-c2fa-495e-8197-8bbb72dc99d6", "value": "24576:SBgndUIheQDbiAoFBeZNfXbWHrJtX47SkE03GRWdtVbXwwPb:SBgdUIVbiAoqj+rJDIHvwWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774953449, "uuid": "7694e451-e956-42a5-9b33-92eaeff538e9", "value": 1920640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774953449, "uuid": "95131c02-c7fc-4f01-8069-2d0a81e74f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774953449, "uuid": "6f89e697-1187-44c0-90ab-a0bab9e4ab2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894c74ea-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979614, "uuid": "7f945071-3274-47b0-9ff6-07bd32a65c1c", "comment": "Malware payload", "value": "b822cc9d3d7bf327e8d7237419d3a46d", "object_relation": "md5", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979614, "uuid": "44e21de0-3ed2-4d4a-9184-9c4bee03de19", "comment": "Malware payload", "value": "e84cbbbc018d7e54c5afed760f04c06731ba57c1d40414c8b94ba1c488b9c9c5", "object_relation": "sha256", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979614, "uuid": "abc19f27-833c-445f-aa6f-ea3c0a9d49ae", "comment": "Malware payload", "value": "8b2e55eaeebf107e10fb786cc7a7019f5bbc2a67", "object_relation": "sha1", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979614, "uuid": "6cfe7dd4-5291-470f-b8df-0d3cd313492f", "comment": "Malware payload", "value": "7973fce4eb75cb40774089e766bc82e81948c5b0fa1682ade361577670b4eaee8554934dc11ecfc03868457f7e0613c7", "object_relation": "sha3-384", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979614, "uuid": "d3d99e36-cd67-4f7f-901b-a8b3eb1eaba1", "value": "T1E1B09BD15D0B93115451A72784B5B1DDB1D059565591D0964305897FB551181850D0FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979614, "uuid": "489ffd8e-97dc-42a7-bab3-033ebcca4767", "value": "3:lP/ErUIax8/MLRALl8ceL18P53y+b4VhDovyV7W6WFL5vhc7n:lP/ErUIalLRAJNeL2pyW4Vh4Jc7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979614, "uuid": "1c7fffbc-efeb-49e2-8951-6b685709cce1", "value": 127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979614, "uuid": "deb9db8f-4554-4905-b987-951d855afd6f", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979614, "uuid": "b3c25bad-2b6a-4420-995b-64477f5f09cd", "value": "Scan_0620954916911.pdf.wsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66bb082-2cef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954456, "uuid": "9399cb33-3f96-4f3f-8cc5-d77c96c48ebb", "comment": "Malware payload", "value": "a3b9a92618f76541aa3f6efbec1a7621", "object_relation": "md5", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "vwo-zip", "colour": "#1E0803", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954456, "uuid": "1162e9a2-d728-42a1-a43e-4fd0ee24a07e", "comment": "Malware payload", "value": "e8dbdab0afac4decce1e4f8e74cc1c1649807f791c29df20ff72701a9086c2a0", "object_relation": "sha256", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "vwo-zip", "colour": "#1E0803", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954456, "uuid": "8b5575de-9f25-46cf-bdf1-5d8c6b279bb9", "comment": "Malware payload", "value": "0d9f26b82473e4d9e9ff824b504f10690cd24158", "object_relation": "sha1", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "vwo-zip", "colour": "#1E0803", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954456, "uuid": "7b9f7de0-4647-403e-8998-6d99b12f3907", "comment": "Malware payload", "value": "3e802b6c77607aa09464eb223a5897894b72debb49ac34e066b5a9562461c7f815935c6b22ad36ad366febd4393b28d2", "object_relation": "sha3-384", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "vwo-zip", "colour": "#1E0803", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954456, "uuid": "936fe7b9-50fa-4a5e-a560-45e0398c6767", "value": "T12AF43323973D7F8BC47014EEB67F86A8A6B74D25021FEC81C1AD0D5C3D86A4CA4D06D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954456, "uuid": "6994c1b9-393b-4b5f-a7af-4e4ef7b3ee4b", "value": "12288:DZpDhUfgPC1Y22BIk+vU/Iv4uWwme0bixqwKoPvk19vFMqXxtAFJwn6hQGZJ:9pDhg51X2BI7vU/Iv4uXm5bikiP8rF3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954456, "uuid": "41a98100-d003-486e-91d9-b4c3eaafcb74", "value": 745238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954456, "uuid": "889c516f-3270-47f2-9468-b741fef5bc09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954456, "uuid": "47c1862c-178a-4f63-bb80-39a57b1c38b9", "value": "e8dbdab0afac4decce1e4f8e74cc1c1649807f791c29df20ff72701a9086c2a0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3a2d65-2d06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774964210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964210, "uuid": "8df98408-12f6-4e77-bfc2-4046356600b6", "comment": "Malware payload (Mirai)", "value": "e080c88f93ccb57569a4d6a3dd8fbd97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964210, "uuid": "7ec67247-2868-44f4-9c99-f4d3f53710d0", "comment": "Malware payload (Mirai)", "value": "e946662996cb04d86082d20460698495fc28cf36f9a876bb70185d986462d360", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964210, "uuid": "b1f06319-7be9-430c-9942-93d8286c5bf6", "comment": "Malware payload (Mirai)", "value": "d4250c0abc087a3cd1078bbfa4909faa76d7608d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964210, "uuid": "323d9257-6c7b-418e-988e-0c99f91f7cc6", "comment": "Malware payload (Mirai)", "value": "15f0a8738ef038ebe7e8e280f286792a336b2f194a23abbbe4fdb95ce07797ebf7e6c5281a48bd32bd6b1de8f524ecf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964210, "uuid": "b48c7c83-784d-4734-8599-897dec957785", "value": "T1A914C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964210, "uuid": "924c00d0-e851-4154-bf5f-871d6bb2a911", "value": "6144:456eQCbeoufx4Fdf2dp06GtCqjYW8nY1j20WI:Dely4Fdfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774964210, "uuid": "b2e8f00d-fa6e-4216-8bed-3dc4662bd086", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774964210, "uuid": "13316306-497d-4cb2-a67c-9a752e1c6cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964210, "uuid": "42f36b39-3862-4149-b77c-53f57388528a", "value": "boatnet.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0017f26-2d25-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774977585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977585, "uuid": "f5f0cbc4-8479-475c-b1fe-c9d38b2d92ef", "comment": "Malware payload (SheetRAT)", "value": "8eff9a21c933ad469ac5cd4df8f44380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977585, "uuid": "d1e1aa09-d638-43d2-8cc6-d01d297aac75", "comment": "Malware payload (SheetRAT)", "value": "e98a790eb7a81cb9243128d3eff6767ede03715a0d732dafee1fce76a1a15264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977585, "uuid": "9ce2dfb9-b29e-4206-8812-5eee1c895d6c", "comment": "Malware payload (SheetRAT)", "value": "7778a64305a6b2c71ead6cdde9fad488719d7f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774977585, "uuid": "5fc95376-042f-4c7a-a3b1-725c904b0e64", "comment": "Malware payload (SheetRAT)", "value": "bb2bd5a5d084ed2a7c7606be8284c1a061bef5a8872ee8b133e07de497f2b26bb8da57ddd6b5fe24bfd1148fa56c3235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977585, "uuid": "27306b5b-60da-4a9b-9854-fc5557dc0811", "value": "T128B4B40CBE52FC05CE6E3DB38BE691611B3210C63E129116370A6FF98B593B659A317D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977585, "uuid": "cff7234d-e005-46b8-8f5e-9d030de01e2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977585, "uuid": "39dbdca4-4327-4251-9eb7-767d18675af7", "value": "6144:ujySA4Amr3/lZTKSP473r209jzwtetZpXbvtNp6Xn/ENxjguHrXMsSTQZR15Codf:ujxAmr3Pu2a3vHU3/ENXrXMqdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774977585, "uuid": "b7ba2bea-6ebe-436c-ba8d-eb2ba30f7962", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774977585, "uuid": "cb1aa20d-d748-450d-ab24-f26cdffea513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774977585, "uuid": "5429926f-b0ad-46de-b8f8-80623df48299", "value": "my.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387506b1-2cef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954138, "uuid": "7d370051-bac7-4552-a454-5cd6e1cb2899", "comment": "Malware payload", "value": "1729174d5f0db692c8350b3139ba1715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954138, "uuid": "da14adcb-c2cb-4baf-bc0f-e4781385897b", "comment": "Malware payload", "value": "eb0d71f7808f2642bea55adde0fd2659a7385348c504bb5f5cb6883e5a86cf23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954138, "uuid": "9921849e-5a82-480f-8a65-cc9bcb2785b2", "comment": "Malware payload", "value": "d79ab73fa19ac2108d49ae251031254ca909d080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954138, "uuid": "87cd1e9f-1bf7-4808-bc33-e1e508174884", "comment": "Malware payload", "value": "2cec4f2f9167e68a693ca0ab0a3f043b8862ae42950e3cf67a878ea5492a3b60f78e2d42e166791c60919cad341b69a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954138, "uuid": "2d7d60db-0e72-4bb0-80a4-6b08c2012532", "value": "T1F9858CDDF6EB8C81C02450563E28273FE1DF60FE00670CADE4A5E6C55E8679E8D762A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954138, "uuid": "4f6be733-39e3-4a63-a4e2-dae33ad8c448", "value": "48:+xAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAxAL:bBlgnGhmDlE61p/0ElMZy09JxwN1BK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954138, "uuid": "a7336a7b-d409-431d-b921-3ab59c499ab2", "value": 1801940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954138, "uuid": "2d1df760-4b73-4240-b607-da6099da6f9b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954138, "uuid": "82c28449-faf1-4969-bf15-9d8f878c46eb", "value": "shipping document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93703d0b-2cf9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774958585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958585, "uuid": "7544f133-0bac-454c-9e46-64eca0ef758d", "comment": "Malware payload", "value": "36fe1296631d8c4f3b3b197763cc8ff1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958585, "uuid": "3b214db6-091e-4efa-90dc-694cbc893894", "comment": "Malware payload", "value": "ed71e8a96094e4df187e8eb6142fb1f6bcaf9ade2e739f35ff0612103e891c27", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958585, "uuid": "c44da4e0-3272-4ac9-88c8-5e7af0ecaa6c", "comment": "Malware payload", "value": "2a5ae4151923b9e4c09aa7294a086d9af59f2cb0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774958585, "uuid": "180d30d5-d5bf-41c3-b5a4-32bdc683512f", "comment": "Malware payload", "value": "4a6b31cabd2adcf1584c0e81b0925fc258bee4e5a1c74f63824ff9129e363739287686d031c2dda8e6ff3a9f1a13463f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958585, "uuid": "998a777f-bfcc-47da-98d7-c112d5f4cf21", "value": "T1A0119E0298C218F3BAC790AD1BFB180FB08583A354509D15F34E4B797F9937535A316A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958585, "uuid": "c1a8ebea-d371-4c41-a4dc-79f4bff2bf9e", "value": "24:RzXwHgKP+RBOvA55ouTX6t3uM8Vu0Aqmgqr//vsaA5kz77l9rJ:8knOvAQu2BuM8Vu0AMY/Xsajz7/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774958585, "uuid": "5d43c68d-482a-4fca-91e4-5d5be57af306", "value": 1105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774958585, "uuid": "22c7ab45-04ee-4376-9005-94803be62649", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774958585, "uuid": "67e6ebba-5641-4c88-b631-18d162ddcca1", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6816b524-2d10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774968391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968391, "uuid": "daa8ce68-7abf-4ce8-bee9-e4341ef83d0e", "comment": "Malware payload", "value": "90e8e227ba8bef0ea7e0212b5b1e0d4c", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968391, "uuid": "a096a5ee-b03e-4cd9-8abf-42a01b277f3c", "comment": "Malware payload", "value": "ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968391, "uuid": "f96a9b1e-05df-4e5c-9df4-55b7642eca9e", "comment": "Malware payload", "value": "dbd62d788ce8dcaa96116a73f70ee24813d59428", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774968391, "uuid": "853c71eb-ead1-473f-a935-0611db66b297", "comment": "Malware payload", "value": "a25f1b5161b9f45fde58e90c7cbf0e1b2807852182d55a3f57723cceff08aebb7a95f5ecd420f55f3b6af0f99806bf6c", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968391, "uuid": "d31c7906-f322-4767-8388-ee6a11aafcae", "value": "T1BC228410791BD02056F76329DE57E448FF26413B23651410BEEEC5D42FB096ACAB8FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968391, "uuid": "b2d9e307-a168-4abc-861f-60ccdd9c152f", "value": "192:b9u9gG89mD+SOzuahCnGX1pybp0j5PWFmFBiMluIY266b7cTOXAWnTvfOkFHPL:b4KG8MwzuaEnGDPWFsBiM9YChLf1HD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774968391, "uuid": "dc9f42ba-c622-4cc8-9624-d0eb9ca94da8", "value": 10656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774968391, "uuid": "4fa52667-a1d7-469a-8166-26b5dc37c93f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774968391, "uuid": "8b9bcb3f-01bc-4801-97c0-1b7fef4b570c", "value": "ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fbdc1d-2cb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774928825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928825, "uuid": "596fa645-cc9d-4cda-86e0-356d91751049", "comment": "Malware payload", "value": "d6587b92d90a2637b3ee4a6d6c4f2c3f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928825, "uuid": "044c787a-e353-4a42-960d-692228d28186", "comment": "Malware payload", "value": "eeff0c73ca19ed3b9bef58ebe15d67631c227f62059ea8e8f83dfe30feadd98c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928825, "uuid": "c68ffdc7-3421-4359-98ab-f16e17ceec9e", "comment": "Malware payload", "value": "8e2d3bdc133b3cba7a67a858c579b55b561adeb7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774928825, "uuid": "d8ada279-467b-4632-ba96-5b6dbc5b6034", "comment": "Malware payload", "value": "eb6361e1f5fe0c01529ba0ee2e24675c0fef87a2094ceb880b62c09e69608f666ca9f9adc4245bd34ee0eb4d51706b63", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928825, "uuid": "edb1dbe6-1e6d-41b6-beb7-088c355c1e73", "value": "T18B5301D01B75278C5371D8763DEE305F8624292E72963D101DEB818EF81A22399B2EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928825, "uuid": "ca12255a-0623-46f6-8a10-786857e5dab5", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcl:8D+CAXFYQChaAUk5ljnQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774928825, "uuid": "5e1d94a4-25e8-4213-9514-7662c2785ab4", "value": 60856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774928825, "uuid": "f74528f4-d079-49bd-8561-121ad8502b93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774928825, "uuid": "a65e9c03-3d43-44bc-990d-e08e72a2c57e", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d650f112-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774960845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960845, "uuid": "43cda743-6230-40cf-988f-38fcec87ea8d", "comment": "Malware payload (Mirai)", "value": "d96f6fd1263a21abdd25f5d923eb2bec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960845, "uuid": "bd6264f0-bfd4-4c18-a74b-edebdb9515d8", "comment": "Malware payload (Mirai)", "value": "ef6bfcb7f6a3d85cff4227cb81cf290905fa608d8349518f1868679ed0ccbe48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960845, "uuid": "db573b5c-a8e3-4c88-8a72-6ca45160fee1", "comment": "Malware payload (Mirai)", "value": "ba15c68e2ee0fa1a307422d0e4831d1cf4abdd59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960845, "uuid": "68bb8a98-27fe-4023-9c12-69e571b455f7", "comment": "Malware payload (Mirai)", "value": "019dbd865d6632c25d51925f9f011108798d7fff6da0fb1a32587e65546f97a6c9e639d36664378bae23626df8209770", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960845, "uuid": "5871a96a-eee9-4bae-8295-f9f15973dfc1", "value": "T1F1631B07BA428BAFC14FC1F407F76A399922BDBE0A36F1E5E3A4FD861901CD05A1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960845, "uuid": "5bb3b9fd-2b05-4566-bec9-8b471ac4bd13", "value": "1536:GnHkHRxHBFPSWGz1GYlGy5TGpWE7wH9OXEL9qo:mHkHvBFVGz1UytJE7wwXEco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960845, "uuid": "ca6b36c8-8aa7-4cf8-92b3-a3b5683c9b72", "value": 69624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960845, "uuid": "43c11726-9da5-4248-902d-81e9731ed552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960845, "uuid": "b1210548-783a-4a2f-a41f-03a9827af040", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bdccae-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959923, "uuid": "480dc36c-0e5f-4f6c-aaa2-9d36fb19964b", "comment": "Malware payload (Mirai)", "value": "4865639a954512d78abf67cc825b1707", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959923, "uuid": "b7e5fa0f-c901-4841-a1b6-1cfc975ba03c", "comment": "Malware payload (Mirai)", "value": "ef8bca1b5fe5923f906168b05d03f85437ccaa2cf2fcd3b5458b8e225317bc3d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959923, "uuid": "30c8b2b6-29a1-4860-90dd-07f3f8f7be8d", "comment": "Malware payload (Mirai)", "value": "1db404a22e58f9e223de9b2a8eac3aa673cd9492", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959923, "uuid": "34c147de-4b07-4e9c-b301-9f28d8f67bd5", "comment": "Malware payload (Mirai)", "value": "fcdaaab2e46aaf9cd5f2eb9ebf3f698ea5539101abb5f836638ccaca41f24dadccc7afdb7e9ddc6cbb42f50c527e2218", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959923, "uuid": "319404f0-83f0-4ec0-8653-1e1391e2cebb", "value": "T124E2E1069B14FD70C6F20FB3CF284389903B53F8E9DA15669B146B846ACB40466BC7C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959923, "uuid": "d4b1c707-a15d-47ca-9bcc-87d99d1e0562", "value": "768:umeDU4l8CCuKMU2RKVooPcr5nHbgdJiacBYt0w9q3UELjf:umIrWM3Xga5H8dDQG05LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959923, "uuid": "d9209913-f590-46ca-ae4f-0c8f7b25f8cb", "value": 32236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959923, "uuid": "5a14ff60-cb42-491b-8b66-728558c256ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959923, "uuid": "37e523bc-ac59-41eb-92dd-847664df2593", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a27cbb-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774954722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954722, "uuid": "1dc085a8-8eff-4d2a-9a4b-fe7bbf2b93fc", "comment": "Malware payload", "value": "cb032878300fb0d060d14ea3bfa0dec0", "object_relation": "md5", "Tag": [ { "name": "aa-zip", "colour": "#5AD996", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954722, "uuid": "5bbf947e-9dd0-4cb0-8277-944fe361168e", "comment": "Malware payload", "value": "f0049880fbe2331043c31cc41ef20d381f4d55d17d901c372bde59556e953399", "object_relation": "sha256", "Tag": [ { "name": "aa-zip", "colour": "#5AD996", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954722, "uuid": "a1ca511c-8302-4dac-9fd6-8d56f3fe407d", "comment": "Malware payload", "value": "1171bdb734d8be0cdd4987c38865367397501610", "object_relation": "sha1", "Tag": [ { "name": "aa-zip", "colour": "#5AD996", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954722, "uuid": "5223e9a9-d37b-46fe-af88-13ae686bbf08", "comment": "Malware payload", "value": "ac11fc48b9f306a013c996f33d5efb55bcbead9f05fa6012a1356d507d0676d212e773c95067fc619d79f246b951a8f1", "object_relation": "sha3-384", "Tag": [ { "name": "aa-zip", "colour": "#5AD996", "exportable": true, "hide_tag": false }, { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954722, "uuid": "37a268c9-bac5-4617-9517-1833c5e4ad20", "value": "T1D2D6331AFCD42589F237743584C86C0CE792817E61A954D8FF6887F2A2C9AC4FBC7A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954722, "uuid": "9d89173e-1255-486e-897c-578493865ade", "value": "196608:pyYq5Zuv8p/w/CMmv3CFkWpP2Kg1Y0BiDydnGT/csnwe717NkcEsx7UZWlAndvn7:pUAt/CMmfpWpPSd9AznP17N8MpaisT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954722, "uuid": "11942fd2-17fb-4677-930f-0822e64144f4", "value": 12671037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954722, "uuid": "a59d7a99-d477-4e99-a862-7bd15879c158", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954722, "uuid": "2a55703e-3e95-41e8-84fd-57a801c4463b", "value": "f0049880fbe2331043c31cc41ef20d381f4d55d17d901c372bde59556e953399.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324d3f2f-2cfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774960570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960570, "uuid": "e0ae6a43-496d-4572-a6c4-22c3113bc50c", "comment": "Malware payload", "value": "52778ba3438f7e8e0fce035e1db98260", "object_relation": "md5", "Tag": [ { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "from-hta", "colour": "#867901", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960570, "uuid": "cefcd41c-a29d-4db9-ae37-ccc2fdfbb923", "comment": "Malware payload", "value": "f0bbd23816b9c7bee8f3237d2d32e69121048fb6a32cef43a9288786ab982a24", "object_relation": "sha256", "Tag": [ { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "from-hta", "colour": "#867901", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960570, "uuid": "3895b0c2-503d-4d9c-bb36-acb9161704ac", "comment": "Malware payload", "value": "c99d88bb8467c81239b32c98588f0e8693704ed0", "object_relation": "sha1", "Tag": [ { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "from-hta", "colour": "#867901", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774960570, "uuid": "5e26dc6f-8829-44b8-91d9-92882140edcb", "comment": "Malware payload", "value": "76bff52774e2761b01e33663ee2e3b159e7aad402777923149295b9738242afa3b11a8a06622d6d6a24a53d136417626", "object_relation": "sha3-384", "Tag": [ { "name": "checkmarx-zone", "colour": "#C5FDCE", "exportable": true, "hide_tag": false }, { "name": "fflexus-45433-portmap-host", "colour": "#600BD2", "exportable": true, "hide_tag": false }, { "name": "from-hta", "colour": "#867901", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960570, "uuid": "d6674e65-a6b4-4343-91e3-5043ccd05c58", "value": "T1D221EA588595B95E1CA402211A256B19B180FCF52065B4DB97F39CC890DCDC6053D7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960570, "uuid": "4e1e748a-705e-4ee7-b76b-1d77ffc94bf7", "value": "24:ic+jrUR0uM2QZ8l1aIHTNrvKKoqoGtY9vCbIdEcjO3ULr3TYi1P:hEd/a9N+KZntev5Ecj3r3T71P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774960570, "uuid": "430980aa-aa5a-467b-b5ee-49b554e72988", "value": 1279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774960570, "uuid": "4fc4d906-237f-42bc-bf56-50a0b421cfb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774960570, "uuid": "44a97bd9-7611-472c-a0bc-70de0a9d8c88", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e19195-2d05-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774963616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963616, "uuid": "7d1ac6de-bff6-4d80-b637-f54c01c949a2", "comment": "Malware payload", "value": "8d9e537a3467ea01d866d79d101e1124", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963616, "uuid": "8448cd58-e4da-44bd-aaf2-d24e93a0df10", "comment": "Malware payload", "value": "f1661078c6bc55634dfd47b0e0716312504665391491cf02b559e3d1ce3fe193", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963616, "uuid": "e891dcd9-a7d9-490c-94ce-0f15e0ff9781", "comment": "Malware payload", "value": "6745ded71c4960b36d1b4d0a09d6ccb05541844b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774963616, "uuid": "0a56d63e-1031-4c88-aea7-f2617d4d4bbe", "comment": "Malware payload", "value": "d16a32dac02db4fb43f127f40130fb4c41d79294d5705c082fbd6f49d1741221c4c189d179bab238a670f269101063ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963616, "uuid": "88cd10c5-c25e-4818-a850-43601a375e29", "value": "T1E554E01AE3EC5010F1B39F88A5BA2646A8777F734A1DC9DD01541D9DCA62C88DCB3B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963616, "uuid": "1de1732c-5e89-4d35-a179-93c4f88b3b1f", "value": "6144:Dc9EJQXDDVxnIMDrqCef2+sEdeY7VmZHFpIvExHO/s5WCn5ON/CI:Dc9R7nIMDrq36CbmZ1U5KOlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774963616, "uuid": "cc89cc1f-5232-4025-bae3-76d7d8817ee4", "value": 305484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774963616, "uuid": "7b90608c-5a10-48a3-96b7-ab3f00f9330e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774963616, "uuid": "a508c12f-f380-4d77-a62a-6040ac47503a", "value": "ORDER#DOC310326-31032026100024.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb1d2d1-2d02-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774962550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962550, "uuid": "50f595a8-e9f4-49f9-976e-04a4e64e29d5", "comment": "Malware payload (LummaStealer)", "value": "b30c94f9150fe1f9f63669801cf542c4", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962550, "uuid": "dc9a82a5-4d36-417c-a0bb-8c304f2ed45e", "comment": "Malware payload (LummaStealer)", "value": "f19e93da9b5d26c4ed28bdb618c125a1f3ae813103fa32fae1b3c402c255e0c0", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962550, "uuid": "549fcaae-f064-45f3-afc5-396c5f5b7a3f", "comment": "Malware payload (LummaStealer)", "value": "8fd1d4a673f1d8cbcebb429289e1d18be5599b00", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774962550, "uuid": "87fdac0e-3d52-480e-b442-53e030ec23ee", "comment": "Malware payload (LummaStealer)", "value": "461e0b28a872c6b94847043f4827c32afd57c8c8f7596e948f552d4eb8e3328f1ff15173d27d131cc79eb3078af26367", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962550, "uuid": "a2947dff-a723-4320-ad50-b7eb591979e1", "value": "T1D3755B51FE8784B6E412173249E752EF2339AD0D0F329A87EA407B3DFA762D11836356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962550, "uuid": "87cdf130-cc6b-4129-86a1-3dd24f6fe723", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962550, "uuid": "f0a732e8-8b03-44b6-bbc5-4fe499dd27bc", "value": "24576:GtlLlKLeexQvL4c2dmvtbBigoUUyBrFxmGoT0iHOB1PN1jSIo3KkWRVgxTpXuteZ:GrQky2KgDCS5ke8TpXuteriVwEA+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774962550, "uuid": "550bb133-613b-4e51-b6f3-a6173d758c1d", "value": 1582080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774962550, "uuid": "4105ae7e-cf7e-4aa1-8af8-67ba0f5b900b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774962550, "uuid": "82e33726-90be-4fbb-9c0d-e2757e805d39", "value": "downloadlink.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f579be-2d06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774964205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964205, "uuid": "dca8975c-315c-49b8-82e4-5bddf9ab1f87", "comment": "Malware payload (Mirai)", "value": "44a94732a1980363c7c06aff7167af38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964205, "uuid": "85fe904d-f448-4650-8153-fc0efd297f00", "comment": "Malware payload (Mirai)", "value": "f20991717b62d88a44b917df63021187bdee72b4c92a7773eb66531f86c3a43f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964205, "uuid": "9388c257-b258-4980-aa66-a3127a392f1c", "comment": "Malware payload (Mirai)", "value": "b8943241e8b63830ed322b77dfd9e64e674d85bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774964205, "uuid": "c6b1847b-ea38-4471-af7c-45c0c1744945", "comment": "Malware payload (Mirai)", "value": "127261fae6125792e0a431a668d26f4b966989b7a27217502498c8bec46224671919fb8f3a529af4843bf457691dbde4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964205, "uuid": "1f1880d9-7780-4e53-8c8d-0e45ea41c696", "value": "T110F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964205, "uuid": "6d87acec-cf38-4aa8-8961-fbadd0782a5d", "value": "1536:3dMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpkEn5p5M/LW:/7vDtrnPTR71gmX7Dy7fMpkxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774964205, "uuid": "7144296f-3b9c-47f9-9794-6d9cfef6ec61", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774964205, "uuid": "a4c6b983-3098-4ded-9323-ca22cc15d0e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774964205, "uuid": "69d5ac23-a294-4c4f-baf7-6e772f78c8b7", "value": "boatnet.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fffae1e-2ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774920166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774920166, "uuid": "536c4b8d-7b41-4409-a636-d5f1f6d53634", "comment": "Malware payload (ACRStealer)", "value": "29e94dab937061f6314053ebdf63ecea", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774920166, "uuid": "3b396ac5-ca98-41ca-81d8-18f1da18c2a9", "comment": "Malware payload (ACRStealer)", "value": "f2207ba54c7c0025a9a75ad69a26404424283866ad57addc7a4346f551a7379e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774920166, "uuid": "76cfa7e7-432c-4424-8036-ea194c13b758", "comment": "Malware payload (ACRStealer)", "value": "424ea3840fd1dcfa035c85a776b44f04146021f6", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774920166, "uuid": "6ed46fd7-5a18-4c9c-8924-0c0e0f0d9f79", "comment": "Malware payload (ACRStealer)", "value": "ca0e292dffacf381a9434fdf01ffbbb09db15d9cda448415a7b5e51b6e634cd1b6dc92e6f345546975f3d62566aac6ed", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774920166, "uuid": "d89f4b89-c492-4664-b6f6-2a4d3267fe42", "value": "T10776E706EF710650C46982F4586B416267B53C58AF3067DB2695B3702E73BF83A7A3EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774920166, "uuid": "8b62af20-bd4a-4ac8-8fc8-078545e1d017", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774920166, "uuid": "f858e9a2-63de-44cc-9ac1-bf134e178508", "value": "49152:Q/vVbY5vfbA6b9dtfDT0M7CWhfm5pojKvOwTl9j6LQcl9iqpc:Q/ufNf5TVvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774920166, "uuid": "bae83e64-992e-4b3a-8cae-2a953b32807a", "value": 7450112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774920166, "uuid": "272113a1-5c5a-4838-9542-0e8dc29ec297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774920166, "uuid": "890fa46a-272a-4c61-be33-2894b0e97a46", "value": "SecuriteInfo.com.Win64.MalwareX-gen.72749724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab814c80-2cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959914, "uuid": "7856b7ac-f25d-4b8f-9cca-14e50285b3f4", "comment": "Malware payload (Mirai)", "value": "2727e396285048151fee96daea38f21b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959914, "uuid": "4bfeedc4-cc2e-4409-99d4-477a8d99ae76", "comment": "Malware payload (Mirai)", "value": "f3798fe1f43bb41671225c43c3569333584b9fb2f83eb75cb37a1bfb190a7cd0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959914, "uuid": "4ff1f75e-8e55-4ea7-8e61-68e83f451ee8", "comment": "Malware payload (Mirai)", "value": "2af001795522643cdf24b01d5b9f540a3afe1d87", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959914, "uuid": "d8e19d22-4b0d-43dc-98c1-034cc146dd7e", "comment": "Malware payload (Mirai)", "value": "861c8a263b9c2e06dc4dac2dadc4056bc4fd618695869e23c5069bacdd77fbb7c8aac2c4683a5b7084277283859d6396", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959914, "uuid": "d43e00b5-4735-4fb5-9dd8-89dd9b5acf68", "value": "T15BD2D0ACE2585995CCFD9C39269E6FF32D904745B3D66FAC630148CAEB38959F10C930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959914, "uuid": "2b47282c-c411-4940-8a21-3ee1cf92f1da", "value": "768:IJpP5brCsdTo93dUxCq+/K2DWoWU9+ZgWI:IJpP1JWddm+/XkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959914, "uuid": "d03036f4-4ff2-471c-8239-0b8e68630744", "value": 30680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959914, "uuid": "db50b3ea-2903-42c8-8c40-3d8cd93e8e1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959914, "uuid": "dfa52057-462a-4de2-8d01-82ad7ee66984", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f43f64-2cd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774941509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941509, "uuid": "2ea9fdbe-689c-4466-8129-99a78fb7cc2a", "comment": "Malware payload", "value": "0601dcd79460a89d567f307c47b39c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941509, "uuid": "ead1e645-fe74-4d03-95e0-6433582a42bf", "comment": "Malware payload", "value": "f3c442a5cf38c571cb5e9d306ba03112c6f2169d4ea96e4b7c72496b26acb7fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941509, "uuid": "c30d4618-7d49-48f4-b952-49a8aa13eebc", "comment": "Malware payload", "value": "52d84c47581a86d5b2e37224b4a2f0d8a7dfadfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941509, "uuid": "7dfa2797-c5d3-4c64-9025-cb2b048fe166", "comment": "Malware payload", "value": "6bec64137722568dc4d074827327d73e3e85a948959787aca370ce09614751cd8a2c6af40c795e669df1a45ba91d46ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941509, "uuid": "980f84af-99a0-439d-ac12-fdc331557ee4", "value": "T17EC24F04ABFC0518F2FB5F355ABA29504977BC9A2A75CA4D2D42409E0DB1BD0DEA0F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941509, "uuid": "b8b5d076-ebe5-4673-812b-586715c080c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941509, "uuid": "45c06fee-0473-412e-8b8c-6a6b80eccbca", "value": "384:PyqJ4NAf/BQE4uCbMojKCRDP2E4/4BejOWUa3yffKmagZZjDEDtOXD8wcwS49:qsf5NCbMo75P2JpyscdjDEDtOXD8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774941509, "uuid": "7de4d328-63c4-4038-b8f1-8f4ec68aebec", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774941509, "uuid": "f531e5cf-1e77-4fa4-a778-dce91cac9f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941509, "uuid": "ecbbeab4-67c1-4611-b280-cb47e03b2be8", "value": "f3c442a5cf38c571cb5e9d306ba03112c6f2169d4ea96e4b7c72496b26acb7fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34754ea-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979684, "uuid": "7312f0cf-dac0-4532-8df8-cceea6b170d9", "comment": "Malware payload", "value": "c8e5182bd3a39745bb98f1aa43970483", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979684, "uuid": "c22bb44f-7369-4713-a9d7-5dc5a9d5ef98", "comment": "Malware payload", "value": "f56a53ec6817c918d9a0056277022d694a06727bc9064bee95e4b80c50067f2a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979684, "uuid": "cf718028-be4e-43c6-b080-b77c8faefc66", "comment": "Malware payload", "value": "bf11841b9f4caab59ac61b7a6854f141d2687a71", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979684, "uuid": "b8ebafa8-c637-4e7d-9708-570a4c709a08", "comment": "Malware payload", "value": "f896f642b820f4d081f5eafabf3fc9771258ce27b5f50e87d2f7fa67ade0c26929b7e359b94e320a55b054192b86e6b4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979684, "uuid": "36ecdbe8-57d9-4650-8e0d-72f305596513", "value": "T1CE742369FDE89B20D41CC239FF84CD015AD3C8025DA3CBBCBA5B170626716B56E275CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979684, "uuid": "6a187c5c-e4db-44a6-9e2f-4ae899ceaa78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979684, "uuid": "6f14f64e-0eba-4674-b861-c532d652f9bc", "value": "6144:FKY9eyHtAYSFpovm5+XKXHUev7BkLwbf7GXsoQfv+l1xU7RiBeDukDBD:0Y9e0tAYSbXK6UevdkLwbDhvCUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979684, "uuid": "e36805d2-ed77-430c-a570-7c9bcb519a07", "value": 337704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979684, "uuid": "f96e6a6d-3681-41b0-85f9-1216933a405d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979684, "uuid": "1505b580-33ed-414f-8970-7b94f4db6c76", "value": "mod_Hvv_shellcode.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd05a905-2d35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774984425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984425, "uuid": "81f56e1d-2768-485a-9d28-5ddff377ae8a", "comment": "Malware payload", "value": "c79b483178d770c34f5e21855ddb50b1", "object_relation": "md5", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984425, "uuid": "002d87ca-ef8c-4f6b-ab99-29202617056f", "comment": "Malware payload", "value": "f67181090db20b48b0b833f856d136ccd763e8d1bd28cbb600c40b05386dea4f", "object_relation": "sha256", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984425, "uuid": "cd15064f-1f5b-487e-b0f7-965d0e2566e5", "comment": "Malware payload", "value": "faf8accd47a88650da7321b4ae61b964e3dd6c27", "object_relation": "sha1", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774984425, "uuid": "509e71f7-486d-4b79-97c1-9469ec2d718f", "comment": "Malware payload", "value": "be4e21a1671a1464f01220a2f5e49742b7544f9d80f5970bcc58901fc0edd07a11deaa5747748c3fd27f97156414069a", "object_relation": "sha3-384", "Tag": [ { "name": "185-100-157-10", "colour": "#A4D65C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "je666cs-com", "colour": "#746FF0", "exportable": true, "hide_tag": false }, { "name": "mlbkn-com", "colour": "#880AD0", "exportable": true, "hide_tag": false }, { "name": "mrmcs-supportmanageronline-com", "colour": "#2DEB36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984425, "uuid": "75fd6310-c6e1-4493-b230-ce8819201021", "value": "T1F4F423F396C35C89C3ADC35D50A2A176F0D80D6292D6C197563E870197EBBF0DC14BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984425, "uuid": "b7676a87-45eb-485d-87b2-0af3bdca9824", "value": "12288:WFvKQyqCtO3yUEPTj1fnFqFuqD1VYqrq6AypcJT9IbuNq12Eti5AQ9B:6iQNM6iFq5VYqrq6Fpcliib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774984425, "uuid": "36590725-53d1-4f8c-87f9-fb1c086473bb", "value": 739331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774984425, "uuid": "66738cf9-ba66-4c39-9fed-f605af2df222", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774984425, "uuid": "3ea8f603-ec38-4568-a20f-bc2a5b2b1ca7", "value": "miumiu.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460e28ba-2cc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774935692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935692, "uuid": "4172a161-c00d-4948-b49d-77ef066e1f33", "comment": "Malware payload", "value": "5ef7b4e9f43aa9fa2e4801e9de301ff0", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935692, "uuid": "756f6028-9fd7-4108-8565-026e9dff91f2", "comment": "Malware payload", "value": "f69b9d7d31f8ea1d1943814dc609bc9520fccf97153656fa6910fc1c3e31f436", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935692, "uuid": "7d1de205-e2d7-4234-a1b5-2bbb19ea5b87", "comment": "Malware payload", "value": "bed01d60edddc287983fd8e713a9c003192fda94", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774935692, "uuid": "975f76b5-eeb5-4526-8dc6-2ba82314973e", "comment": "Malware payload", "value": "d76eacf0fb4359601543784ec55f1ba8b5e4cfa594e776db9bcc81fcf74c4d63804093f5759ff66e45714e93b4428282", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935692, "uuid": "0a396a10-b368-4175-a7fa-a1000461f780", "value": "T14843024693635B5EFD9BE6B2913C8AC3A19534587FFAD32E012162AD07331718C52BA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935692, "uuid": "8e643d07-1293-4bac-8879-ee36348ac25f", "value": "e74715778590298c1a6ab6990c37a79e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935692, "uuid": "041ac916-c63e-4081-ab19-7a43a79c090b", "value": "1536:2KYgcU1MWIkKsIWCFCy5ptQ6Mo/u4N9Z522VR3EvusSq:JY2ykJIPEy5Q5oD22VRro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774935692, "uuid": "8026f6d5-d4be-4b36-9e7d-f870c43ea808", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774935692, "uuid": "f88bc62e-367e-4d1f-990a-1c0d420845ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774935692, "uuid": "f1349d11-9788-46bc-8ac5-17fdfd906982", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470e4398-2cf0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774954592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954592, "uuid": "de9e654c-a079-4f7a-baad-6ddb59d3d070", "comment": "Malware payload (Mirai)", "value": "8873044bfd51f9abc2b3250ac9821aca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954592, "uuid": "3f281fec-a9bb-4566-bc25-244863e2a07b", "comment": "Malware payload (Mirai)", "value": "f73a91223fd07749822aa74d2bfe5be447ea4e0dbbfb882f7038a143f3cf34f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954592, "uuid": "d3b08872-ca13-4383-a27b-06bd273eab8a", "comment": "Malware payload (Mirai)", "value": "f31624ae5597d53e7c8f80df456224a960f41a44", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774954592, "uuid": "d63b9d9d-9820-4bf7-a52a-e7a0056064ce", "comment": "Malware payload (Mirai)", "value": "602aedc1cf03230372f95ff666acb1f85d723b9ea8521c25cdfff4ce2df6c05c13d0ff62e2f82a283b464bca110d3bb4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954592, "uuid": "93424f44-e657-4289-b14a-a3182168f3cf", "value": "T1AF230894B9819A17C6D0537BFE0E42CD3726A388E2DE3313DD225F6537CB92B0AA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954592, "uuid": "744d3f45-f346-4cca-beb7-eb5df7f656ac", "value": "768:JQGsyO5cPVQEYJVvKwtPFVcmlu6JjnNCR6gPj5+uB4Pl5Q1zL0lkb8FWBMcEZz3:2x+kvH1c76JJMPj5+uBaluyyb8UBUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774954592, "uuid": "f8d49457-320e-4e04-b0a6-e8e46bc13f32", "value": 47936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774954592, "uuid": "c61118d1-57a3-4ee1-8b12-a230d6b2ef22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774954592, "uuid": "3867a1cf-e1f8-4305-a3e6-f4c7103680ac", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d4d723-2d0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774967666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967666, "uuid": "86f38c62-af49-4fff-99ac-9fff3bb2a6de", "comment": "Malware payload (Gh0stRAT)", "value": "64f67d9fe4336d1dadf961629ee2c60b", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967666, "uuid": "37c8c30f-5870-42e8-a5ff-377264eba501", "comment": "Malware payload (Gh0stRAT)", "value": "f75445cdbc126869a4a3d7621e15881d1f0173c1cfaeb1be7ef8358e0da2d5c3", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967666, "uuid": "0dcccfda-24f5-4339-adc9-a8f57423d2c3", "comment": "Malware payload (Gh0stRAT)", "value": "b94ff5c3523bf94f3eccedff9f8caaf3acd24818", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774967666, "uuid": "80efa985-bf6e-4e13-b55c-1d34ea2c16f7", "comment": "Malware payload (Gh0stRAT)", "value": "a07c99dfca2ad439265dddaaf5804f33151d7c42a10673e5efa5c20df555990ec7a36437045c33697ae30be20fc51f90", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967666, "uuid": "75da8d23-56d9-46e3-8aae-4c2cb5a9b041", "value": "T140C73363B78E577DE09E8A3A25F3C0518C732E51582B8C07D5E44E8DCB2E9542E3E786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967666, "uuid": "0799ebc5-707a-474f-bd98-f6353120eaec", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967666, "uuid": "0b4be88d-9196-4b0d-91dc-707a096d49cc", "value": "1572864:hoI0HQY9Y002i13A5aOxVzJBanU4EVlmA6gqcXWW:ho4Y9r02iB0aOxVJoU4YlHhbXWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774967666, "uuid": "83c4aab6-8aa7-40db-a25e-dd0ef5c0cbb0", "value": 53339507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774967666, "uuid": "e845f0e4-6474-486e-a469-35352d250834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774967666, "uuid": "3e842ae0-357e-447e-8b2a-a11279fb7ca9", "value": "II2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa1738a-2cc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774937471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774937471, "uuid": "fbd87f72-cc38-4850-ad12-f0b52af0e863", "comment": "Malware payload (Vidar)", "value": "13993ec952e0b18b1b6090126134152d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774937471, "uuid": "c122aa5a-3217-4e8a-ae89-adad70458512", "comment": "Malware payload (Vidar)", "value": "f7b1d63f63ce73cf998de8236625ad38eec7efa36b836da413bd5c2cfa60426b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774937471, "uuid": "8dc5da4d-5bef-4da4-90de-ad937ab33e2c", "comment": "Malware payload (Vidar)", "value": "023f13de11953a1bc45e8b4e96f77c7e820191c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774937471, "uuid": "2c560e0b-22b6-4ffd-a0f1-c7eba9fef1ec", "comment": "Malware payload (Vidar)", "value": "d5f022bcf799315eff6902e7e2dbf12882e9328d23b277e1c683f116c1d3610e39ccc997c69cb2bb6cf62b63af630a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774937471, "uuid": "980d7b84-71da-465f-bc40-9f39c09a22f8", "value": "T11A959C4A7CE104FAD0AA63328DB752A17B71F80A0B3223C72E5076793F766D0AD79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774937471, "uuid": "e3c3abc4-c0cd-48be-9c1e-d4d4128fedbb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774937471, "uuid": "20633fa8-0d69-49e3-9eec-e50cd8aaa256", "value": "24576:o+j69OSkFCESuUuqb2gZsxVV42bBbu4S3yZj5Yn4nhele5nK23TdGK8o:o+m9rkF4uUuUsxP4kVi6Ndz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774937471, "uuid": "3ab94811-4204-40b5-91ab-7e9dfe84950f", "value": 1917632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774937471, "uuid": "74945a45-f9dd-4b03-b917-7a3029db004e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774937471, "uuid": "07c4b659-0325-40ae-944e-13c1be293529", "value": "13993ec952e0b18b1b6090126134152d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b201cc0d-2cbc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774932437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932437, "uuid": "977c1cd2-21ba-4dad-ac79-1e51daf1c6f6", "comment": "Malware payload", "value": "089e2872016f75a5223b5e02c184dfec", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932437, "uuid": "037c9d63-f6bd-4eaa-af82-02a185d6fe7b", "comment": "Malware payload", "value": "f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932437, "uuid": "f5851466-6954-4975-a968-723acc6bf8ae", "comment": "Malware payload", "value": "978407431d75885228e0776913543992a9eb7cc4", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774932437, "uuid": "d4483b87-8c4d-4b73-9774-ce7103587676", "comment": "Malware payload", "value": "c87776ccd9ed80f2991ca3c28ce999b734eef778f49f7a870ca6938fa086f0cc63c5ad83447381300d00e04014ee5fb3", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932437, "uuid": "f9595db8-0ce2-4fce-82bb-980a9313e4f2", "value": "T17CD02BA11AB9C7500444D9243174F944AF903BC0219D7EE47FE6F36488502E1C525A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932437, "uuid": "2275ed76-bb02-4caf-9acb-75e076854588", "value": "6:rz8SFXF+RLgyKBM3S1z+ILh8JkziZw1T34WSV2o4VhRUaep1T34W0:X8+ERLgyaIS1HGuziZwh2MhXsh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774932437, "uuid": "13e93d0a-642c-4625-9887-547bd45af06c", "value": 265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774932437, "uuid": "9e37c4f2-622b-4f09-9244-0c08759747b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774932437, "uuid": "4aff43c7-2d76-4313-9b80-8ad8e309e2aa", "value": "f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c9eebf-2cda-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1774945355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945355, "uuid": "189369bd-ab3b-4744-a135-1c9c5a68c5ae", "comment": "Malware payload (GoToResolve)", "value": "b7ab15e5f6fc0fac40e4a9d5e512f402", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945355, "uuid": "10c06412-96b5-4a73-ba90-15066a54e8be", "comment": "Malware payload (GoToResolve)", "value": "faf5f74da30234e90e698a345374f98e32e7738ce1ff266b70c89e801f2c8790", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945355, "uuid": "9220ac73-f48b-46bb-896a-3b0634d5827f", "comment": "Malware payload (GoToResolve)", "value": "0146c5a097bb43d117613864c251dbcc92552da6", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774945355, "uuid": "32d8483f-25ed-4880-b617-6bfebd391a75", "comment": "Malware payload (GoToResolve)", "value": "6dd8b3107959634612465445b67428b25075e543d122b1934c299d5055c8fb51b8c69ff368cf3b1e2267fedf3a2cd708", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945355, "uuid": "6ed41dfe-488f-4214-ae98-418a581388f2", "value": "T1FC61543BEC0785B392328861D5829D4CCFA2157B112644F9BA0C84952F387AEF5F55ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945355, "uuid": "b55c6bbf-72e8-4b67-8630-9efeb16f10a4", "value": "96:QhSUXusiZAvJq7ARZlLBc/QALwj7N3Fmh+M/sEOuMVy:cSUXussAE7ARZllc/QALa/mhL/sEd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774945355, "uuid": "47df6032-aaa8-488e-8a3e-75aa7d173dfa", "value": 3282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774945355, "uuid": "e15f8daa-e444-4aa5-9e11-10f5433d7273", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774945355, "uuid": "69adc0b6-3433-4126-b33e-0d5eefd61264", "value": "T4-Slip-21108885116027721.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e752a3c1-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959585, "uuid": "17ccd752-0a52-480b-9bec-1846ca5e003c", "comment": "Malware payload (Mirai)", "value": "98a1307e711744a7c4a567fc91a7de8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959585, "uuid": "55f686b8-35f2-4394-a996-cec1a796b6df", "comment": "Malware payload (Mirai)", "value": "fb10cbce3b750290774de552141bdfee2b97f43c29b8a8e4be04fba0a2c0d5e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959585, "uuid": "c7aa9ff3-bd6a-4e19-9b8f-f655c11b7151", "comment": "Malware payload (Mirai)", "value": "0d16f066f25639383ce94701f8d71a3a3076fca8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959585, "uuid": "f8a69796-851a-48aa-a741-0f1066904891", "comment": "Malware payload (Mirai)", "value": "dbc2e5ecc9eafd56a2e40c98ecc323dd375c823e702a93574e7f6f596eee19308a3f9459177aed64980592734f0db48b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959585, "uuid": "c0f43a40-1c01-4f81-91fe-5f71743e5c23", "value": "T1DFD308C7F900D9FAFC0AE7374853080AB230B7A549925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959585, "uuid": "6b389822-30ab-4f59-936a-f4db799cc4dc", "value": "3072:kSbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFIax:0rybytG/Oyi42VOgLNBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959585, "uuid": "00ba730e-969b-4375-892b-d0272d2b8ca6", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959585, "uuid": "a6e3f9f2-503e-4277-92a7-46696cee2403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959585, "uuid": "40185e2b-8cde-4e13-b9e2-f665792bf564", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad40180b-2d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774979674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979674, "uuid": "fdedf636-40c8-4366-aa65-600aa87683ab", "comment": "Malware payload", "value": "3bf0792c9a99ae101c0d3643ff37c2ce", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979674, "uuid": "59763c4e-e1ce-4778-b325-a8464ff5e2a0", "comment": "Malware payload", "value": "fb8d3c2980dd99edcd146cb2e3439994b3d9ee203d4bb692e2eabd6fb0fac9a9", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979674, "uuid": "bde1e6c9-2e8b-4795-ad22-2f6392385d0b", "comment": "Malware payload", "value": "a39331edfdd51de1f02256ae228324b69eff8e43", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774979674, "uuid": "6fb9bc41-b591-4b23-a4e4-7bba8aa01121", "comment": "Malware payload", "value": "147ba34cceca0c8a903b1e5159b67443b1d5717909357fab8e022c250de53a49509f1b67272f7771d4a770ee08c53a91", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979674, "uuid": "1e0c084c-9dae-4eb1-bf91-444847f91a81", "value": "T1EB5531A25C8D6C6CA659CD078315E92B095B78D4B290FF5237D1EB61AF433C0DB072BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979674, "uuid": "a4834682-1dce-4ad0-8673-f454e8cfdb5f", "value": "384:WwSpMezwws0elPVGRjVD/bJoKXBDzcazje7dkj2MuSru68F:WrpMezwws0erGtlbp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774979674, "uuid": "dcf062dc-3ebc-4447-a78c-65b093963996", "value": 1306987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774979674, "uuid": "9e2083c8-4814-415e-bc91-036b8d98d508", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774979674, "uuid": "adac95c8-91d1-4206-adb0-9a02f9619d2d", "value": "1SMAR30_UK-Vioooooooooooooooo-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d2514c-2cd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774941547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941547, "uuid": "25ddda53-3861-432f-8f59-8eea13d6620b", "comment": "Malware payload", "value": "23e603eaa66a779bb3170f894eb64d5f", "object_relation": "md5", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941547, "uuid": "d4ff744e-e216-4a95-878c-dbad59c66ab1", "comment": "Malware payload", "value": "fc1f719c4c269cda61c3b614a09c4cf11b20acdf22b04208772d935fc0dc8d59", "object_relation": "sha256", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941547, "uuid": "9a11d20e-4695-43bb-a0ca-e399d855b5dc", "comment": "Malware payload", "value": "6525687fd95c702d49bc651a4eb4975928f22b42", "object_relation": "sha1", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774941547, "uuid": "cccd4cb3-6303-48b9-8121-57286766583a", "comment": "Malware payload", "value": "738d6697c56c5ac7a018820e03a5365b7742993ce616e648d2cc9726fe2a0b022e4d446e4c874e3300fb9c359fff72a9", "object_relation": "sha3-384", "Tag": [ { "name": "hui228-ru", "colour": "#F27514", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941547, "uuid": "0c413887-3134-490c-8623-336816b626c8", "value": "T10743562879BA5019D537FF713EECBAEEDCDF262269056457104203078A22AD0EF5397E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941547, "uuid": "f35e8488-0d67-4cbf-8f24-09bce103f5f4", "value": "768:XaSdeV2FzH2CtGXQBpI+I7Az5s/nme8e1c6g4lCo1yi122Nar3lBP40F+tKj472:XaSxwBPmsc0QiwkeIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774941547, "uuid": "3bad00ca-0d7d-4e74-8e5e-886938df1179", "value": 55930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774941547, "uuid": "2b9092ac-ce69-4f84-992a-00640bbc3e89", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774941547, "uuid": "18d1ed5c-aac8-4bbb-82ee-1c4b84182de1", "value": "fc1f719c4c269cda61c3b614a09c4cf11b20acdf22b04208772d935fc0dc8d59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bde1200-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774959378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959378, "uuid": "03b160f2-2f70-4c3c-9bf0-e004cf29758d", "comment": "Malware payload (Mirai)", "value": "f0bbad033d7ea9102676837b0b3e9f21", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959378, "uuid": "074f7a1a-81e3-4ae3-a9c7-16203cc0f79a", "comment": "Malware payload (Mirai)", "value": "fc3082894847c2111f850eaa72d7a77178792e08124c92cfcf689e89283b787c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959378, "uuid": "c80c951c-6f63-4290-8827-b9f733668d79", "comment": "Malware payload (Mirai)", "value": "88dd354ed7abf54567f24d317f4cec7e98ac6fb9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959378, "uuid": "4f85e142-0ff3-44ae-92ce-8578083a8f6d", "comment": "Malware payload (Mirai)", "value": "89ee59875447e47ac80ca7e19c84fdf63285e59cf640be9a1babd26ecae6b6fdf98b0c35065be1cfe81e64e3f8d8a33b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959378, "uuid": "82a3873a-7e91-4b65-898a-88d8774b9bd9", "value": "T14C930C46B9528E12C5C212BEFAAF415D33136F78D3EE7212DD20AFA063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959378, "uuid": "d4ccde7a-b371-480f-a331-afa6cd3e6283", "value": "1536:gknJxjhCMsBMl3EVGpOFnbRfGqtCMy05LyHQ4YE86v5aeyXc8aRQeiC4VfC5lzcZ:TtC5MqVGpOFn1fGqtCy5GHQ4q6v5aeTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959378, "uuid": "92478981-293b-481d-ad09-d99d897f40a5", "value": 96864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959378, "uuid": "edc2ddb0-b672-45ef-b690-c0f36909eded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959378, "uuid": "076e05f9-c8f8-4f98-832c-10cf95a8c9d3", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3790e975-2ce8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774951130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951130, "uuid": "83cf06a6-1e71-40b5-8681-9158c04d0de3", "comment": "Malware payload", "value": "9663665850cdd8fe12e30a671e5c4e6f", "object_relation": "md5", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951130, "uuid": "1d9b90ad-06d4-4836-9fc5-9f343bb12208", "comment": "Malware payload", "value": "fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf", "object_relation": "sha256", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951130, "uuid": "48e360d8-3d67-4989-b28a-aa3c0bf3f700", "comment": "Malware payload", "value": "59faac136680104948e083b3b67a70af9bfa5d5e", "object_relation": "sha1", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774951130, "uuid": "6081040b-3f0d-4f37-9ddd-fac3ebd0dbb1", "comment": "Malware payload", "value": "740679e6c5e2b8237cc6e53bba9eacaa0a8d8ba69a06b72eb384729f710b28c84a4348962396cd1f612d087192497b7a", "object_relation": "sha3-384", "Tag": [ { "name": "Axios-NPM", "colour": "#7D7242", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sfrclak-com", "colour": "#820E25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951130, "uuid": "6dc7a2d3-5e71-47bd-8e40-6230ca8d8e66", "value": "T129423016CC2E68028DF2921D9C27C1A5F714635717262913BEFCD25C2F348A2D1F9ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951130, "uuid": "7298d4bf-61a6-42b6-8b02-4c9696b5303b", "value": "192:V+OTSQFF3MjzSCII7s32HaYo5uuFe0+60U2WICd/tPQTnd/Y+cLL2dPj47Hp79Bb:V+OTJRCII7sRdI8mT+IkUAsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774951130, "uuid": "90b9f586-30d8-4004-8f06-47f8af784cd7", "value": 12323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774951130, "uuid": "ada61724-e14d-4081-b1d1-0d09ce7b3fff", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774951130, "uuid": "aa73fe19-87f6-4de8-8bbc-fc3043b5abff", "value": "ld.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b739717-2ccd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774939513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939513, "uuid": "ddf12245-720d-4f72-b755-0ac8e6ad4998", "comment": "Malware payload", "value": "7ba1d4b49e00ffb59b0effaddbc78f05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939513, "uuid": "cf1b1781-5dee-4e86-9f75-75bc054bff4f", "comment": "Malware payload", "value": "fce1249adde898a0b254334723106e922b9f646ef2e3f78a263b12677e7085e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939513, "uuid": "4a70d068-5e19-4c36-80bd-89f0fb67e326", "comment": "Malware payload", "value": "a405ea1a187a435860d0d3ac97adf3c5fbc4e75e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774939513, "uuid": "7b12cfab-025c-4d23-bc93-8c3a40b00da5", "comment": "Malware payload", "value": "eb83e2771ba52e3443e5b19394dc90445da8459e08227d6b0e00b47f15cfdb79a032c2ccaddf5e2c3cec963cb0e3eef0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939513, "uuid": "085be21b-f492-436a-9334-650a19da59d0", "value": "T132A4EEE92EC1F1AD0F826937F21AF06DF0F498F0536A4C69B0DD5C48F8A16D4AD69235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939513, "uuid": "31e04c43-a6a2-40d5-a753-846f06307199", "value": "6144:VqSjpivw4jFDN7LFx/noYbITm3tDcP59K0gdWcmG01S5cW5Ux4:VqSjpswU7LfoKdcXcD5caO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774939513, "uuid": "4e245719-df36-4e4d-8878-3a827d080e2b", "value": 484228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774939513, "uuid": "38d7550e-6d08-4a8d-a68b-96d7f2b8b505", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774939513, "uuid": "8ad4edf1-7f2c-4211-8b57-78dec4090cca", "value": "0066927_Ocado.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa96c9e-2cf1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774955054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955054, "uuid": "b721629b-3810-4462-ac44-933e1b2f976c", "comment": "Malware payload", "value": "10384cde352ec635214b09dfab837b8a", "object_relation": "md5", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "va-py", "colour": "#F5B9B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955054, "uuid": "78d68318-a7e6-437b-900b-b445bdfe01ae", "comment": "Malware payload", "value": "fd9d6fcadd1cd2fdc1564c9a44cff4876a27beb212aef4b5702e5647233ae998", "object_relation": "sha256", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "va-py", "colour": "#F5B9B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955054, "uuid": "c8b31c94-3104-4ff0-a30c-7c82780c18c0", "comment": "Malware payload", "value": "f92a777cf38ef1720171205c2b710c8d60818f36", "object_relation": "sha1", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "va-py", "colour": "#F5B9B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774955054, "uuid": "85160d7f-1d55-4978-9eb0-baa02cf3c890", "comment": "Malware payload", "value": "3f754b84b0ff264a01feda387ad6a357428990aac169692ca35fa762ad4ad7455f24595098a10747927c0f04f4ecbc75", "object_relation": "sha3-384", "Tag": [ { "name": "individually-bangkok-dedicated-static", "colour": "#CD2822", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "va-py", "colour": "#F5B9B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955054, "uuid": "9dade4de-c0f4-4339-a209-a331f0e3ea6a", "value": "T17B92FB019D9CE61503738969E502D563F58B170395BA1A3AB7FDC2B82F34238C6E8FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955054, "uuid": "b5ad6f39-d5b5-4aab-8db3-68e47a4c5c4b", "value": "384:5Hze5FnAiE1A7nnnn+7AAU4CJ8FdSUpQ8Gs+ni:5Te5FnAiE1A7nnnn+7AAUx8FdSb8Gs+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774955054, "uuid": "9eecb2ac-7fdb-46d9-af45-6f33d39347bc", "value": 19625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774955054, "uuid": "0f64f371-9709-4368-b517-860136b900f1", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774955054, "uuid": "9e5d4ec4-9244-4738-b365-be628e87c66f", "value": "va.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faf40a6-2cbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774931816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774931816, "uuid": "f3300d56-cc23-4f01-b5a6-615fdf3c1c73", "comment": "Malware payload (Mirai)", "value": "51c5d657885c357281967f958314b84c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774931816, "uuid": "35fd1713-3b41-4dab-81ed-be7bdcaa8fe1", "comment": "Malware payload (Mirai)", "value": "fe334cfac7c661cf8e7c1aeef56a1bf06ebeef717f433aad096d11666c48e58e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774931816, "uuid": "e2bf7654-01db-4d59-9d89-f71e98a675e0", "comment": "Malware payload (Mirai)", "value": "c046542953376bb1ac38e9f87fa564368bacfe0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774931816, "uuid": "08b445e6-bbe8-4f3e-ac77-0c5a94cef714", "comment": "Malware payload (Mirai)", "value": "6689e04967a41a9976d7affa14e10e81e035851e838b5d96c01d2a67476f68a28140000394ef834020aa6f6c38bd1ca0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774931816, "uuid": "203c2110-f902-49ff-ba4b-4d0099865492", "value": "T1E9167C0373F5457AEAC05A358BFA43533286E6A464D54B228F50CE6FAF22B5328714FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774931816, "uuid": "4dded46b-2b86-45c5-bc2b-b94aa43ddca1", "value": "49152:gvpPY6HUuxCuIroJqBMb0atjhWwN6yaoqAPGpyk:gvpPR38DrFMb0atFWwN69oqLp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774931816, "uuid": "e8a34bed-35aa-414f-b4d4-e00899f249bb", "value": 4336716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774931816, "uuid": "6da401fb-1319-4f4b-a9cf-49a3fdf0965a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774931816, "uuid": "4578b07a-75bf-446a-b0a4-5f9b4daa9b0e", "value": "wlan.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd00f786-2d3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774987109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987109, "uuid": "e9b2e2c3-a938-449a-8060-c831ce451eaf", "comment": "Malware payload", "value": "a24ede051050bb416ee00751cd9017c7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987109, "uuid": "5f07a3bc-c3e3-4cef-8473-d3ed37283741", "comment": "Malware payload", "value": "fe33d62ccf69d427a9a56be71d6866b5a79d92edb65d3ea248bba6da8cf31354", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987109, "uuid": "c3637f55-d7f8-4320-a306-65f123cc18e7", "comment": "Malware payload", "value": "2f3d3e1f22d401c2beca63ce472c13d214979f33", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774987109, "uuid": "81fb817c-df70-4301-8900-a93543e8396a", "comment": "Malware payload", "value": "20093e263e7815f80750eae083cc8dbecc32a703b712504dc2ffd4fd8ef062932b4b1e7971bd6e32decb568366c09b22", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987109, "uuid": "d05c1a29-a546-45ec-870c-3ddd08bebaa4", "value": "T1CDE6CF1A7B988179D17BC13889878B87E7B674114B3187CF62A0176E2F337E15E3A721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987109, "uuid": "29361fb4-240c-46c1-ba01-a85e21697245", "value": "196608:RrPtpRmPh7HJWokaLfdfHk/Y5z47N7WnQexrYSVFLkL5yL4QF38eRZ:/mJ7oN2f5z4R7WVxF8LQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774987109, "uuid": "0ca4df8c-a1ba-4195-b5b4-c52c6fa73d66", "value": 15175668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774987109, "uuid": "1c23d4f1-ae22-490f-859a-6e95bcf453fb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774987109, "uuid": "881eb86a-8b06-4de3-90a8-9829d7cbadf9", "value": "RWBHGSQS.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c8f6e4-2cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774959393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959393, "uuid": "c011006c-fb1e-4bce-8131-a26df98f321f", "comment": "Malware payload (Gafgyt)", "value": "f21a9b74f3eb953f7988b2f5c371fb2c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959393, "uuid": "60b4e732-0743-4244-8b33-9bbdef0663d2", "comment": "Malware payload (Gafgyt)", "value": "ff3d8b267779baa521248ebb38be498e55cf56304029d15bda87f476b8bc6634", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959393, "uuid": "35b36dbf-8259-4cdf-b5b7-4def9a5a4cbc", "comment": "Malware payload (Gafgyt)", "value": "d98d1a1d0bebc267f2c7968616160bac69885830", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774959393, "uuid": "bfc4edfe-1898-4670-a20f-c24e07e4761a", "comment": "Malware payload (Gafgyt)", "value": "8a913225ea43c77c4c78f1e68490f675480c8c990ee82b6cdabe4744e897dea83769fcebf8047e2f5df70570b942a5a9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959393, "uuid": "b292b41d-1689-4aba-97ed-7cefb0e94d7f", "value": "T12CC3D506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959393, "uuid": "dedfd716-3d9c-4538-aed3-a16bf65a3f7e", "value": "1536:j4w4zW/h4SZsqEz3UrgiDSAPrfO4jaXbzjZjCfPNXm/iRK0UgSSWt:0xW/rZsqcUzfHjarzjD+XWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774959393, "uuid": "2a8e5529-4091-4ae7-bca8-574b94f5ffc5", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774959393, "uuid": "4c8c1fe6-af0a-4e5a-921d-3bcd41aa0967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774959393, "uuid": "2f126851-b6c8-4e78-b30a-e43b65218d75", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f767312d-2d11-11f1-a769-42010a9c0008", "comment": "Malware payload (Pay2Key)", "timestamp": 1774969061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969061, "uuid": "7bfdba18-8ab0-41e4-9aba-2ee4b69e315a", "comment": "Malware payload (Pay2Key)", "value": "6a53423827f43647cd5f0b23ab785f7e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "Pay2key", "colour": "#3DA74A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969061, "uuid": "f9c68cef-8f42-47a2-a8bf-a0bae6949de5", "comment": "Malware payload (Pay2Key)", "value": "ff9fe19f2fe7148190131b48fc6e92a4a33569c990009edf87737e4cbe56cf29", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "Pay2key", "colour": "#3DA74A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969061, "uuid": "fb97e756-7501-4c68-840b-646328f308d9", "comment": "Malware payload (Pay2Key)", "value": "701329d9ef8c36ef89e402d25ba1b76dcb2ff14b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "Pay2key", "colour": "#3DA74A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774969061, "uuid": "8e8353f0-56f6-4124-a832-65b6f71e66e5", "comment": "Malware payload (Pay2Key)", "value": "869757d061ff2eb2713fc26f87e217c28e7420a74f16f9ac39b62f8a15a14abd30f33d6036575c59058ae89c0fc4c396", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "Pay2key", "colour": "#3DA74A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969061, "uuid": "52ceb360-1be2-437c-b679-72dbd89544e3", "value": "T1BEB5331137E3CCF5F589663225919BA23D9BFB2103E653DF3BDC2A9208205C5D9F0A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969061, "uuid": "8da472e2-3fff-4118-a079-7c341d2e2a7e", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969061, "uuid": "a5eb377d-2616-463d-9ac6-4ac586ad953d", "value": "49152:AgwRW3PSS0qm4ZqQn+NNozrP4Fw+JGTb1/t08EHBDlW:AgwR8k2dnAezAw+Ji1/rUZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774969061, "uuid": "6b966f00-635a-4734-b909-38417b84dbe3", "value": 2342551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774969061, "uuid": "a1c301dc-7346-407b-a68a-1e40c5fbd25c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774969061, "uuid": "e92e055b-d1a8-4ecf-b4ef-fe6047ea8239", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ec4b1b-2cc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774933870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933870, "uuid": "24bda8dd-5598-45f5-9fee-1156ec091699", "comment": "Malware payload", "value": "78ff8ba7304c4b82c823572a5773ecaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933870, "uuid": "d5ecb203-1dd9-472e-8073-ff75fda6671f", "comment": "Malware payload", "value": "ffa3d038618436a59bbfc0cdf36b6a8b1ff566b7a612428b3f889862a6d29c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933870, "uuid": "f06c39d9-4f90-480f-9a1b-672d71a415cb", "comment": "Malware payload", "value": "b5e22f82c9cc1107038abe3e3267d426e3276002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774933870, "uuid": "0dd61f05-42f3-485c-8b42-aa0c16cd192d", "comment": "Malware payload", "value": "67b77edc5a7d2f3444ab0d94139d7bb167d0673c4dbf5693491d0ff590b8af8adc1cee57fce9320e0c149d01b39782e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933870, "uuid": "c8f6c3f7-81e0-4746-a965-5c972f10798d", "value": "T1E8468C6AE6BD00D4D8BAC179C2866227FA717C5543B447CB5A50B6E60F33BE06E7E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933870, "uuid": "39daf235-3109-4b65-bb47-a8dd610193e3", "value": "efadd9dba7ec83799af5c019e48e19ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933870, "uuid": "9cd1b98f-a205-45a7-b60b-ef27d1807ec6", "value": "49152:YmVwASOPGtlqxY4aQ6e3O2N8pDl1IobjW6/YvfyiWc5QXrL39z3Xp9/qVP0xJ4yo:EnJ/bj8qiWcELtBxJj++0p3vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774933870, "uuid": "bf501ad8-a9c3-4179-88a7-bcef2e8cee71", "value": 5845504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774933870, "uuid": "cb3fd8fc-978b-44bd-85b1-c339490458e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774933870, "uuid": "75ba3a5e-9a59-40f9-aac3-179a3abf30ca", "value": "ffa3d038618436a59bbfc0cdf36b6a8b1ff566b7a612428b3f889862a6d29c21.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }