{ "Event": { "published": true, "date": "2026-03-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-07", "timestamp": 1772928181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a360843c-a474-49a9-98d8-6acab30f9224", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d28242b-19f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772866442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866442, "uuid": "f1138a44-f3e3-493c-80db-eaeab2190661", "comment": "Malware payload", "value": "7e63e65d4d7e3b2fd52312e77ddd8278", "object_relation": "md5", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866442, "uuid": "3569462e-dcf4-4742-a550-29764b9d6df5", "comment": "Malware payload", "value": "0096d75048467d5a578ae590bc4a9451ae1a02f39de3a03546097baaf8e22399", "object_relation": "sha256", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866442, "uuid": "b3d40767-989d-4bb9-a5ae-659943a6440c", "comment": "Malware payload", "value": "afc0d5d49cf3661d900f2e8ebac11fa1644ba1b8", "object_relation": "sha1", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866442, "uuid": "fc3df82a-629c-4b86-bbae-733573c205d8", "comment": "Malware payload", "value": "3ca6931a658e44a88302936c3893b4e119d86baebc5460b446c703569c7109b5fa4e9fd5ce8833b264d4ed88b6ef89e4", "object_relation": "sha3-384", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866442, "uuid": "1f2c400f-5eb2-47e9-b804-ab97e2738128", "value": "T1EC119E39E3F9D30CB569B09B9BBF8B44742891EE93C075090AF482D8A970120DB75F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866442, "uuid": "fb5f8f8c-f939-463c-be3b-f0109297780f", "value": "24:+R/LDQjj3RmMgW9TcZmO6B2O+ZL/j365HO+v+jO+oO+oO+v2rO+v9ZO+x:uDDQjDRmMnTcZVrpJ/D65Hpapopopv25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772866442, "uuid": "879dc84e-c11a-4556-a201-29c1a93377a0", "value": 1001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772866442, "uuid": "fca84ac5-ec53-4d93-83a7-cf4db9567a67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866442, "uuid": "dfc02e0e-9807-4871-b7e4-6194604204fe", "value": "client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702b9be2-1a25-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1772888352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888352, "uuid": "7a8c21dd-b54e-4073-8837-513332122549", "comment": "Malware payload (SliverFox)", "value": "67b0c5d5a10c1bb5e85065d33224320f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888352, "uuid": "f6963991-62d1-4372-b962-f30e08bc295a", "comment": "Malware payload (SliverFox)", "value": "01505bf6efded437e348c587395a09abeb4412d9d754bb964ea0a86a80e99ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888352, "uuid": "1f01d6bf-0226-4a56-ad9a-97186538d419", "comment": "Malware payload (SliverFox)", "value": "eea6fe95d6ffb2706b3d32571fe701548ae34e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888352, "uuid": "f670206a-a0e5-4dcd-bd90-77130f7b36d6", "comment": "Malware payload (SliverFox)", "value": "1cfe01157c412c1ab3f0aadd9960c8f0ac8a5026ac9dc48925f96fa6c83c92d09b46c007f7aee7abb22fdbb57ee7598d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888352, "uuid": "ea9c61f6-6462-479a-9bba-98fb4a614e61", "value": "T1ED65230CD616D4E1D61B0370E4B29B9C9561ED206FE4475773AA3B2EAC331E86C2B3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888352, "uuid": "67505c55-e11b-49b3-b79d-ce4d3b0a8034", "value": "923b402ce0fe56023d103d6fee0bff99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888352, "uuid": "8abfc63d-bfc1-4c3d-9425-99629c07a8bf", "value": "24576:4CZJDCXyvdKg4vXNNJjvSfaaRnSsBKkLxnRF+x2SLJh8ceFe8ulHlgd:4kBWWN4/NKXnS6/ny8c5rlHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888352, "uuid": "6090ed6f-0250-41a3-b62c-7cbc03dff2ba", "value": 1412608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888352, "uuid": "4a15f8f6-58f1-4c1c-acab-6c1f4a60ef7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888352, "uuid": "cc30b136-4150-40d1-a149-be90a1ca2be9", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u4f01\u4e1a\u5185\u90e8\u8fdd\u89c4\u4eba\u5458\u540d\u5355\u901a\u62a5\u4fe1\u606f.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46b1d4b-19f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772866991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866991, "uuid": "464fd82b-aeaf-41c7-b3c2-2b3caeaed26b", "comment": "Malware payload", "value": "17f8b110de17fb7c7033db6fae1ce4bf", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866991, "uuid": "e2ae9072-f475-4c69-a646-afe817ab1ec8", "comment": "Malware payload", "value": "05b0028d90b004bad77de0280b4962498a819910c37a9088a3d1b6f736dd1abe", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866991, "uuid": "1a9f8984-743b-468d-acff-47c91940ca66", "comment": "Malware payload", "value": "fced4dc7d7967b404770f089f2938d5f393bcb63", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866991, "uuid": "5c4ce3f4-5758-4430-9de2-acdc0aaf0013", "comment": "Malware payload", "value": "76191c1d4e1b8a5f4fd07e3cf204948aec3fa36385930f6a3c2c82d193ed644218108f76da849adc5850bbba66e2b3b9", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866991, "uuid": "c1bfb46c-2368-4e6a-92c1-4a4e5ae038ff", "value": "T1727412B35AD6BD3DE48E81F3209378B4F2552D028934712A5A0357CC8F2359E4926AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866991, "uuid": "3adb0815-776b-4e94-ac0e-a31494cc382d", "value": "6144:BHxktl5lNXlEMsBkUK1pownvPo1zCHaXt/TbgHMeIRTarJBEZ+FY/OZEFObdLYYj:7ktl/NXlQBkUK1Dvgd4wtr/hRozEZExj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772866991, "uuid": "3dcfed62-516e-4e21-959f-d71d9391cad4", "value": 355013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772866991, "uuid": "dd5d338a-2e01-4029-942a-b53b3f120c4c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866991, "uuid": "8d7fdd52-d21d-46bf-a517-ede37c3fd5cd", "value": "05b0028d90b004bad77de0280b4962498a819910c37a9088a3d1b6f736dd1abe.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cc5cbd-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1772865031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865031, "uuid": "cce35834-a164-434a-be9a-5749016e282c", "comment": "Malware payload (Gh0stRAT)", "value": "fbf7ef6cc7b1c28d0577a15a2ef64eb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865031, "uuid": "c68f3490-4964-4804-a6df-e68da6fa9f72", "comment": "Malware payload (Gh0stRAT)", "value": "05c074c995b6ea329f80e60f57e00f7a0d6dfa9714b203002f6f026953ff6cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865031, "uuid": "1cdb776a-acef-4c68-b4ae-5a5a40b9619e", "comment": "Malware payload (Gh0stRAT)", "value": "d93cec15dd505855404c2ab7d202f1cfd4629f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865031, "uuid": "45b544da-c072-4b79-895f-01882400f87b", "comment": "Malware payload (Gh0stRAT)", "value": "d8476904dc3bf57309c7072a861cf0af808bb6e6e8fc3db51337cc2999cb6b5b269da3026b2c6dad8a05e3311d7f4482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865031, "uuid": "7855d75e-d221-40cc-ba27-fdde06ed9718", "value": "T14E18330AC5ED6470CECA40F0CB23039E8638BD6A03B5C6F753F0B64D89695D4A679F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865031, "uuid": "981a5fac-ac6b-43ba-ad4a-5481b05515af", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865031, "uuid": "0c516726-2888-4d44-b766-3c4a60c74bd1", "value": "1572864:MoOkxszXRrhqZ5r3V2jpFsBfkyh9KHPe/EbhrFEapC7WwW83mYlqxuS19B3e:MfkKVecyh9gAkJWaU7WwW83m+qxbve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865031, "uuid": "77e0dfcc-789f-456f-8da6-4617fd0da6bc", "value": 86732190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865031, "uuid": "52f5e88b-08d4-479a-a7a7-e7b116cf5dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865031, "uuid": "74232bf9-5254-44bd-8810-c851c870c7d1", "value": "A0sysMiaic_Jianq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad8d924-19d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772854037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854037, "uuid": "30e10025-ecdb-4027-a820-cbe7e61a8d02", "comment": "Malware payload (Mirai)", "value": "a370e350db79d9cc652590946b9ecc04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854037, "uuid": "87894cfe-fa24-437d-999c-1fcf37751a25", "comment": "Malware payload (Mirai)", "value": "05f12b8ecb8e4efbba6b329bec7d734634b496df802b44f9edef43ae63267482", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854037, "uuid": "372c1bde-6546-4e6d-97d9-8ffcf57f0fdf", "comment": "Malware payload (Mirai)", "value": "417fa00408275861fe9c4ae2e53e6807605ae047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854037, "uuid": "fc1bf284-c021-4de6-9cc1-289751224d3c", "comment": "Malware payload (Mirai)", "value": "090266ef1ee32dff3e50c6dd07d2606b548c0437aa04476e27f98fe665f6f641cf2288b25574b088302928ebca1915fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854037, "uuid": "b2d3a8e6-995d-4b9d-be6e-03bf8a7dab9f", "value": "T1BAF30845BC519B17C6C616BBFF5E428C772A2798E2EE7203CD156F20379B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854037, "uuid": "2e51054a-e3a9-48d9-b520-a86af4effe98", "value": "3072:xnzPRz2ARfG3x4N0p8gIdV9iDxZ4i0BUY2I0emfncpO:xzPRz2ARfG3x3p8gIdV9iFZ4iQUY2I0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772854037, "uuid": "eece630c-9dbf-45ca-8fb1-843c9fa11999", "value": 161176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772854037, "uuid": "f966f5c3-25e8-4ddf-a59b-be5836fec891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854037, "uuid": "7a109abb-211d-426f-a396-644ab1ddf061", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ad83f5-1a47-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772903014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903014, "uuid": "7ffea286-44c2-43ed-a1c9-bcc243e04475", "comment": "Malware payload", "value": "6fb2f7d81dbbd83fb23042638385e7d4", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903014, "uuid": "e8370606-fbfb-4633-a211-b867aa1e20ba", "comment": "Malware payload", "value": "06c7cd604169e32a75d1f410c1d9ba47c39e0e9cb2039a15de75c12eb4c78e6d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903014, "uuid": "0ca52ab1-7bdb-44fb-acac-14d07eedf8d4", "comment": "Malware payload", "value": "8871b1d3c1fa40f5c2d13a4e685d4e60a03bd962", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903014, "uuid": "8309c61c-f7c4-458a-8023-22f53c54b576", "comment": "Malware payload", "value": "626dd6590283da00b56af7a4252a844eafab4340fe0b7e2440c35906babb6be6d6585537dbffb7e98165c29139ddc23a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903014, "uuid": "1261bd91-1304-483b-ac24-e71485f0ed9c", "value": "T1D586BE15A3E415A5D42BCB38CA15D333C6B9BDA28A36C04F0999F3C61F779628F2F611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903014, "uuid": "65abdd69-6f7d-41f0-bfb5-f9c98f70d2b5", "value": "29902699352c781de4751ad9302066eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903014, "uuid": "de527642-ae4e-4164-a91c-c0a840d52559", "value": "196608:6uu7uDVMREh1PXUAoE0iO0RcpsZWR0Nggvj8faZUwqxtVjA:ru7uMRi1vkEIxC34j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772903014, "uuid": "75477507-067c-416a-839a-ebe9d48fd10b", "value": 7917568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772903014, "uuid": "3fcc7eb9-7c9b-47f2-a34d-518c1db4cf06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903014, "uuid": "997703f6-b1c8-486b-a5a9-131da3e2b517", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91512c1-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842115, "uuid": "bdd3fd91-dac4-43af-9d7e-830fc77faa7c", "comment": "Malware payload (Mirai)", "value": "99ebf95ded1aca5e3ebc09928e177623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842115, "uuid": "99fcad15-530d-4bac-bc88-384a1508dc4b", "comment": "Malware payload (Mirai)", "value": "073933625bf9f2f7b3c93d43ccbdef7c8500af30cf43a1e5e0537760760d8b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842115, "uuid": "e91f70b2-0121-4810-8f51-c72ef89cdd3a", "comment": "Malware payload (Mirai)", "value": "b06bf0c3f840c5fe2829eff4ef2572d2e7ffbd41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842115, "uuid": "8a11fc30-2091-4560-ac73-8e5e95a2d34f", "comment": "Malware payload (Mirai)", "value": "5630c73f127c11bc55514c093b65ef6d10ccf0849abc6daf18f61aa326d642e7373b3e114ed4869c9e12f9240bc74711", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842115, "uuid": "3f1c046e-fec4-4671-bc80-f887bb550343", "value": "T145144CD7F800CDBDF80FE73A84174906B131B3A21493473B625BB967AD3619A4963EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842115, "uuid": "af913ad6-e59c-427b-92ea-fa0971976d00", "value": "6144:EZLStPJrsYTW/48G9J6umB5W7C6LbKypzkwdm:xFW/425gZkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842115, "uuid": "a46504ea-9ddb-4aa3-aef2-18b8d52a8883", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842115, "uuid": "25f9a6d1-414d-4a5e-b422-f7913e7ad38e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842115, "uuid": "4819c194-7477-4402-8632-b8306233e54d", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5678a6-1a02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772873501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873501, "uuid": "c4cc2075-0cb3-4dc3-bdd7-5864d0ff6b8d", "comment": "Malware payload", "value": "c8dbd37cd220b72548a1fdf919b4c71d", "object_relation": "md5", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873501, "uuid": "c90a40d3-e51f-42f6-a7a2-2ba690587f85", "comment": "Malware payload", "value": "07f56ac8b5bd7cdb4c33ea5e9cd42bc7f9d3cd5504aabbb476ef010a142d7e29", "object_relation": "sha256", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873501, "uuid": "35ac92a8-e116-464d-ac46-5787717d5d64", "comment": "Malware payload", "value": "6336ee00c19db6765e07f0b5befc5d089a2e65c0", "object_relation": "sha1", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873501, "uuid": "f2d0b2ac-bea8-4e1e-932f-4473fc6a89a8", "comment": "Malware payload", "value": "ea13f4a645135f7b8bff341a62a48147f26b57333d850e4cbfe236a9eab217121c90f29d10c8f2a49cf1ae236486503d", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873501, "uuid": "813d230e-b727-472b-b550-88c2a6be6508", "value": "T1C9E512013FFC9E02D1FF2A75E97229C817B5ED069552EE0F0941B19C0DAB746AD243AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873501, "uuid": "31361677-18f8-4f7e-b0bd-815ab4cd2a76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873501, "uuid": "3f792e09-9d88-4f31-a36e-ceef49f5cd4a", "value": "49152:SVSTJmhnmpBZeM9/LwVkFG6X4cFy5FwsAQpDygNAypQxbd2o9JnCm7FR4ncFf3Iz:SlJXlVkzAFwRQprqypSbd2o9JCmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873501, "uuid": "a41ca011-c9ae-4782-8e2a-2cdd5a9f4baa", "value": 3135488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873501, "uuid": "c99d6af8-13d7-4b57-bb2f-2bde501f9989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873501, "uuid": "14f406b1-c019-448c-bb93-c68dfa8d2ce8", "value": "07f56ac8b5bd7cdb4c33ea5e9cd42bc7f9d3cd5504aabbb476ef010a142d7e29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb96f09-1a51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772907383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907383, "uuid": "0d0b71aa-c6dd-4b9b-a983-7d37bfef8f09", "comment": "Malware payload", "value": "3e55f169e598697c5526ae48f6d9adef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907383, "uuid": "a2a8cd65-9477-4c99-a4c8-298455f1dcb3", "comment": "Malware payload", "value": "092fb803ea1777965f61e4e60a8ba0a1c5b1eb688ce3554ddbaf0bf28f6bb254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907383, "uuid": "d8d1dd0f-d80f-4bf6-b24c-a384ff93a7a4", "comment": "Malware payload", "value": "3b1abb6c7a43eac2a1514a56007b3d5317098976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907383, "uuid": "41de535d-d5e1-4af0-a0d0-bba8612028c0", "comment": "Malware payload", "value": "3d17f805faf2d385d9deec4e41aa4f2755b11e5be0df13fbc9e50b8c95a69c608650a0f201e2e1613401d64ab572a799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907383, "uuid": "d8de0218-5b73-467f-b3e2-40b2a4a291ba", "value": "T1B708333FB187AA3AE56E123529306220593F7DB256134D8906F47928DF781706F3FB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907383, "uuid": "c5f94cbc-9cb6-468c-af41-9c619fd477d2", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907383, "uuid": "f3109da4-adb6-4d9f-8485-09da15f1a246", "value": "1572864:N81quE0Nr8d4Xxc+U0nU/oEknkxqhGbs+yUgxEhMFmmoViu2As+a:N81ZEI4mBc+NnQxeGw+yUgks/As+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772907383, "uuid": "df5de74e-1278-40ca-bdec-e5a62f2e87e0", "value": 79088232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772907383, "uuid": "9f04317d-029a-4a01-9d3e-94501df560b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907383, "uuid": "22135486-8b71-4e1d-868a-f9ca0aaaf4ab", "value": "Dirtygame_x64_v1.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8465c8e-19f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772866971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866971, "uuid": "dea80aef-9f8f-4ca5-8e74-359501b13739", "comment": "Malware payload", "value": "2681f876b6b35e1e2e79174e7d07c36d", "object_relation": "md5", "Tag": [ { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866971, "uuid": "b2ca0307-aa86-4a5a-9284-528d56cd3737", "comment": "Malware payload", "value": "0a3029c709f392b0daafedd4a7855a8680b6cbcad4151328b87b0a3307d37198", "object_relation": "sha256", "Tag": [ { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866971, "uuid": "3e43a7c2-627c-4649-a808-f3b3a78f3ec5", "comment": "Malware payload", "value": "0d6e39c9af6ace7a6fe4332c64bc06f22b4c4e7f", "object_relation": "sha1", "Tag": [ { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866971, "uuid": "ebdf7707-70e1-4ab4-9c8b-61fc102b9f21", "comment": "Malware payload", "value": "8afd3999bd766508676c724f57086e39314757ce3e1752d3595b80e965a8e25ee720b314a9cf31be32f5976270a4f20c", "object_relation": "sha3-384", "Tag": [ { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866971, "uuid": "2262f31a-30a1-45b2-b522-b4ebd0959240", "value": "T17B117B39D3F6D708B935B08B9BBF8A44743D91EE53D075090AF582DCA9701218B75E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866971, "uuid": "293b21d9-bf67-45da-81ff-d68a133ec293", "value": "24:+R/LDQjj36WmMgW9TcZmODB2O+ZL/j3695HO+v+jO+5+O+oO+QO+xZO+5D:uDDQjDJmMnTcZVkpJ/DC5HpapkpopQpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772866971, "uuid": "c83228d1-a5be-4233-8b16-d26c14ddc94d", "value": 1001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772866971, "uuid": "bca1a2cc-ce2f-4eb6-af08-5a4c0fe9a289", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866971, "uuid": "85dd3963-13e8-4343-b549-6abb96015fc9", "value": "0a3029c709f392b0daafedd4a7855a8680b6cbcad4151328b87b0a3307d37198.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a192efc-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871081, "uuid": "1b47cb42-ef13-4cec-ae3e-f6f0ff3613b8", "comment": "Malware payload (Mirai)", "value": "9f6aa3aa103e17fed852ac8d5b566558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871081, "uuid": "573f337a-7016-423d-82ed-4eb38b46ca0d", "comment": "Malware payload (Mirai)", "value": "0a3ef431ef6aac9035870acc991bfa9c3b34e1be185656225c8a5016ad0a2890", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871081, "uuid": "535bc2ad-b6a0-449d-9290-5a1479abb2f5", "comment": "Malware payload (Mirai)", "value": "6f7f0f2094d617134b605d1478544ddc2be0f416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871081, "uuid": "c83d3be2-c927-4b30-92ac-d73aae8805c2", "comment": "Malware payload (Mirai)", "value": "3073c7142d657e15dfd978d6a0e6e12d998f2bffe7f8f6edaf8f3f786a478258fe6264fcb80b245cba1fa0b7984bf997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871081, "uuid": "db9c38ee-bafb-417b-9671-8a4be8d91ab1", "value": "T1DE333A13258085FCC40982B147BFA62BF562F4BE4234F58D6BE87E26FD5AD310A594C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871081, "uuid": "5b0e39af-1c63-415b-b60c-321c9778f576", "value": "768:FnjJrbghrXpCJ9t3C0q0GNls1qtjNo7MM7a0KGxDopKXobZ7/cKYeTBn:xdwG/t0XNlEqdC/7a0xxMd97cBeTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871081, "uuid": "a818430b-1284-473c-abdf-2062d1177c7c", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871081, "uuid": "a7af3270-2304-4330-a989-bda0a8d56e56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871081, "uuid": "462a4f66-fabb-480b-8cab-76f602f15caa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda1f73d-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772865369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865369, "uuid": "daa0fbc4-21f8-46fe-9eb5-300a3c4084f1", "comment": "Malware payload", "value": "3afd4380cd177b86825654fed6d6ad30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865369, "uuid": "c2bfd32a-5ff3-46c1-8988-3e89d5c40dda", "comment": "Malware payload", "value": "0b2954a74cbd95dfbb0cf23d08f1805b9c31c1b39ac4b3a3d456b801a41ce789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865369, "uuid": "6d595382-23ec-4868-af9b-7ae5568214d9", "comment": "Malware payload", "value": "d4d26bc799e6e129702183c029c11b4789d05c8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865369, "uuid": "5dd03d17-789e-4512-8f78-da2d4de8946a", "comment": "Malware payload", "value": "0a1726e1a25309d5d21cfb77b0ff69154dab8ecc4ec9a27d1e4520b9b11c5d3bb8e4e82f208289ad2e2c182fb3a4a203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865369, "uuid": "1db0e9ca-afdc-4e5e-9d33-d12e4b4bee2d", "value": "T15C050A7E5962D16AEA8A40FC25458B6249B1B33B03B41FF7016681302717DB2EED73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865369, "uuid": "4731f135-8963-4ccd-8b90-44eb571ee1c8", "value": "12288:UyQPbM02BDbQzFQU7t3Jzv4icKosTqH8qpTrSvP6otbI5urS9Vn2wZ+TOqu3D:cKlbOFQU7t5zv4iFjTZNwv2wZ+iTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865369, "uuid": "59ee9833-d8c0-4798-a9d6-3386f3d86be3", "value": 866688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865369, "uuid": "486a2a2c-bc44-4161-94ad-f334cb183eaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865369, "uuid": "86d313ba-d3d6-4952-a7d0-8c01d9f1e28c", "value": "0b2954a74cbd95dfbb0cf23d08f1805b9c31c1b39ac4b3a3d456b801a41ce789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129587a6-1a4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772906234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906234, "uuid": "3f105e7b-3c13-4f65-9da6-ba3ac109959f", "comment": "Malware payload (Vidar)", "value": "2858e41b1c1f6cf9dfe6ef50758d3e8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906234, "uuid": "16f617f7-61a5-4027-af4a-5100263f910d", "comment": "Malware payload (Vidar)", "value": "0b51bf93a76fcab0f9db43164054acb76d5a96d34fc3b7dd5f9129f6bfa5e58e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906234, "uuid": "0031a73a-60aa-4b50-a562-f2bd7fd2d436", "comment": "Malware payload (Vidar)", "value": "6a9fbd5b768d3f66bc9a9c5a48824af2f40830e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906234, "uuid": "f2266dce-85a7-45d2-bb8a-82f29bb699c7", "comment": "Malware payload (Vidar)", "value": "3e9fb86227c87fdbd5d537a5469395284f1d1839160644f165627f0c1ac6f5dc65f82c2cb44905fcd13797e8b1cf91e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906234, "uuid": "79f8a195-00a2-4109-a24e-542957a8b63d", "value": "T10CC6E47B62E48168C36B817AC16F8A0CA4F371750F36C3F732911B5D8A12FD16D7AA64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906234, "uuid": "bfa2ff43-5760-407e-8318-56cc5825b2b0", "value": "068780fe56d60c9502ffe606f8c04be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906234, "uuid": "c43e93d9-b94a-4e44-8993-e805453d7453", "value": "49152:KX18qps+OYzlmB7ki3LfrrOSVhi04X7FOxHZ8mUFqz5L0TVtoeoMwNHcXCBz+COW:TzCoeoTFtBUX/XrL2zmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906234, "uuid": "87068120-db62-44fe-92a4-23b25ada8fdf", "value": 12336640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906234, "uuid": "a5c60c80-eac9-4143-a4fd-3f6f816670cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906234, "uuid": "db76a123-d366-481b-a7d9-0e7077d29e81", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a5125c-19d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772854429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854429, "uuid": "30c9f349-94f8-4ce0-bc74-36e26c1cf643", "comment": "Malware payload", "value": "c9ee8b296d22424eeb55b12775bd33e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854429, "uuid": "d491385a-a130-4193-a6fd-c86eb3a30afb", "comment": "Malware payload", "value": "0c26c222a5f4e74aa32055fd5651e0f71e9c2ef08fc19fc4ba1dec6645bc4bbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854429, "uuid": "f1b4d156-2d9c-4b7f-8e83-6b14778c574f", "comment": "Malware payload", "value": "aa3d8829853e7595a6c30f301560f7baecb1e316", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854429, "uuid": "89aec693-bd50-4a07-b745-de022fd33676", "comment": "Malware payload", "value": "fadb8c9efe381ef1c9fda5519cb77af718d995c39b6f89dfde26999a992bef2e0667dfc93a6a62eaa660eeba240b2705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854429, "uuid": "531247cb-9f2f-4de9-b900-e5ed37ecf68f", "value": "T13924A50AAF610EBBD86FDD3706E90B4635CCA50722A43B763574D928F54A50F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854429, "uuid": "14720cc4-2a77-4cab-a574-b76817f86052", "value": "3072:M47wz8e+9Lh878qZQ5aHbGm9QXAbVb3ojnTFWo2:M47wu9hrqqaJqABQnBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772854429, "uuid": "1748b23a-86bc-437b-8f15-1bfcb9ea94e1", "value": 228696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772854429, "uuid": "780e3de3-698d-4307-b883-da801ef0b4ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854429, "uuid": "1266d259-c1fc-4312-840f-8c176c050dd5", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954b8681-1a52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772907741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907741, "uuid": "a5a42cf5-9d89-4aec-b80f-687df9aed248", "comment": "Malware payload", "value": "9aedc1ce311a13b36dd6339a5e85b0cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907741, "uuid": "8b25b117-413a-4613-9311-e32657eb5312", "comment": "Malware payload", "value": "0c680e59a5ce447ba02a45526afa3f1dd735fa0e8b9a1eebab1dde69bdd2e9e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907741, "uuid": "de293b77-92e5-4576-9327-65b024e658ef", "comment": "Malware payload", "value": "57e4750cc29c19159809f7029caaaa0418850b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907741, "uuid": "56384f32-37ed-43b5-b34f-a592ac943215", "comment": "Malware payload", "value": "658f313da98a905d6e3a86f9019a7f89de29a1e10c5fe432260f470d3b7339791a8a4ff710a9ae304f94b8f31974f5d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907741, "uuid": "634a6ded-1e2b-4cff-8298-69292659bc9d", "value": "T10B065B31324AC52FE96201B0192C9A9B552CBF760BB254CBB3DC2E7E1BB55C21736E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907741, "uuid": "fe609c8b-30f5-40d5-a2d2-ed6c128ba5fd", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907741, "uuid": "55644a6d-dd59-4b70-b19a-c8b8372018d7", "value": "49152:6WbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5tS6Cu8PAELcpB2M+:6r99u4kc8Hao8eRjYBU4UAir2Y5snu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772907741, "uuid": "b904c6be-c52a-4ae2-829b-7856355b859b", "value": 3855344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772907741, "uuid": "1d5c1224-4687-485d-802a-a64749831782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907741, "uuid": "bd921b91-233a-497c-a432-affc35cc38ca", "value": "Futaland.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7f0491-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842178, "uuid": "9eebe32c-3168-4dc2-8ee8-6acd15d1d82c", "comment": "Malware payload (Mirai)", "value": "42d611ad63f2e132dfd7c7ac701da070", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842178, "uuid": "98039a27-2156-4f45-bf58-f940ee19fec8", "comment": "Malware payload (Mirai)", "value": "0c6d4e9924545dbe2d029e42581ff7ab3719f6447e96fa66ae2957da100c83ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842178, "uuid": "c76def3b-36c6-4014-9899-38a246e83baf", "comment": "Malware payload (Mirai)", "value": "7227e7e526b33679b2296a625edf80de39c18f35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842178, "uuid": "b9c95675-7dbd-48b9-a696-5c7a472010e4", "comment": "Malware payload (Mirai)", "value": "2cdd166f91e4afa6152ebfad404ad37c567cc8cce2add514d7f1ca9091abe869c4e0f9b6bfb0c9e5bc728ef7d6cf5e81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842178, "uuid": "1c6c1adf-5877-4a02-adf7-aef35379c4b6", "value": "T17D440806BF510EFBD8AFCD3B06F9170625CC651B22A52B3A7634D918B50B64F0AE3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842178, "uuid": "273f232f-2186-4ffb-962b-402c566ce92d", "value": "3072:hlS5OP8StlB9U07CDWWS//YNQHajZsf1ntwJEY4PZ1LidzoAB:hlS5OP8SjLUeCDWP/YeHYsnVYa10xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842178, "uuid": "91cc1102-919a-4902-b934-d95f7e0b1ad7", "value": 255892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842178, "uuid": "68c5d380-2bb8-435a-b7d0-b8b223a9a9fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842178, "uuid": "0952cbab-c124-4d04-a281-798c4a511a41", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf2c2af-1a02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772873450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873450, "uuid": "10beb945-f3d8-4e84-ba50-01d25f54a758", "comment": "Malware payload", "value": "461fc48da78e63a132e9c30948b26eb8", "object_relation": "md5", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873450, "uuid": "f8f7de72-b2e4-4745-8bb4-f07020cbbd42", "comment": "Malware payload", "value": "0d869d22807ae377407d3002e4be2abeb0cdf451392eb4a458bb7b5f16e1c6dc", "object_relation": "sha256", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873450, "uuid": "956a8e07-c876-4d00-a318-5e4d12a8e134", "comment": "Malware payload", "value": "577735672565a737c211b9d7cf92322cf5dc90d4", "object_relation": "sha1", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873450, "uuid": "74cae003-e46f-41c6-83b1-b088c6cd31a3", "comment": "Malware payload", "value": "2cea03f2348a27255bb983bf8198c4e8277a04a26d2ce639123a7bfaa773d5bc0b77ffe98c2651f5c14d0d639dcfa7dd", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873450, "uuid": "01dd4cb0-a532-4b98-8200-4178be5cf1f3", "value": "T104E33919DFE54C41E9D808BD85734104CB34A0FA6542B38BBB95E0A20D51FDDEA7E2EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873450, "uuid": "f713729b-2378-4942-8cbf-f9240b7611dc", "value": "3072:jpLBkjfIy0rklaKZJTL1QXn6Est6LFwbYwM7aN6HnWKF8X0T7E:JkaKVQXn6EsYLabl4a8ykE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873450, "uuid": "877d710a-e7ed-46be-8b6b-585d07ec0503", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873450, "uuid": "aea6e2be-1cd3-4644-8d57-4fa38e6d6256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873450, "uuid": "be2bd8a1-41c9-4280-878a-916f5b1232a3", "value": "0urkspr63xoryra2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d44639d-1a30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772892991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892991, "uuid": "850130b6-c84f-4f93-a630-a9e74bc1b384", "comment": "Malware payload", "value": "4c806cd3ec3bc81dc3a75dcf0d65d90b", "object_relation": "md5", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seventhvictoryira-com", "colour": "#B6AED4", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892991, "uuid": "11b9d44b-3757-47a5-a043-7eb7ecebab8a", "comment": "Malware payload", "value": "0e2bbb35e5c3f5a6d80fc209c6c6d942c2d518933d1ad7fe3cf7fc1a69f22abe", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seventhvictoryira-com", "colour": "#B6AED4", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892991, "uuid": "80b34ee0-9f84-474a-811c-9692b7474135", "comment": "Malware payload", "value": "7299bfb419b51970c5ca9ccb225a4a265a0049cf", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seventhvictoryira-com", "colour": "#B6AED4", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892991, "uuid": "fd45bfc6-197d-49c0-8c69-d8854fb16ec5", "comment": "Malware payload", "value": "faf0070ca6b9e07936c3fb8cbc686526cc4df8e3afb73cfceac3628c4bfeff93cd4952d9729de793a3f54962c909e413", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seventhvictoryira-com", "colour": "#B6AED4", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892991, "uuid": "8c266598-a448-4db0-a31d-bc04a8c637e5", "value": "T1B6B13953435843ADA2D45ECA4128312B49F2D47B7C3D12ACABD29ADBF82DF416639B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892991, "uuid": "708c853d-d564-44f4-aca6-565aced3b2ee", "value": "96:gpVYPXZfro99xkfIEZInMm26jb1DpJz99xjYAXSVLAGsW:eY/ZfrPrm11bGoI8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772892991, "uuid": "a48dfa0c-2c88-425f-a1b7-658d27eb0c0d", "value": 5340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772892991, "uuid": "4bfc9fac-ad5d-4ef2-87fd-2175af06dba8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892991, "uuid": "7045a0ca-aed9-421a-a305-344483b33bc0", "value": "WindowsUpdateHelper.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3e7b0e-1a3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772897737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897737, "uuid": "150ad5ec-9a94-4419-9e11-d243d1be8688", "comment": "Malware payload", "value": "d071d37731eb7e61ffa35079484eb31d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897737, "uuid": "c1d8974c-217d-4802-b6d1-e87cdf7856ac", "comment": "Malware payload", "value": "0f60c1c23bda9eb9213713e8f21470de0da0d4b67b46e6c27c9f8007bafcef74", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897737, "uuid": "2759603f-9f98-4987-ae72-ac05bb141373", "comment": "Malware payload", "value": "1b0f7ca72b59562c541c7942d03a9dbf26c7fa21", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897737, "uuid": "aa01e509-78e8-4b91-98e3-a4bae0b3090a", "comment": "Malware payload", "value": "b5384b6b1efe15291cf38d4c935cd9021141562b23345dc7d8c0a6b73f500bce1bb427f733a7e9ec7c845a2e4bfe3047", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897737, "uuid": "9b43a450-c43b-4639-9613-e6ce5d857304", "value": "T1BD925CB906496C75BBC0CE799F3C7F0CAEE582C42128E39DBA1F39705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897737, "uuid": "10714e11-0124-408b-a31b-089f492ff7ac", "value": "384:AcfxncuxOLnVYMSYzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:JCuQL+YzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772897737, "uuid": "349a1533-6da0-4314-805e-e92d78f38133", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772897737, "uuid": "787671fb-3a4d-4966-b2f5-8186fd170b6b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897737, "uuid": "a1dff963-80ed-4b0f-8e3b-f03af48cbbb5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f7284f-19fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772870890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870890, "uuid": "a24c9052-0fcf-467b-9d12-09953369c2e1", "comment": "Malware payload (Mirai)", "value": "a1be7c65b1464958949915a59f965a93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870890, "uuid": "d336b20a-e706-47ea-9474-c8c8b2a123f8", "comment": "Malware payload (Mirai)", "value": "1212ccdb015645af6b3d2f8f1d23febf8a9ffb91c89f9c524898c83410394191", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870890, "uuid": "ab41ecdb-1b22-4743-b31d-c4cb3076d1e7", "comment": "Malware payload (Mirai)", "value": "23c83c49e8f1254bb5c6f7c7ca23d5d5677ae042", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870890, "uuid": "15e84af0-5655-4863-806e-cbff2e01f5fb", "comment": "Malware payload (Mirai)", "value": "c586d367b167690537cea9685b3698a815333c30954b6a5e3b21c44cd73c9cbfff5c796f6369c528b7061340a269467c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870890, "uuid": "81655fdd-7784-41df-aadb-3df5bb1b9d48", "value": "T1B5B172C812A358747DF69E637169C924B8C9B182EDC58F81D0EDF4F9598CF08B941AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870890, "uuid": "16992e5b-4b40-42c4-a85f-dd523db0e54a", "value": "96:2RKhEcfEnsTE11CxCCxk9BbTXfVpvHF5nPrZ:2M2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772870890, "uuid": "72561d65-38c3-4953-99a7-e0d2d2972296", "value": 5173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772870890, "uuid": "904e6d05-a0b7-4131-b411-2e8ff30bc76d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870890, "uuid": "0393caee-23b6-4378-b080-7e1ac444a929", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03895d57-1a2d-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772891606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891606, "uuid": "c13aa3b9-1ecb-433c-a557-ed351cde4149", "comment": "Malware payload (ACRStealer)", "value": "671479dd083306ae10257aaa53b145b0", "object_relation": "md5", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891606, "uuid": "148dfac6-1b35-4fee-8bb7-e1fbe3ac8c5f", "comment": "Malware payload (ACRStealer)", "value": "13022088dd79e9d7d2116365215bc447f5182104393cdfbce4a201c65022b398", "object_relation": "sha256", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891606, "uuid": "4d967a00-3991-42d3-bd47-2f1adbe268ad", "comment": "Malware payload (ACRStealer)", "value": "c4d6b0d8fb3cf96aa7e6f4a93fe8028c86300d38", "object_relation": "sha1", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891606, "uuid": "770f1219-7b82-47b9-8695-46dddc4b6b7c", "comment": "Malware payload (ACRStealer)", "value": "83dc64c9a0ce54f686be62b2f55c7036c7e9a231c3c53cbfa18bbf764ac594ae40b37a71ccbea07e6bfe9e9aa62e3334", "object_relation": "sha3-384", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891606, "uuid": "c42d52c7-6068-450d-83a8-044c0abd708c", "value": "T190954A116E5B8B6E5280D6C3D647B8C8DE15804E2125FD8C3ED88DCC779AE88D7A16CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891606, "uuid": "ff519a57-fac6-4d5b-99cd-5fd219a56933", "value": "12288:GgJ2j37ERoq9wNDmVUuSBIZqYakzWTcTlx3RpypeWtZGgzLXF1e:H282J50yuP3RpSZjzLVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891606, "uuid": "e79928a4-548e-4ac5-92eb-b4f14b14c20b", "value": 1878539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891606, "uuid": "89fdac6b-6d47-48ef-ab28-cbbff21a8aea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891606, "uuid": "5f89a4e0-2ade-4014-bcb1-23710a32f73d", "value": "wslservice.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2609c7-1a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772890811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890811, "uuid": "e0eac0ef-95d2-4515-97c2-7e7da85c36ee", "comment": "Malware payload (PureLogsStealer)", "value": "0242e60372bd4edd8cb5881a43901ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890811, "uuid": "5cca7d1e-31ad-4421-999c-718509ce0e48", "comment": "Malware payload (PureLogsStealer)", "value": "158d126fa0caf2974e0cb4fb943d3a0453cf404369a5aac0d24e77ceef25b4a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890811, "uuid": "d83b70c8-5a5d-487f-b261-b7f43e76592d", "comment": "Malware payload (PureLogsStealer)", "value": "d9d2db397e2fec0c63af41d459b75f00f2aa0420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890811, "uuid": "99666672-54a6-44a7-8eae-1617c10a8328", "comment": "Malware payload (PureLogsStealer)", "value": "de265dc0b4d300da3fde740d783b6a75c437869f6aaab77c2742dc087fdd124183093917b286d388467030a6bebc4831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890811, "uuid": "8609bf53-5b14-4393-92bd-8daf3537d271", "value": "T17EE63389BF44A1D1D6202C38452496A66E12DD4B7D0C11C5EBEB1FAACFF368CDE9F610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890811, "uuid": "15052c7a-5418-49a2-9271-df02133d1e31", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890811, "uuid": "a5da92d0-6032-4503-9c36-da8198eb7282", "value": "393216:puiyBGmbIl7bY1+kUhR6+RATTG944OaZbdAdW2:puiyhZzwR6+T4/qp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890811, "uuid": "990c8ed9-0c43-4493-b203-098a192006a1", "value": 14947840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890811, "uuid": "92530a8c-5e8a-40ff-b3f1-51bdd6fba2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890811, "uuid": "efee1186-deb5-49b7-ba5b-7da372d4b432", "value": "Installer_v5430_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b21984-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871159, "uuid": "0ebbdc0c-897c-4278-ae91-bdd6c53715c2", "comment": "Malware payload (Mirai)", "value": "fb7f669f6b84aed7228acb39864f92b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871159, "uuid": "4ece639d-89de-45c1-a570-ced0b4283e69", "comment": "Malware payload (Mirai)", "value": "16f314417dba0e85be63016ef212ffbb7f9a2bcd0ac66419eb92ae85d009ce5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871159, "uuid": "8b12a674-116a-43ce-8471-e9e97ef6ae2d", "comment": "Malware payload (Mirai)", "value": "e865d1775bad5822aed4b97f5449350583a06825", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871159, "uuid": "231906dc-6285-4951-a01b-6645072e8d30", "comment": "Malware payload (Mirai)", "value": "7b98a7246c77a46165267fc121e08079cab22084fd106225a95d1abf428114aebef863def2038564241ae12833b9c338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871159, "uuid": "85f6e25c-7e4e-42dd-9266-715af75143fe", "value": "T15F834B86FD819A12CAC4027BFF1E508D371613ECE2EA7203DD259B253BDB95A0E7B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871159, "uuid": "fc6d5830-17ec-4d25-a829-c5159718d009", "value": "1536:ZJ032N7BMu/R+pqLGRsDQdIcgRO39C9WIDYL1lIMXVvGgW:ZJtnzcWcaO3AWDuSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871159, "uuid": "16c23b58-7c8f-45fb-875d-2a3f1b736361", "value": 83404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871159, "uuid": "8c6f439c-4d6a-473a-91d0-7871b5636bff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871159, "uuid": "cca0a1d1-cef3-4fd3-a457-28c376165b3f", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0065fbd-1a52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772907867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907867, "uuid": "6b938d40-150e-4ea2-b59f-eafdea101948", "comment": "Malware payload", "value": "0e7f99708c2e01b6ca01132d5abb144f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907867, "uuid": "64a5cc34-562c-4eae-b522-bb224e3ab45b", "comment": "Malware payload", "value": "1755169c2eb55a83e75e30f4420f76456c28cd3af64ff2532b030cf5195843ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907867, "uuid": "1df4e76b-4b94-4b82-a434-9ac77e39a540", "comment": "Malware payload", "value": "27d8f9680a7d742e62748832c4506fe0a757066b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907867, "uuid": "9b717c24-8548-4941-9de8-62849f4f000c", "comment": "Malware payload", "value": "e78319aa4c4824f71a2eb9361b28f24d01cabc8dbe9bc457a01676936fa076d916e938dc98bdcbb717acd09201b1e01a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907867, "uuid": "7ed8c78a-8408-42b4-8558-4da4a989a298", "value": "T1AD08333FB187AA3AE56E123529306220593F7DB256134D8906F4B928DF781706F3F786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907867, "uuid": "ae94f00e-9e4f-4836-ba34-af89af264e68", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907867, "uuid": "c4d53081-ed09-4ddd-9c0b-16c67b2a816f", "value": "1572864:P81quE0Nr8d4Xxc+U0nU/oEknkxqhGbs+yUgxEhMFmmoViu2As+i:P81ZEI4mBc+NnQxeGw+yUgks/As+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772907867, "uuid": "8f8eb962-b52a-4e4d-8f92-28d9aedaaf79", "value": 79088232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772907867, "uuid": "0aed64d0-d8f2-4516-848c-bb07bba13ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907867, "uuid": "aed15741-4a53-499a-b68e-b889f1d9dd7d", "value": "OperaGX_v1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f97934-1a7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772925025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925025, "uuid": "9a2f03e8-fec7-4e2c-a2e3-147415a97d73", "comment": "Malware payload", "value": "d6feb6156af17fe0679139c92a0180b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925025, "uuid": "765fb47c-54bd-4b71-bbd2-31427010c5a3", "comment": "Malware payload", "value": "1897db94dae684822e11954fd07b734a81de5729198d4b32089e5e49367b9d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925025, "uuid": "b0175f42-cec5-4067-a71e-afdf3087a85d", "comment": "Malware payload", "value": "4a8a50490518bc7fef7125b894e2442847625b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925025, "uuid": "79919e9e-431e-4e63-8e7a-6263e01a7c6f", "comment": "Malware payload", "value": "3e1934ada88d8a3870d5d1e2353e7bb556e1a9b936d663fa63da5095a5d754abcf68684242446c343ee9dcfc6b914323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925025, "uuid": "f11a46c2-679b-4ddb-843a-4728565b7eec", "value": "T1EE0623117B819071D2A331320F66FB5997FDF1250F365A9B33C81A2D8E702C1AA76F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925025, "uuid": "4f2c5dd2-9f8a-437b-af3d-20c21913d7be", "value": "e59d00b0d90522ee1a983f13d4ff7e50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925025, "uuid": "12008edf-02d7-4e69-893f-7b9fa1283c5e", "value": "98304:JAPGk5eObOMVZufwMQmtfhieeRjsvT7zvbSY/Qd:0h5FbOG3MQm9hMRjsvPrbP/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772925025, "uuid": "a1677d27-aceb-441d-bf51-3232a2494b6f", "value": 3744224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772925025, "uuid": "50325ff5-58f7-4bd4-a52c-024d00478d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925025, "uuid": "23c798af-74dd-4dd8-aff7-083b343c3211", "value": "OperaGXSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97110d36-1a52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772907744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907744, "uuid": "c5ecae17-ad2b-4f94-a50e-905c65b3024b", "comment": "Malware payload", "value": "9945eeb90b702636b496e063fef0e339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907744, "uuid": "a482d8df-1362-4a01-af21-f43ca5893c0f", "comment": "Malware payload", "value": "18cb2495b5e0512f8026d7fd123ae821d554d918ecd7269e9b8eb40ca2f480cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907744, "uuid": "23432133-a5ad-4c49-b287-565c260321ad", "comment": "Malware payload", "value": "32bca821f9d6ad6c4ed652b68d667ec2ba6e4c45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907744, "uuid": "60884b53-8bab-48a2-ae07-09fff350c99f", "comment": "Malware payload", "value": "16350e56c23d49171783de685109cfa9a037d124634a1b1c5dcd516d62fb5486ca85a7f7fb4fc63f7832f117e9f9eecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907744, "uuid": "de0d74dc-ca13-41e6-89b3-397c739c9f5a", "value": "T13808333F6287552EF8AE1638753296205837AD7275074C6682E0E94CDF3A1706F3EB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907744, "uuid": "536ba548-3b10-471f-9f80-c3e5a7ae7fb5", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907744, "uuid": "80b14624-3f5e-4b21-b388-d841054335b0", "value": "1572864:yD1PNHpD9LOIyiLGdYdOyJ0BCDKTpcgpyc0Gs+yUgxEhMFmmHIk8aYi+H:0FNF9LbyiuYFJ0sDwjpra+yUgksLl88O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772907744, "uuid": "36492cac-9616-47f4-b74a-847f7cc0837c", "value": 80972576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772907744, "uuid": "8eac8a5d-48b8-46a5-aeba-efca8f7dfea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907744, "uuid": "27c5aa45-a705-4348-8f34-8964eb23c5e8", "value": "99de081e-4602-4f77-a173-837ebfd30379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6117bc4a-19ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772864704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864704, "uuid": "39eba172-a397-4277-b6c8-09842a51f759", "comment": "Malware payload", "value": "49acccf5506a27aa040a94c99c42fa06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864704, "uuid": "2e647c16-e64b-409b-9aac-2d17cca174bf", "comment": "Malware payload", "value": "1a11962f2ab3e29878aeb08abaa96bc7a59116ece20d46a5bab74dac7f367541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864704, "uuid": "3526ff11-1ce0-4d11-aa48-c4d6eb51043b", "comment": "Malware payload", "value": "19cfc46c07eeab69a3b8efc4502ff8bb87f5e72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864704, "uuid": "866f1606-a958-480b-a5eb-801ab98e6249", "comment": "Malware payload", "value": "c5c544f1dc14bf6aeebcbc46f2944ff399695fb4313c296600455a4c11ed49f127bffc443a33378d113dafbff037da39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772864704, "uuid": "d5cb96c3-7ca0-4ddf-aef3-4c5439c9bed9", "value": "T165F4EA7F59629126DA8A80FC35494B625971B33B03B41FF701A69130270B9B2EED73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772864704, "uuid": "57ef7dcb-be27-4caa-8718-427a173d2f39", "value": "12288:283WeW5lhlHJQ77nU+HBkbVXVV4DFBrTbY+Pm4YjjdhPKK:x3WeW5lhpJQ77U+e1wC4e6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772864704, "uuid": "8c88e50d-b5b0-4d08-aa57-5175ff635ee3", "value": 729472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772864704, "uuid": "e05435c9-8df6-4dd4-a329-4983eca1b743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772864704, "uuid": "512ba469-48f9-4a36-ac04-6c0451dd0121", "value": "1a11962f2ab3e29878aeb08abaa96bc7a59116ece20d46a5bab74dac7f367541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a375353-1a2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772890785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890785, "uuid": "ecaebb0c-ccf2-4c2d-9cc4-e4ca627a11b0", "comment": "Malware payload", "value": "ceb3520e449d0462c9e3675639600a09", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890785, "uuid": "de45a970-acd5-4299-a498-864a57e629c9", "comment": "Malware payload", "value": "1ad7a1376b82faad3fd19ed30ff3e72ce385d99caea2c17bc6efd0ca698ec0d4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890785, "uuid": "f138b246-3518-490f-88a9-3cbc1408813f", "comment": "Malware payload", "value": "506e0b4c0c8a68f7c0c3017cc9feccdcbc138f24", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890785, "uuid": "f3a9ac51-25a0-4c63-93ac-80649b9eca8a", "comment": "Malware payload", "value": "155e972505c260401f767ef1d48502302e72a87d22d723883c6d2cc80b5df983ac9ca946ce2d9d107d16e8c7053336be", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890785, "uuid": "da8e36f9-282f-4c81-88e8-be4fb4989241", "value": "T1F4513B3A81789390C32DE232BF6444CFC1902A1A560E1F429FF90891E86D8B996D249F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890785, "uuid": "fba5efec-7256-4822-a45f-9560519093bd", "value": "48:9+9Pfb5pQqaLtJsz8+THoo4GL66N6lB/FUWkPXP9JCDnaypslVI5AbBOrmFPjf:0WPYPOvBtU/yDa0sESbBOrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890785, "uuid": "fc9f364f-c993-4719-a6c4-296bab0a4607", "value": 2962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890785, "uuid": "e31f4ea0-fc9c-47c1-8347-17635e5439e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890785, "uuid": "277b9ace-060c-43f7-aefe-20e64815db9e", "value": "@kontroliryet_2026-03-06_11-51-42.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d84659-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871103, "uuid": "7b5e51f2-b6f4-4473-864d-c8ea9996696a", "comment": "Malware payload (Mirai)", "value": "e38892b7d69aa21ac4ef23bcdbdacd39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871103, "uuid": "90f5ddc7-c549-447e-890b-1217f457e25e", "comment": "Malware payload (Mirai)", "value": "1b90de1f1a53b171162753147f2e0ab3aa357cb1b27b1d2e58cb72cb095886cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871103, "uuid": "d6044c95-2894-4650-8fde-45412057a712", "comment": "Malware payload (Mirai)", "value": "97a2f04899bbef6bf5635e8363fa91f9112da343", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871103, "uuid": "70079d19-60f1-434f-a312-31b904496946", "comment": "Malware payload (Mirai)", "value": "df678529c96dda439a9226490a4dc3fd2ca85ddd7c475005ffdcf35ebe03c6d1b899226a3ee9becd2ab0c7e6bb8be317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871103, "uuid": "7805afab-5c4b-4bbf-b6da-e5d47bfa6c35", "value": "T1EB33E845BD829906CAD84377FA1E42CD331173D8E2ED7226CD157F51B7CA62B0EAB062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871103, "uuid": "ff466daf-332e-4f28-975b-05d599cb5150", "value": "1536:jZ373CYePDBvT48TgEoxmnv44D0bwbZn:V3738PFcVEouv6bwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871103, "uuid": "603fdff5-bd76-42fd-a11a-80e24ff243fe", "value": 51624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871103, "uuid": "fb3c1bd8-5bf3-478c-9149-65e21b23abbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871103, "uuid": "300fb72c-f10d-4f60-9e48-3f488f26820c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64609c49-1a1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772885326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772885326, "uuid": "35c7d9fc-e4b9-49fa-8b25-9f2e64cf7a70", "comment": "Malware payload (Mirai)", "value": "f84313c4d8a07c08a132776e3e4a462a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772885326, "uuid": "fea76554-9397-4798-acb5-d1d2def9e89c", "comment": "Malware payload (Mirai)", "value": "1b96e64900dff8872419a941cd3e3f7547b6079b50b68c96bca1bc0d00bbca74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772885326, "uuid": "1184324b-7b91-4263-828c-68252289c621", "comment": "Malware payload (Mirai)", "value": "e76dede17eed7e19df1523fb325b1d6c9346c694", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772885326, "uuid": "1423f27a-a631-42ab-a9ac-c99a12e47500", "comment": "Malware payload (Mirai)", "value": "57af2471a986a444eb4715736042190282971859a42020a9b843795fe5242fa2049015f364789496d421590bc73d6565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772885326, "uuid": "501f6d5e-7f21-40b0-baea-14c05bd887a9", "value": "T171158D2EB2B3B5BCE00BC03457DBCAA15535F07522212DBB26C4DA353D6ADE11369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772885326, "uuid": "0b517233-1a58-420e-b790-303a1d9d2817", "value": "12288:Pe0MlaNgenARxBcId4HDowN3+SOlmE/GCOw3WUpcubh5y1qoqzzayUHjAd/HX:G0yaNgeARxQTObAsTpcO5yO+jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772885326, "uuid": "73b09801-8331-4d3b-82aa-ccd146583dda", "value": 957256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772885326, "uuid": "fa9395f8-1a69-479d-9ee3-44e24c891682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772885326, "uuid": "2a8eb8f6-96d5-47eb-97d9-afe4dd68dece", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d201ae-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842117, "uuid": "11f9adf5-e90e-45d1-8597-61fd404bbf04", "comment": "Malware payload (Mirai)", "value": "bb44ca1c028021e568f3cb68e6d72747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842117, "uuid": "55b8bfb2-8733-4376-8bdc-b3e66d57a964", "comment": "Malware payload (Mirai)", "value": "1cdb1a474d1aa7301ceb137f09083aff05c597694651ca123ff37f8777f82356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842117, "uuid": "0cb18066-2c4d-4da2-9f43-211717ed53ed", "comment": "Malware payload (Mirai)", "value": "36f039d1aa15b41b9818ed76363588e1dc052338", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842117, "uuid": "bcf0e72e-a933-4b3d-a18f-d81d5e824028", "comment": "Malware payload (Mirai)", "value": "197d43270ab6d26a54215b046a425111f85ec526edca06f348c05ace2e7a2877496e46f9e235390c1edbd5aa972dd95e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842117, "uuid": "cdc98f6e-2749-4b5a-93cb-df51d034b886", "value": "T1B1931235CA0EDEBCD581053AF5C8C6C1B28924286EF2F7CA118B974DEB521F2096C7D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842117, "uuid": "f681e08d-eb15-43cb-9d40-0186a495c89d", "value": "1536:o5BTFsAwvJvjzmV/WQ0nuGWbgKxcYgmflYBp7PkLwvRuNZFX8m3bZ0uGi2aU:UBTzkdpQgTYglYt0pzkLwZuNLMmrZ04s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842117, "uuid": "0517f579-a195-4d40-b7c6-a7a49a628d6d", "value": 90696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842117, "uuid": "6fdd0e2d-2cfe-4b46-95c5-d6d7b69b0415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842117, "uuid": "1e8b23cb-4fcf-45cf-89bd-fe0b99336c0f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40dc291-19ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772872199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772872199, "uuid": "e4873dc9-5998-4739-b730-f42edd237f8e", "comment": "Malware payload (AsyncRAT)", "value": "ac2c946bae19093408509c6c702dfc3f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772872199, "uuid": "56af1f21-2fed-47ed-976c-1559b686c353", "comment": "Malware payload (AsyncRAT)", "value": "1faec8bc823455133b1bbfdc264a23187752411c981e5e78da05730fd5fcae40", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772872199, "uuid": "a61d7e92-e9b6-4dd2-ab92-06f0e3ed619c", "comment": "Malware payload (AsyncRAT)", "value": "3d8a3a42e4d045cfe978d3834f22a16b29cec5cb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772872199, "uuid": "91b1030b-1836-48b8-9567-7b01491295a4", "comment": "Malware payload (AsyncRAT)", "value": "ce5d5f093c377cb557cffac27e851f42844b1e648867e685f8f440d1f2bdab6aedac2303d3e2b40080148dcf4ab2e5a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772872199, "uuid": "b959667d-8a72-4100-9e8c-08779ccd6bcc", "value": "T15FF23A04B7E88A29E2BD5F7D9C3691404331FA575D12D79E1EC0549E2A23BC8CE24FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772872199, "uuid": "40fdc9a7-d9a7-4762-a400-b54b1e5c1813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772872199, "uuid": "32073fec-8b7a-4c91-be2b-514179a496cc", "value": "384:t7X9ONkWFqL+NoGyrhgs/eSlJCtL8N393bayse6QxnC7O+W+l3uunGfrgYCx9WRw:tz947oKy+WesktL8FRbJpB+W4YEgZj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772872199, "uuid": "a05ee6f9-35ba-475a-b2bd-211412f7a4f8", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772872199, "uuid": "40783caa-254b-4f8c-986d-ea096eede78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772872199, "uuid": "926c1802-51dc-4b50-949b-9654d104a0d5", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd64284-19e8-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772862199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772862199, "uuid": "b41f657d-0d33-439f-92ac-23853402decf", "comment": "Malware payload (ACRStealer)", "value": "0b029ff7d56a2dbfe40b9d261cf61c30", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772862199, "uuid": "544310b3-02df-4a84-8be2-96a275464f30", "comment": "Malware payload (ACRStealer)", "value": "20ce51e6bb4702822af3ef59b52eaa9e98f6936b5361b89e2626ea376b946126", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772862199, "uuid": "e1ed9092-161f-427b-81bc-4f97915a9b5c", "comment": "Malware payload (ACRStealer)", "value": "5036fd23f1cd1351e028c002a1a0ad7c23107951", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772862199, "uuid": "c2fb9515-c2ea-4038-aa20-12af792f45fc", "comment": "Malware payload (ACRStealer)", "value": "b2722935402ee744a00915ae9b1c4caa112509df0d3c9d2ba8f91bced45b9b472b84b48109a969739d6a0f237275456c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772862199, "uuid": "5ac1a84c-cf62-4d3c-991a-e767baa89090", "value": "T153858EA6A6E906F3FA6AD63D8117061FE37178E40B21D6CF431046EB9E27BD19D39700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772862199, "uuid": "a7cdb041-2673-4eed-a4ab-a2049245af21", "value": "60ca84b2a0bcfd6ea13da89e6f7e9a99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772862199, "uuid": "436e0b37-7a43-45a9-a824-999bb31e8ec0", "value": "24576:BkK6jYKfDzKFcfxeGzqWCVamQju0lnZCp89NoEuUKpZaGxrThFmLfmywjkhPoyYO:vWCVO+p89NxuUK3dhFmBG1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772862199, "uuid": "6d80c8cb-53c4-4808-90fc-7047f638969f", "value": 1818624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772862199, "uuid": "6acd56af-5d70-4d4a-8cfa-f3a60d1d5b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772862199, "uuid": "9792604d-9c83-4fbd-88cb-185c444c97c2", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8e86ec-1a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772891062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891062, "uuid": "4a134d16-8d08-46e1-9b7c-d5773bdc6de2", "comment": "Malware payload (Smoke Loader)", "value": "9ef9d1f9122dcd46c4cfe1926ddd42b4", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891062, "uuid": "2f4703c2-3c03-4c6c-ab26-4d230f5efb51", "comment": "Malware payload (Smoke Loader)", "value": "20f51ec40f2c5ed9775ce852feed3bea71e9054b78ca9239f928f70c08ea8014", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891062, "uuid": "67732fb1-6a0c-44bd-a32e-4fef7b80db4d", "comment": "Malware payload (Smoke Loader)", "value": "22ec2af75977e15d5eb319a72fbe08049b14f83e", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891062, "uuid": "00bb8fd6-cfe6-4c56-963e-c62c4e493675", "comment": "Malware payload (Smoke Loader)", "value": "316d3145bb8bfef828f2ccac19f46b79c0e0e362e36128c8b6924ccd689fc33f741b0c6d4060e978be9e63a684b8a14b", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891062, "uuid": "225078f2-461a-4b86-adf6-b9e23f88d3af", "value": "T18E95395ABC9418E6D4AE93328CB762927B30FC190B3223D72E50AA7D2FB27D05D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891062, "uuid": "368a3aaa-cee5-4c0a-94a1-cd8f1a0fcdca", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891062, "uuid": "f8b9b990-d63d-4f92-94a6-7971cf35f13c", "value": "24576:DBazOksIxgSmjlRUpH0tjpHThG3ep30MbDsK/tPHDso6f7XR:DBaaksIxlmjl+pH0tFhGuh0M3sK07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891062, "uuid": "abd21c24-74e1-4410-a67a-4d865edd0322", "value": 1880064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891062, "uuid": "be38365c-52b3-4a8f-8722-ffb960ce9238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891062, "uuid": "02c343cb-8e28-41b0-98ac-47d864284628", "value": "zHhaprGYxyWnAydgaLgGYwOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29c452c-1a02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772873458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873458, "uuid": "8548c589-77b3-46fd-8d5f-2dda13c0a826", "comment": "Malware payload", "value": "ecbc53d2a5680b688d3326d93e373ce0", "object_relation": "md5", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873458, "uuid": "e547b144-1a70-4314-ae3d-5319d20a0b1f", "comment": "Malware payload", "value": "2280a21011ccb1e9d06b86d2f951a97d253d7e9384b533a0952f96ba2b30c002", "object_relation": "sha256", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873458, "uuid": "7687ae3b-05b6-4ff1-bdc0-61f1b886290a", "comment": "Malware payload", "value": "1432b753ca1e48be1587ca487e7c1af772d142ec", "object_relation": "sha1", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873458, "uuid": "8fb7bd11-4da8-45b8-953e-896a96dac57e", "comment": "Malware payload", "value": "0ef6591bf9f90a86b93e1a3fe07f863006c4ddb8277da9493cc2aef4d9ac4a7fbf5cde20d66429afd30e22c4c41a4601", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873458, "uuid": "7e34f232-0098-4cdc-b6a3-0f74193822cc", "value": "T18DF34B1ADFE54C01DED809BD44B29104CB35A1F2A803B317BBE5E4A21C45EDDEA6E2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873458, "uuid": "921b6bb4-ef21-4f61-afa3-43f8009a203e", "value": "3072:FjV5RjfIydVYei76A8ED2dq3rAtk5m8s0UlfKCbbld5Bts+juPboQE:Q98C2dMAtkwl0qFb7H2Pby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873458, "uuid": "958e5cbe-b046-42e3-b4ea-36d55e5ed09c", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873458, "uuid": "cabc74d6-9792-45be-a08f-9f78cdb081d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873458, "uuid": "d6b24d97-61da-4c29-96cd-78369096be1b", "value": "2280a21011ccb1e9d06b86d2f951a97d253d7e9384b533a0952f96ba2b30c002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c016b32a-1a49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772903948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903948, "uuid": "2954058f-dec2-4861-a2af-e4d22979d0b5", "comment": "Malware payload", "value": "5b55ee5435718fb5dd222551faaba05a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903948, "uuid": "d1818cfe-4b01-44e1-b631-aaf9ede757fd", "comment": "Malware payload", "value": "229225eb456f8172b45ccd176f2333b8e66f45daea9d346361b6329960f2f72f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903948, "uuid": "3f85d1f7-9930-47a7-8d30-6492065f0700", "comment": "Malware payload", "value": "d85e8948af108c9c00a1d937c6ace8f212dfeb10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903948, "uuid": "10b0f796-4444-40b1-9d62-7b6d5f708a93", "comment": "Malware payload", "value": "d49a83989402e570ffa4878c2d187ebdd9fbf733543c827d4391b3c4bc00d7ec8ac328b884c7a7329be7b59ce81fcd57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903948, "uuid": "166c0d04-f55f-478c-bf30-6b737e3800db", "value": "T1127733E172C41EB5FCF48478C5A64257FEB9E4829B7096EF0174625B2EA72C11E3E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903948, "uuid": "bafe7b99-868f-45dc-892c-0e69a597ad92", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903948, "uuid": "4936cb2d-951d-410e-babf-16c54c78297a", "value": "786432:Ux6U5I1PGuPW+e5Ra5nUQHzyaLDfyRXJ9MEM7aW6sVOeS+:Ux66kuuPW+eH2UcjioEM7aKzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772903948, "uuid": "f6bf3b21-ef9f-4ead-a8c8-9f67f38c3ae5", "value": 33760728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772903948, "uuid": "aa3a1087-a386-48d2-bd6a-aff6e9999e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903948, "uuid": "dd8c399f-6a38-4de6-8b78-cb658cdcadc2", "value": "taskhostw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccfd7c3-19f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772867381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772867381, "uuid": "68104ca1-1e00-4cbd-80a2-760976a61f2a", "comment": "Malware payload", "value": "e68ddd1d7caa97e6bd6fdebf3aebdc40", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772867381, "uuid": "fcd24785-8896-43ff-83f1-5765d1178cf3", "comment": "Malware payload", "value": "240821416fe1785124e5e24fe953b8b87b4ce2798f296351026fab8e80726aca", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772867381, "uuid": "e336ea23-2f7a-4329-8aa9-40988c4cd770", "comment": "Malware payload", "value": "60644c9c0b7ab619ff0719bb39c8d6770aac61d7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772867381, "uuid": "f5de4761-cebe-4c8a-83de-17d1e874286c", "comment": "Malware payload", "value": "1b32311fd114d3110034fb20f211e45ab0d144f6ba1f347493373ac83330ebc2b61a40199303087858af96a4b4c3bad1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "extra", "colour": "#B452B6", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772867381, "uuid": "ff8b34f1-6abe-4a3e-9b7e-30d83e4fb6ff", "value": "T115722431B3F9E708E16A61779E67C6847034EDA9DB80E60B3AF4739D5C301108F79912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772867381, "uuid": "ac5de500-d40b-45e5-8f43-06f1fbc55ce5", "value": "96:9kDDQjDYMnTyVT/D6e2BqFrZZ0F/5HZwkDDQjDYMnTyVT/D6e2B:9kg/PyTb6WrZS/5HOkg/PyTb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772867381, "uuid": "4b21da15-b533-4894-b460-c2b56b58fde6", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772867381, "uuid": "7e6cd701-e570-4e78-9be3-3b9ab1888505", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772867381, "uuid": "9739dffb-d95f-4ce7-9048-939aceeca32c", "value": "240821416fe1785124e5e24fe953b8b87b4ce2798f296351026fab8e80726aca.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a5fa11-1a2d-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772891721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891721, "uuid": "4fd659ea-59ee-4e2e-856a-72754da92500", "comment": "Malware payload (ACRStealer)", "value": "852f4be5cc25ba7e0cbdde282a29e343", "object_relation": "md5", "Tag": [ { "name": "77-91-96-209", "colour": "#5ACA8D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891721, "uuid": "0b3bc229-279f-4a01-87cb-36b3693cebe1", "comment": "Malware payload (ACRStealer)", "value": "2482ccb817a02e51747a3818f6b2724d1b786f634e9a43c2c9db0997792b9cc7", "object_relation": "sha256", "Tag": [ { "name": "77-91-96-209", "colour": "#5ACA8D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891721, "uuid": "a42b607e-3b02-4277-b5dd-08f0d06847f0", "comment": "Malware payload (ACRStealer)", "value": "4ed43e2a0b0a1bfaf89ddfaeada10e8b641bc7ce", "object_relation": "sha1", "Tag": [ { "name": "77-91-96-209", "colour": "#5ACA8D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891721, "uuid": "1c341659-5a3b-418e-ab38-4a0d3e38672a", "comment": "Malware payload (ACRStealer)", "value": "d1b977506d4f5f8a38b9eb53ad4f5433c7b51c25639e9934704a60e0ed2ab639177bddebb261e33419198923e8208d85", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-96-209", "colour": "#5ACA8D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891721, "uuid": "550e9b8c-757e-462b-b512-b0cecf56911e", "value": "T1BE16365D6C0A15B2D51F00B66EB7EBA64604F3CE00F9F5F6F54C8688B052706FAA1E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891721, "uuid": "de0a8da9-cd01-4829-ab0a-a07bd021fd7e", "value": "87f26fae22aed88d36e7fbd312c4555f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891721, "uuid": "dc729b01-eed6-41a8-97e5-cdc80ca40b31", "value": "49152:6fKzwS7+XMjfkzwtx39/9QIuA9/m4Bqiwa3gxX3NBbVJ6k7uaR+OJrk2VdDH2b:6f07139Q3A9dqUwdXVJ6k7XJrkmdL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891721, "uuid": "c8cdc95c-9614-4826-89dd-1b6312282803", "value": 4336128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891721, "uuid": "2ed6d7d7-6817-4326-b960-866b013affe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891721, "uuid": "6a6ba412-ffb1-4f5e-8249-c2eae787a2c8", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8e5798-1a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772925011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925011, "uuid": "fad24495-5b33-401d-b911-4874b06f58fb", "comment": "Malware payload (GuLoader)", "value": "a92a21c80c95af7ae84d08aa680dcecf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925011, "uuid": "6bec9e32-00de-4728-a4a8-1d599eda86bd", "comment": "Malware payload (GuLoader)", "value": "24a45d0b7b4fe778fe67729da5b9577b79bd42a847004110406fd57efec03ecc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925011, "uuid": "0706d0fc-6bf7-434d-a74f-25525cc2930e", "comment": "Malware payload (GuLoader)", "value": "c73220c2be8e13b6b559fa40e8a1601645de2c57", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925011, "uuid": "ae1bf536-090b-465f-b99f-edc418409274", "comment": "Malware payload (GuLoader)", "value": "b958a71fef570569c7dae2d766bb24b6c9dc49c37030721e114a19d10085b8c850d48e69d5027150d90c2f1da25e2d7d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925011, "uuid": "34944cc7-c140-4602-a60f-44b7defe1c54", "value": "T129941225B593C84EC92219701DF6E57DF5A8ED992A218613B7E0F70EB8332119A1D3F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925011, "uuid": "307b6014-5f29-4d21-942c-4852ebe3f12d", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925011, "uuid": "05d7cdd8-e388-4b59-9ebc-d9a88a6fb3c6", "value": "6144:nwq3NpGrARiuIAMBW4bdmaJeYei3IBkiHOLW3D8SC0N3Snb8RvDTTL6Q+vR:nzSiibrI0Iki8W3ooBSnb85vveZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772925011, "uuid": "455448ee-1fb4-4ec3-83e6-df6dd0226e19", "value": 415049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772925011, "uuid": "6aef438e-b968-4793-a57c-62ed59d49d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925011, "uuid": "6a544f60-9566-465b-9748-841ca6098e36", "value": "Order-Acknowledgment_LTMG - 1 (LT958) RFQ.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d1ea67-19fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772870000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870000, "uuid": "c90cba4a-fc2d-4fdd-b192-53875ffc80c6", "comment": "Malware payload", "value": "0fc9f35147e37b38345b8d80d093205e", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870000, "uuid": "d082c51e-bed0-4c5f-8079-231473d70893", "comment": "Malware payload", "value": "26b8ea7bb37f273ac6d64b175fcf3f97c247a4f6f89b3dd77c279acbf443867f", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870000, "uuid": "72de7331-e26b-46a2-8373-e9b0a2a0b94a", "comment": "Malware payload", "value": "0dd719c3546487b467bdc10e92d48c2d29664dc6", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870000, "uuid": "75a5f2f9-5b57-4c56-bd28-4c558a9a1e80", "comment": "Malware payload", "value": "81b1e17af0e80548c2964e2d3ddf50aead1e128f8e09a224cd5eb1ed030ea6d564aaa1fc4a749ec7f847e1429fbcdc95", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870000, "uuid": "9a8a3307-0927-4703-a2fc-3cab9c1b6e7d", "value": "T1DC46330A59D0B548D8F501B1862CF0933EB1E5932AB25C5D1D63BB4AC7F1A7A3EC71E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870000, "uuid": "8c99a796-f59d-4191-a584-2adb0882ebbe", "value": "98304:fhp7b3EhoJBdFAdIrslexnsX6YotS2+xtJn9BTFAh01zjpw9Urg5eVHarm+ctS+7:DP0hrAUEnsvY+XTVOhjYqGHaPEgD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772870000, "uuid": "24a9a67b-3ee6-4ac1-b4fd-9f4e90517159", "value": 5353494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772870000, "uuid": "f52c3688-95e4-4a85-88dd-edacdd8e5212", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870000, "uuid": "7c2f9711-0afd-4d68-bfa0-f9b00f3434d5", "value": "26b8ea7bb37f273ac6d64b175fcf3f97c247a4f6f89b3dd77c279acbf443867f.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43436269-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871097, "uuid": "a64d0c2e-ee86-4c12-b910-1b6eb507ac23", "comment": "Malware payload (Mirai)", "value": "3bcf9f7095ace24f6ca2a1926ec20922", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871097, "uuid": "cfd9a29b-1a98-43ef-92b6-9650dbc7324f", "comment": "Malware payload (Mirai)", "value": "27ae6791bdf69f4550fb3d8a4109e24b78d9cd66c0531c4e4f5a26e666fd650d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871097, "uuid": "20739e5f-8822-46c6-a733-90db9137098d", "comment": "Malware payload (Mirai)", "value": "e6d1ab9db6ac1747497e6ef21e3db194f7a5e7d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871097, "uuid": "d6e2d744-c030-4f04-a931-142047ee005a", "comment": "Malware payload (Mirai)", "value": "53a481f822d9df49b9e26d7337e4ccd01e85b791eb980c66aeefec260a10f4eef4ce87b881b508c610e13c7da07469b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871097, "uuid": "8416ec0a-3f63-466d-ade6-7521e4e82873", "value": "T158834C89B800DDBDF44BD6FA42230919B931A2514FA30F27B767FD9B7CB20A49D1AD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871097, "uuid": "28e7d0c0-314b-45f0-9603-3524cca6b361", "value": "1536:R14u6b7zZgqCo5kqYZUrbhL0WnA5T+f/u0IG8SFQd89qgwQnRbxFHG/CA0DeNnxG:RP6b7zZTkq3A5SRnFQp8xVG62h2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871097, "uuid": "0653bb06-1aba-4cfe-bf44-3e7086e343ff", "value": 86776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871097, "uuid": "983939d0-d535-4f50-88ed-4bda5b85cb8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871097, "uuid": "7eee245f-81b7-4382-9366-37a6927b5116", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f48ddf-19d0-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1772851874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772851874, "uuid": "1d8e26b6-822c-4666-a843-b53a216fc5eb", "comment": "Malware payload (SimpleHelp)", "value": "5239d6867d7e09a0d4236f0aab95193f", "object_relation": "md5", "Tag": [ { "name": "144-172-96-63", "colour": "#484662", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772851874, "uuid": "3f7077f0-6543-41a0-addf-37461907c6a6", "comment": "Malware payload (SimpleHelp)", "value": "28bfb5ad030de1cb0be842de702da578869ddf6bccdd32b7f6a991e65025587d", "object_relation": "sha256", "Tag": [ { "name": "144-172-96-63", "colour": "#484662", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772851874, "uuid": "6bea0d98-dfa2-4397-9552-08c8ce7862fd", "comment": "Malware payload (SimpleHelp)", "value": "cd4f293e1b1fa748bf4b57cd0ee9a2cc6e2e452a", "object_relation": "sha1", "Tag": [ { "name": "144-172-96-63", "colour": "#484662", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772851874, "uuid": "1b516d9d-1524-4245-9e3d-1595cd66168a", "comment": "Malware payload (SimpleHelp)", "value": "0ea98a0ec1d9d1baf6361596d8d40626b6ad1929d3078f268d9b5c3920a3a74d82d1ade8d3597dd16809cba10dc1ffc6", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-96-63", "colour": "#484662", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772851874, "uuid": "aa41d24e-28da-4c8a-bd24-20df1540ebdf", "value": "T19A873329F39599FECE33D0FCC0854487EA96B9E54385412717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772851874, "uuid": "ae77cfb5-302b-40b0-bbde-45f0c978df8d", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772851874, "uuid": "ac54970a-2947-4d27-8d7d-69072ad0bbcb", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bV:/uRf+nAu2FuQd73XyFeDMnKTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772851874, "uuid": "6d1d059a-a0c7-4727-8d3b-3bd68c21abbe", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772851874, "uuid": "2a82302d-d3eb-4ba1-857b-cc0c4ac5261c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772851874, "uuid": "36121e02-c27d-4091-9fd5-134ce2e7601a", "value": "Ststement_File.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095ab123-19f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772865416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865416, "uuid": "cfdaf23b-8857-40bb-a776-4f34a844dba3", "comment": "Malware payload", "value": "951cf81f6bf697c373d00a9ee35cce4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865416, "uuid": "06e36ee1-7776-43f0-97d1-3830d058df0b", "comment": "Malware payload", "value": "2a23887ebd2010b6985772341ee02e1a1fea794aa4a94b49110c3daf361ac047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865416, "uuid": "4913bb61-53bb-443e-821b-e1cd551d5a88", "comment": "Malware payload", "value": "6601279b099895ba0e3958b42ab1533ed966c96a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865416, "uuid": "3dc18aa9-3dc7-4c92-9e2f-399377a14f1d", "comment": "Malware payload", "value": "a9e495908c270d7e17ff68ba8fa65f39b434befa83cb106b2e86bb940b83883a82fa8047d67e93244d2552f8f04a551a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865416, "uuid": "22dd8f0c-0381-495f-a46f-2e337ade3d3f", "value": "T185F4FB7F99629126DA8A80FC34494B625971B33B03B41FF701669130271B9B2EED73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865416, "uuid": "b65f1295-0f4b-4c72-98c4-0ec053822c9d", "value": "12288:nvEQz8Z8bxWJZJTx67yY+V6mMbSn1ZJ7fQywTwGOB7iaxlScS:vEQI8bxgZ9x67J+QVTWB7icS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865416, "uuid": "fc0f0178-75b3-4520-8544-ee94a754895d", "value": 729472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865416, "uuid": "1d9d98e4-1c34-485a-89e8-db8e2e23b255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865416, "uuid": "74362d39-2bd8-4317-b95e-93d447ae1556", "value": "2a23887ebd2010b6985772341ee02e1a1fea794aa4a94b49110c3daf361ac047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf52741-1a42-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772900933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772900933, "uuid": "57b677d9-fa3b-4e55-bbf2-416a98c3a2bc", "comment": "Malware payload", "value": "520959a672b7767cefce1536ef468a2c", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "cookie-stealer", "colour": "#312B5D", "exportable": true, "hide_tag": false }, { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TopazPhotoAI", "colour": "#090468", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772900933, "uuid": "f8f4ac1f-0219-4780-b9af-b29f68b38f4a", "comment": "Malware payload", "value": "2b278bcfc2c7b1fb14d4ab86a6ea78f5ce5fc2c487bb2a0f3e4efb6bcaa04b25", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "cookie-stealer", "colour": "#312B5D", "exportable": true, "hide_tag": false }, { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TopazPhotoAI", "colour": "#090468", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772900933, "uuid": "3f49ca1a-70b5-422d-b58a-94cd9311b40a", "comment": "Malware payload", "value": "c2a3a266c8be78f261aeb57e639f29bac6b3682c", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "cookie-stealer", "colour": "#312B5D", "exportable": true, "hide_tag": false }, { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TopazPhotoAI", "colour": "#090468", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772900933, "uuid": "a719656e-4125-496e-97d7-1bee95742cba", "comment": "Malware payload", "value": "7c11216a6d262b73180d2c92a699bb4ee1234d5e5a708eeddb1d06df2d9be66d1d1e86c2bcee29312b342829a68571b2", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "cookie-stealer", "colour": "#312B5D", "exportable": true, "hide_tag": false }, { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TopazPhotoAI", "colour": "#090468", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772900933, "uuid": "4240f625-22d8-4712-b6b6-715d0ef69bcb", "value": "T14CF47D55B6E434A4C57BED76CE42D32BE2F1B808CB3597CB02784E5A1F2BAD05936321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772900933, "uuid": "16827851-71c3-4b52-91bf-9f44ff38c420", "value": "ad8a4c67d419c46b8f4be6df044c3dc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772900933, "uuid": "54814d78-fc47-44d1-9438-fdbe3d914d5b", "value": "12288:R69zDWT/xwNqd9brIX3JALF1QbOagrEGgtNryyCJuDT/PNa0V8QzHyw89:R2Dy/xbXX2YIbCQsu3/PNLeQzHyj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772900933, "uuid": "1e7daf78-1cb3-4227-9eb4-758c5de03e29", "value": 787783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772900933, "uuid": "a88ccbef-2199-4993-b9ef-df6b982f8299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772900933, "uuid": "ee459be8-dd34-4ea3-b9bd-c8c566e5ab14", "value": "RequiredModel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce58f4ae-19f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772868323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868323, "uuid": "c1088209-f7d2-40c8-a5ee-c0517fdc9e54", "comment": "Malware payload", "value": "91f1b9637f551921cc6d7f966c43ef5a", "object_relation": "md5", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868323, "uuid": "48cca371-fe43-4b21-8e3f-26a9d25ab0bc", "comment": "Malware payload", "value": "2cb9671d54e85c9b732c29cfead3ffdf8aedac8eda8ab58813e97a148e05edd6", "object_relation": "sha256", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868323, "uuid": "669dac28-7d41-49d3-a11b-11e8db974898", "comment": "Malware payload", "value": "ea928e06b50fda509a760e5a74c3e652e569a181", "object_relation": "sha1", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868323, "uuid": "d30fcfda-258a-464e-a203-997ecbb8d22b", "comment": "Malware payload", "value": "2ce03b6f320da0ac6092d9e5d91b8f30d434665074c1deba4e8479712481183170055096bc650146af99765c2f8e750f", "object_relation": "sha3-384", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868323, "uuid": "915586b5-4844-4d96-be12-da4c3c8b1059", "value": "T1A3757CBAE8D81CCDF9C6CB598536789D5E2E3127A9C93C81447D8F01B0C6495ABC3AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868323, "uuid": "15fd8cca-9a85-42b2-952a-6ad1436abef6", "value": "24576:4nVUsOpK9Ly7lrEbQF0rVhfDWdxlYI/912h8v9:4VUmI7lrEkWVhfUxx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772868323, "uuid": "12ae44df-f5f1-4bdb-9a5d-57ac912ab948", "value": 1675436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772868323, "uuid": "69ef515e-ad3d-42a6-9c90-41dbd9638bff", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868323, "uuid": "1c0bfecb-20a6-4d37-8c4b-e68db758390e", "value": "2cb9671d54e85c9b732c29cfead3ffdf8aedac8eda8ab58813e97a148e05edd6.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a69567f-1a31-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772893550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893550, "uuid": "90f27580-1df7-4a91-9d93-2d931b02d3d7", "comment": "Malware payload (AsyncRAT)", "value": "3a90f276a78645748d3ee4334534d255", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893550, "uuid": "16e1b8ec-cc2f-4fda-ad7f-830997272022", "comment": "Malware payload (AsyncRAT)", "value": "2f354cfa595f102401a8f160208dcf6474fce66b3b80673a5f3ea6e2c25f8c43", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893550, "uuid": "edd45816-a807-4a27-aa90-0fdf9766996a", "comment": "Malware payload (AsyncRAT)", "value": "f402e6adb4f0a7bdc0eee106e13bdfdc4f6007d5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893550, "uuid": "d308246c-75f8-47a5-971f-a8109050010b", "comment": "Malware payload (AsyncRAT)", "value": "3e3684c33564c040576b4f1d532ee6d6b27a14f28c507aaf88314cbc980a0f96065dd52ca8881dfe62063d6b0276c1c1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893550, "uuid": "cb0c8247-3378-4c9d-aa94-34c9d686ab04", "value": "T14303490873F44A25F2FE5B7D9C7686405336BA479D22CB9E1EC4509F5A23788CE24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893550, "uuid": "a34a6c72-01aa-4dc1-947a-ccbda3307c6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893550, "uuid": "728fcf12-5806-4006-a99a-62c43b9b23b2", "value": "384:a7XVPfDrL/YmNFsP8TjKMFEWbne8393bayse6QxnC7O+WRl3uuhGfrg7UUhCSIWm:azVPfPL5N+PcKsrRbJpB+WP7LgJZ+j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772893550, "uuid": "92f0543e-581b-47cb-92cb-44c1d89a8895", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772893550, "uuid": "c6578b31-fe37-4007-a84c-a65e892c0ca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893550, "uuid": "8889b23a-75e9-4884-8d1f-ca64b03cd7db", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f55cd1-19e2-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1772859560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772859560, "uuid": "1992734d-4ca6-43f5-922b-99fa24266615", "comment": "Malware payload (AteraAgent)", "value": "063e7372a2a99fa35745f41904d188f1", "object_relation": "md5", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772859560, "uuid": "ae197066-2acd-4ed9-9912-c278e47d52c8", "comment": "Malware payload (AteraAgent)", "value": "3077d335b4d51417fac291f1ce9cbb61ecc8cd893194a0292b0f2be5bcf45ad3", "object_relation": "sha256", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772859560, "uuid": "9ddfb9bd-db50-4719-9d8b-a1f87242173c", "comment": "Malware payload (AteraAgent)", "value": "54c4ae1bd42e030a0b6ae7f0e495acbb379bccb0", "object_relation": "sha1", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772859560, "uuid": "7f4a74df-fdaf-4985-a786-9b2c384d2951", "comment": "Malware payload (AteraAgent)", "value": "2dbf709e8257c54351f22a9718aed7faf7778c609801abf6f6ce976c4bed26c40338f8784cdffb23c1fb5cec89f1f470", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772859560, "uuid": "5185cc4d-c15f-4699-9709-ed92e3096e81", "value": "T13A862318FBE009AEE5778276C56A8520EA327C8D3720C54F47A4B6295F3B7A075BF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772859560, "uuid": "ee192142-1483-4f2e-b197-9582e26ec192", "value": "196608:3W/FMmnGYLnWgziirlb4/ieF3GrAfedpvCs3md8r:qMqGYLpZreF3G82yc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772859560, "uuid": "8c845d6f-ec0f-4119-9f78-43b372b231d1", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772859560, "uuid": "afdd42bc-a1e5-4dec-98a8-f15c2fcc67ff", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772859560, "uuid": "75f959fa-b621-4ad1-994c-643cef09c7f9", "value": "ZoomWorkspace.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f7e7ec-1a25-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1772888338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888338, "uuid": "3ba7accf-c065-4342-b0f6-2a02813089b6", "comment": "Malware payload (SliverFox)", "value": "757a32cea090e1dd291809ae6658a137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888338, "uuid": "7f7f9907-63a0-4fc4-a9b5-128a25933659", "comment": "Malware payload (SliverFox)", "value": "31492751604440f10a1d3a3650719a1094f94b3cf2483d9928aae1ad9854d651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888338, "uuid": "6a6a0d48-54c6-4e90-be99-cd3f447fe353", "comment": "Malware payload (SliverFox)", "value": "9a07ee9d9aa7ba6427b11eb8b5d717def0101abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888338, "uuid": "a7e9944f-6dc1-4ba3-9e6c-d2eabcef5ae5", "comment": "Malware payload (SliverFox)", "value": "68bda6c9f779744e9e2e378fb133e92e66fe301d445ac9733c7ff930cb20208c7cb4e5cd76ab323f2aa7c91d634c73d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888338, "uuid": "425d7612-fe23-4aca-9268-64bf045f11ba", "value": "T1F665234BCB02C0F2D1290335DA099B9236BA6C66FC194357AAF67B2D1D77F348E2B445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888338, "uuid": "c65bbded-790e-4f3b-a115-9cf52aeb2eb2", "value": "923b402ce0fe56023d103d6fee0bff99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888338, "uuid": "5ecf7a1f-9b5e-4f04-ae36-f4338062600f", "value": "24576:aMl6knakIJ2H/sgtFXe6QAvS8LsfRAvW37VVScyiduPuVFCLdzylEwe7C:bsQaWH/sgPXe6QAFqAvwntndac2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888338, "uuid": "fa54171b-326c-4af0-91e2-552d77950c45", "value": 1439744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888338, "uuid": "27a7e5e8-fd1b-48c1-a7c4-bb124bcc0d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888338, "uuid": "4270e39e-e7ca-48e2-964d-67069b8060c7", "value": "2026_\u7b2c\u4e00\u5b63\u5ea6\u4f01\u4e1a\u5185\u90e8\u8fdd\u89c4\u4eba\u5458\u540d\u5355\u901a\u62a5\u4fe1\u606f.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0975276a-1a00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772872288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772872288, "uuid": "48afb7b3-26ca-40ed-929a-5d02293d142e", "comment": "Malware payload", "value": "015924e48b805555487130b464ec037e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772872288, "uuid": "30761665-224f-4601-ac09-cc8139423775", "comment": "Malware payload", "value": "317f523b62941f1a5426963055fd27a7660a8273d0bf22a77fece8800230980c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772872288, "uuid": "513867d3-3292-4c78-a3b1-02a75115ac26", "comment": "Malware payload", "value": "dcf83910794f3b1dac0c232425090a754cbceaee", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772872288, "uuid": "38a758a7-a9a0-4cc3-97dc-285adbaa611f", "comment": "Malware payload", "value": "a52db2b08efdf6287736495c3cbcea750d672ffb07b5cfe64d14e5f303887583b9f7ef5e1ac4c77c60c79652f4dc6de2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772872288, "uuid": "082534ea-a8ee-481a-9970-9d6009e46ac9", "value": "T17C2633C650CBD719D6C4D03A65BFF276D9082B95A90383EA2B9892B41FDE190133DEDC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772872288, "uuid": "f5ece7e8-420a-4154-9257-4c4a61497fe9", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772872288, "uuid": "789b8282-68cc-402e-bdab-f2f84287d073", "value": "98304:mWjmr6ur5tuekfswPlE1eiUjErqblJm4Opm4wsdZlkDUVlTM:mWjmJrDuNswP+hJEJGpm+ODilT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772872288, "uuid": "f1516bbb-2b43-4f24-9004-1d7fc7bda44b", "value": 4648448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772872288, "uuid": "8034f1c5-a9ce-47ab-ba23-d61e7e2cf126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772872288, "uuid": "358b4206-97e8-4941-b7ee-77feacb99707", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35aeee3-1a4f-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772906530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906530, "uuid": "4d4b22b3-cf02-4494-8001-59ec059fcaeb", "comment": "Malware payload (QuasarRAT)", "value": "f304c001ba733ced1a3b213dcf2d1ba0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906530, "uuid": "a50e2be2-d0a7-4bb8-b9f1-5496c796a714", "comment": "Malware payload (QuasarRAT)", "value": "32855d78f2bb5b72b9ea1a9284a04e52bdd3778fcf4e23eb6229356b9f158c10", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906530, "uuid": "472def22-eaf2-4d2d-be97-7ab027a624b8", "comment": "Malware payload (QuasarRAT)", "value": "c65bdda766b3702eed9b4874e636e188169a924a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906530, "uuid": "53064018-0bed-409e-8b0e-99e53e5b5154", "comment": "Malware payload (QuasarRAT)", "value": "2b295a15b0739fb165d2f1bb1707b100cfcc78b37e4980ad16e5278097fca7676d41d911430e4831a85952e3031dd94c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906530, "uuid": "47e89076-f7cf-43d1-8802-3ee7a93d1d30", "value": "T103F423366CB89E7D0A7803E5A413DB054CE852D30C1C5CD776D8BD093BAB9819A1F5BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906530, "uuid": "ff3efd79-49a3-4ac8-9347-032890acf749", "value": "12288:0zj3uX1wUG0PU1K31XjdkhGMe+7xlYCVWGP+743+dEZN3ZTNQ3isOUvNeCK:azuX2GPn316hOg/z+O+dEZrNkisn8CK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906530, "uuid": "e9e77dc5-78ac-4ee2-9a5d-39aa195aaaf2", "value": 779377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906530, "uuid": "7c6689d1-fe78-439d-92ca-441254bea62e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906530, "uuid": "b472b09c-489d-4184-974c-167e963b6626", "value": "Sentinel.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c2f3f6-1a47-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772903078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903078, "uuid": "e61045e2-b74c-4b03-af28-35c3ed819082", "comment": "Malware payload (RemcosRAT)", "value": "e9609d7fa92930f60359fbc6f4667c4d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903078, "uuid": "7ffdfa09-8c71-44fe-b982-5d98708786d7", "comment": "Malware payload (RemcosRAT)", "value": "329afa0425a06aefcfeedb09773ef58199f5f07ef43c77bc6de4f249a590bc0e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903078, "uuid": "f7371e29-e891-4db2-bf73-0e9bab0c8ef1", "comment": "Malware payload (RemcosRAT)", "value": "481e3f63c594bc914b5cc9b58a031dd68386b6a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903078, "uuid": "45cd9cf3-8f54-4a79-ba70-7dcac448fb28", "comment": "Malware payload (RemcosRAT)", "value": "2694335e3e059bb62f8c8fb8e01999a3bc0972b7be3c922a8756d649a0020ba3befb8e96ba0c9332b803d871d4d62c31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903078, "uuid": "13f5f5ae-406d-4210-92bc-0ceade15126a", "value": "T13DF5AEA5830C3BBAC7FC530C40BB395EB2E1931E7C55A94C7F72CCA09A365C815AA5D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903078, "uuid": "6c1c25d1-96ed-445b-98d1-c0295461e00c", "value": "24576:/xe6TxWwCdF3Wb/tQG/AkMQQJKH12bi1juGSSJO1By7s4FVisySo9tNhAGz7SVgz:MWDtQwMBKH12eJSB1sgI87z9xCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772903078, "uuid": "14ae52ff-af3b-42ad-aab0-5c838e6845cc", "value": 3326728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772903078, "uuid": "be447df0-a12a-4108-ac28-a1a842b7e991", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903078, "uuid": "43ce1d72-923e-4917-b99b-8c29852698f3", "value": "e9609d7fa92930f60359fbc6f4667c4d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a99ac2-1a3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772898535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898535, "uuid": "fb6bee88-33dc-46f3-8706-239ad5c1b987", "comment": "Malware payload", "value": "6cf3ed386024c73e6666416437f2e6a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PeerTime", "colour": "#9052AB", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898535, "uuid": "8dde1f79-863c-4246-a3f2-5bd89898a523", "comment": "Malware payload", "value": "34d64b3cd9430e85edefcb883973a086dd5de9917e05fabec89b1f4ab9627e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PeerTime", "colour": "#9052AB", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898535, "uuid": "91c56e4e-2690-44ed-b314-5e315b2568a4", "comment": "Malware payload", "value": "01b9161375f2f20c8058357106d2a51004f9d4aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PeerTime", "colour": "#9052AB", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898535, "uuid": "465af4a1-f8b2-40b1-bc19-449c94d89f5e", "comment": "Malware payload", "value": "18061207582ead4772b6d51ce6a2f7a70109aceae418171f0b01777e90e879ba5cbb2d5e873794b01ba899678301ad4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PeerTime", "colour": "#9052AB", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898535, "uuid": "9206eff9-7850-45a9-8a44-46d9eb6241c3", "value": "T18F752316FAD1E83DC883C57C070F56B6D6367C48A366E4BF6252FA709E62F912A14160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898535, "uuid": "3ad97c74-ba47-4174-8074-6b8b36e38495", "value": "49152:9YzL2pwdxnFyBKfXIGQ9/Ftjh4o/snpKoJLB:mzEwdxnjfXIRtjh4oO7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772898535, "uuid": "5aebc839-7f3f-4319-9bd8-9fb09afe13e0", "value": 1608240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772898535, "uuid": "dd59b614-2e89-47ed-8ab2-2f242745be45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898535, "uuid": "68f1e71b-1cc6-43d8-925d-e0bf01fa788e", "value": "amd64_1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca41993-19f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772869287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869287, "uuid": "b606bed9-5219-49ac-9adc-7d1edfe57a82", "comment": "Malware payload", "value": "615cb7a8f014d9ec29ec556e692b677e", "object_relation": "md5", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869287, "uuid": "09e76301-d342-493e-adb5-6bd30dc1fd9e", "comment": "Malware payload", "value": "376636045ad447fbfcfda67c52bb2e1d862cd6f26c369839bce6a35fc6ab427a", "object_relation": "sha256", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869287, "uuid": "6c81a782-a6b0-44cf-bb72-cc6f2bb0d082", "comment": "Malware payload", "value": "b7b6615e7bf93691be706b4b5ef6dcbfce5bd88c", "object_relation": "sha1", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869287, "uuid": "78905583-6460-4b17-bf21-0b3eacd4a35b", "comment": "Malware payload", "value": "dd65a8d754576132cfb568b099423e40cde994b698dd710fce7761bcec6ad24ec7141137bf21f1dd19d1425088ce700b", "object_relation": "sha3-384", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869287, "uuid": "530bf121-a75a-4ea7-926f-60b977cf943e", "value": "T1CD372934420312ACFDF9CD349A2BCF8DEC4D466BE5136548FE1B70742E8AE55663B42A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869287, "uuid": "4c7418b2-cd58-47ae-87cf-5a37b0e8d2a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869287, "uuid": "7b63a139-92ea-425e-a2d0-4d70f98218d9", "value": "768:2hk1Xo1p7Lq+91/XhbJH9ktdD08c8UUS0uQx0hEAW43oaVR2Q5FPiA+xMekCohAp:J1Ae43Qx01oaVR2WPidTktAps8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772869287, "uuid": "0111c572-770a-445e-b983-f2fd6a03c1b9", "value": 22994432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772869287, "uuid": "03019181-261d-44a8-a5ac-188a98e77203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869287, "uuid": "c890975f-ce78-4ac4-af96-15a85fc1b3cc", "value": "376636045ad447fbfcfda67c52bb2e1d862cd6f26c369839bce6a35fc6ab427a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f5125d-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871162, "uuid": "3c105405-ab93-4798-b8d3-36eaf592584d", "comment": "Malware payload (Mirai)", "value": "ee03545272d991d9dc14634fd5847ad0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871162, "uuid": "81e43cf5-f904-4dd2-b86f-5a63fff3bd45", "comment": "Malware payload (Mirai)", "value": "39e7f54a6d27d0b58b01cc7a8f521972fd0f58e1f87668dd1c57a465a6c645f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871162, "uuid": "e70ba864-ed5a-476c-9655-4a644b783337", "comment": "Malware payload (Mirai)", "value": "0080dc846687bc846f806e41360911ff165d0647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871162, "uuid": "cb929f5a-ce5e-42da-a90e-6cac47bac826", "comment": "Malware payload (Mirai)", "value": "bade7f4ab4905d2abfb5a58cb66cc6515951331bcda57a88db6426204d4f64e3f3f1dd1cce5e7074254668d38f8fdc3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871162, "uuid": "86447ff1-a6be-4da6-9cfd-702b9b4251d8", "value": "T12D734BC9E1C39CBAEC11097525336F32DB76E53F3275DE83D7B9A921E901502A42A28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871162, "uuid": "8817a484-c3db-4f14-8ee2-19edf694f182", "value": "1536:dcCrwoM1IFgYHSZSgMGdqFK/Yu0aXPT/lhSugY:RrwoM1qyZSOdeK/mafblt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871162, "uuid": "515edf67-eb48-4c69-9d28-7305fcf8ca50", "value": 74896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871162, "uuid": "b8084007-e0e6-42d5-905f-a59e4ed660b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871162, "uuid": "723c9e44-f56e-46de-9566-cc3ac1f06424", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79e070e-1a02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772873493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873493, "uuid": "53903d6f-2e5f-40bf-9132-69a2dd95ca41", "comment": "Malware payload", "value": "50bb96874a06590ac6597cb6d244bbdf", "object_relation": "md5", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873493, "uuid": "88d77edb-d586-44e3-b28a-43dcf96cab7f", "comment": "Malware payload", "value": "3b949335c6c7bf29c4551867507dc86476977731159a824ff34a0b4bc3a9ae18", "object_relation": "sha256", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873493, "uuid": "3f1f99e6-39b0-4aea-a741-52d2345dc5b6", "comment": "Malware payload", "value": "349fadfea3de6460282f485175c4086847a701de", "object_relation": "sha1", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873493, "uuid": "0365dece-357c-4815-a499-275d92478872", "comment": "Malware payload", "value": "bfe99e144efc3c964675c62b23ae8e2afc21d4f1f7d8bfed7ba78bf3a40228608af359c5bf67496b494cf153f758d43b", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873493, "uuid": "8b68020e-c6c4-400e-8276-0fc703cbf966", "value": "T1D906338E60F40360D29A67F55087182313F9410769FFE79B3B18F5A68F2139A47A6B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873493, "uuid": "fd30e209-2bb9-43ec-8fc0-82ae54490c6c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873493, "uuid": "66d9c0f9-8b3d-45ae-bf59-209797665dce", "value": "98304:UuO8xCsskaRod/MWfOf3GLMMzsva+vG/s944RJ5+ylIIa5umX3i:UuXxClkaRa/MwK2xACd/sXLsw65umC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873493, "uuid": "f4862078-6238-4495-bada-774a07c75180", "value": 3962368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873493, "uuid": "c34099e4-cfb9-4b8e-8893-9d1a7b746183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873493, "uuid": "88401aaf-6661-4e0b-82d8-3ca4793a6363", "value": "3b949335c6c7bf29c4551867507dc86476977731159a824ff34a0b4bc3a9ae18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cabb1c2-1a4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772906438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906438, "uuid": "ce56fc21-1221-4ef3-832b-7094b75eaa39", "comment": "Malware payload", "value": "6af99d08e9295db93ad869af5ec1422e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906438, "uuid": "8136234c-93d8-498a-b235-1ea4929d5037", "comment": "Malware payload", "value": "3d510977d60a44322f88100b515f06cb5ed83babc64247068d1a489595faa6c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906438, "uuid": "63669a07-8b26-4004-bddb-eb3502248aea", "comment": "Malware payload", "value": "cda7136e67b34757ef2688f1e168fc927f025625", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906438, "uuid": "fee68130-4b07-4575-aeb5-44b4b1066c2a", "comment": "Malware payload", "value": "53804bd179f6027b3807745c97f24673ee71a9d5ad58f53405d27b2508c81d12ad7a6c883d9716d3b9a7f94af43ad57f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906438, "uuid": "29f85565-31b9-4f4c-81b0-114e08d74f47", "value": "T11D06C003A2924BBA9EF8073D92F9210E23DC3647405D7D1EA774FEC27599BC69607287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906438, "uuid": "5b2cf3cd-e3ea-4fd8-a443-c6adb05e35d6", "value": "24576:bld6OqI4j5VjnhacrtnvbxtgNiePH+MO4kKY5VQT02sUqz6GeFRxhaYqpOJM0NMz:6Z/gwZJY1JkejEZVj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906438, "uuid": "af177345-0e00-40ef-b2e8-81733c3917a0", "value": 3930068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906438, "uuid": "e01f2010-6050-4499-9ae9-ed3a205193de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906438, "uuid": "02908537-1d30-4c0c-b411-fd27a59ad248", "value": "6af99d08e9295db93ad869af5ec1422e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b596a4-1a25-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772888517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888517, "uuid": "63985088-3f62-4ddb-a181-1cb5566ce840", "comment": "Malware payload (ScarfaceStealer)", "value": "d5e851f058a02800e01179bea3b5569f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888517, "uuid": "b2e95843-1763-40a7-b3f7-d3b87996bed9", "comment": "Malware payload (ScarfaceStealer)", "value": "3d8d2de6ec56bb69954c25f37065ff372d3ce943f7f7cc5db6ca317bc1e1a169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888517, "uuid": "6781abc0-7951-43f0-8a45-6ef1f90497d9", "comment": "Malware payload (ScarfaceStealer)", "value": "a79affa2956dd6b5734ed67e6a628e40cdc8d67e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888517, "uuid": "9dbbde5d-c89d-45ed-9762-0fb8b71af08e", "comment": "Malware payload (ScarfaceStealer)", "value": "c03372c49c36d4348cac4c89efe2424bd229b219bc0df123d3fe2311057132a000aebdebd78ab51fb2c81edc14f21543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888517, "uuid": "a8ed754f-d94d-493b-a477-98485068a041", "value": "T1B2D623EE81A513E4D8830980738E27CE75D0656D45FD4D2D3EE62C02AF21D6F264AEE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888517, "uuid": "282d85c0-3627-485b-a716-55d6c96303f8", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888517, "uuid": "4ea68239-378c-4cbe-bb35-e8b67dc18221", "value": "196608:n1apTzwZgfINzX0qwICF+UgQ7ha0mqyb7wHIjMCXzBM3tcMtGYvLOK1uK:n1aZgNzSIC3FtaL73wmjiBat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888517, "uuid": "68c5231c-4801-44a8-9fa7-9217b48299b3", "value": 13718528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888517, "uuid": "f6383fa5-4fd8-4cda-add4-741b1323b922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888517, "uuid": "6aa387cf-196a-4d9e-ac6c-28f1104e5cb4", "value": "Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34ebb42-1a51-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772907335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907335, "uuid": "5cfa1e68-c63a-4e91-b364-9f7bdddedee2", "comment": "Malware payload (AsyncRAT)", "value": "550bf59eaf9f3dac8a873278d3c273f6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907335, "uuid": "28d61b72-a7bd-46b1-9266-6b5febf17e7e", "comment": "Malware payload (AsyncRAT)", "value": "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907335, "uuid": "a6f7d988-795f-4492-9d3a-dba1f9cbcacf", "comment": "Malware payload (AsyncRAT)", "value": "0f5a6a04f00ec390d62907b82375fa469c68882a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907335, "uuid": "86ee9596-fa87-47a7-80b2-4afc972c3e10", "comment": "Malware payload (AsyncRAT)", "value": "00ac2950fd01972e53e7cb07d2c92c3f236c03a0d5778a3413727fbe39f2e55a5b0b48206ec5cbc13bce5c3fe171c5b1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907335, "uuid": "25b26e83-4712-48ee-beb8-768740f7db73", "value": "T140231C003BECC62AF2BE5B7899F2324545B5F2633603D58A1C8411DA6613FC6CB426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907335, "uuid": "54426931-308e-44ad-abce-78da9cd3bc8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907335, "uuid": "3d6b4ba0-c2ab-4dea-8198-67fa66dd88e0", "value": "768:ua1THL8xrmxvuwUGdx8f++s36LBK1P+JIjbyg47FD3KCmM5bpf+:ua1THu5WVMw+Kb14hD38M5bpf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772907335, "uuid": "93f490f7-7f65-4c73-be1b-10a28cfac20c", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772907335, "uuid": "f50fff3c-3a55-48b0-96c7-8c7d2606fae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907335, "uuid": "31d71e1f-c0ce-43ff-899f-170cc114e2f0", "value": "Spotify.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4775c24a-1a25-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1772888284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888284, "uuid": "2e2b258e-3162-470b-9606-e40ed9c52fb3", "comment": "Malware payload (SliverFox)", "value": "7789b3f402589a1592889f61f0bb35c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888284, "uuid": "e9bef413-abbe-47a4-af8b-96686bf4f06a", "comment": "Malware payload (SliverFox)", "value": "3fe1010b95a69dabed9e724068663b506f71bcb207db21296d7358573271bdba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888284, "uuid": "5dcdf441-73dd-4aa5-bb6e-f7cfaf50c532", "comment": "Malware payload (SliverFox)", "value": "d7c22208ac901c551b918b4fdbbea276dc3222e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888284, "uuid": "958f2196-d7ee-4079-b78e-81d3e5f4ec10", "comment": "Malware payload (SliverFox)", "value": "26b3a7be9b614a206b5bfdc41e6d7e5d8b8fde6933bf75807b780f87d533b83aa30be87c2c344631db35944837342df6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888284, "uuid": "e918ba9c-065e-443f-ac59-3378a34e3bb6", "value": "T1BF650216D1828CE9DC1B17FEE8AF3017B89B6FE31AD2530367623954FF166794814B88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888284, "uuid": "b2fc27aa-4754-4252-ba33-0f834338acec", "value": "923b402ce0fe56023d103d6fee0bff99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888284, "uuid": "ff79ae18-17ab-4f8f-99ad-1ed64caca89e", "value": "24576:wxI59FGI21K7GVhrn/eA4XHE0nXajxsrwRs22zqjAEJHiG/7wIRPC:sI5D21K7+WAAdixha22zqkEpiGzrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888284, "uuid": "1d72123c-6a57-4374-bd49-2a3e1fb55436", "value": 1439744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888284, "uuid": "f0820e52-2f5d-436e-afa9-375813c614b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888284, "uuid": "1fcf3454-b5fc-4b93-bf35-3497fc632747", "value": "2026\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f1.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a56246-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842108, "uuid": "55f50b65-1652-4200-8d1b-e917ea2ad450", "comment": "Malware payload (Mirai)", "value": "71dbdaed262fff6f61cd265c9e91dc43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842108, "uuid": "b2d8e410-2498-44e0-bb92-11bfd754f211", "comment": "Malware payload (Mirai)", "value": "40ecc5dfd9303a36754443afa232239e63f8101acec453029077ac703a8a3942", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842108, "uuid": "5bed31dc-27c2-49db-97f8-115a6e13e4ec", "comment": "Malware payload (Mirai)", "value": "51eec140d794a28b216bef30f63457c13f2e3fb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842108, "uuid": "9762f1be-a321-45e3-8a19-0f1d846c6df8", "comment": "Malware payload (Mirai)", "value": "19c935935586919e16cd91456c19331f83d91f4f01f1ba635b67f4e3ca887817ee4597253e44f3bbbd38a5cb6f909268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842108, "uuid": "25f49463-dbad-4c42-a962-75ab526d4a5e", "value": "T18B430100D9888B0EE80AA1764DEBB54B4F91CF07419A4378B91038EE4855FFE771CBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842108, "uuid": "a44045f1-be16-4acf-b2f0-ceb982d43dda", "value": "1536:c1xGfwcfwFBJ9u4Grx3CVg8X2SVwAr9hIlw7nouy8Eys:c104swFBvu7rMf9hnouti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842108, "uuid": "8770485a-cf34-4301-8600-1d786662aa97", "value": 57376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842108, "uuid": "ffbe3dcd-3e90-49bc-b5bc-5c672ef2ab77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842108, "uuid": "082ba13c-2201-4b3b-b059-04fa0b33f1ea", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce641922-1a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772925017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925017, "uuid": "8dc1ed14-3a47-48ee-b3e3-c91948fca32f", "comment": "Malware payload (ConnectWise)", "value": "be2abfc63ca36cf0d2e7e43f4404db78", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925017, "uuid": "c6d06594-739e-40e9-8607-9f0f2537fffd", "comment": "Malware payload (ConnectWise)", "value": "411fae02a3fa0960c0142e04a3401803f722b934dbee1130b3203c656ae93ba7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925017, "uuid": "b250b341-fa99-4d5a-a0c9-e62542a0f15d", "comment": "Malware payload (ConnectWise)", "value": "09bd264552665c962a6b29d650089194eb6b7d0c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925017, "uuid": "c4a09246-5bb2-4fb9-872d-8b62c14ef8a8", "comment": "Malware payload (ConnectWise)", "value": "ca939ce7ad3ee171654edabd6f81ef68f0e05ca6518b183dcbbcaf4ca3907dfc0e2e9a8777f7b601467899e30b09165c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925017, "uuid": "2af00361-23d9-4e84-88b4-85225c7d7093", "value": "T15AA6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925017, "uuid": "6b3682c4-06b4-4960-9577-4f6b18b713bd", "value": "196608:JBn2hg5kEWmXhcfKjSVph7vGeLBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSVM:bgdEEijeDGsgdEEijsgdEEijSgdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772925017, "uuid": "55b97b1a-982e-42b0-9f4c-7674cbb626b3", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772925017, "uuid": "314f03dc-242b-49cb-a313-cd06da510f47", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925017, "uuid": "246a793c-3fef-4655-9510-65ea2d5f931f", "value": "SSA-Statement.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d33f6a-19ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772864657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864657, "uuid": "7b176ff1-9425-4d05-9979-9a36c1722a09", "comment": "Malware payload", "value": "1f2a84daeccbdde588c161c8573c0558", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864657, "uuid": "2ffba1a1-01f7-4596-b745-cd1188ec7321", "comment": "Malware payload", "value": "4289cf7cdfe0063b2252e6cf609bf9dba38a7923a3c2db43ea2a821adaae7575", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864657, "uuid": "6a1dff34-5d0c-4b73-bcf7-8b41d0f6735c", "comment": "Malware payload", "value": "a503d8a6da0bac4e222ebb0513da1f043262fa3e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864657, "uuid": "2a32ebb6-ef45-45a5-9734-9ee0433f32b7", "comment": "Malware payload", "value": "7128772cce66a90ce8aaebeaacf3f0ce5be03f8794b085d6133821af5a4466a9cf69c8f97c4a6a03c87e0cac66da0c32", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772864657, "uuid": "de26b818-28bb-419e-a6e1-d3680bd47aee", "value": "T1FC2686A45DA16B11E6D283CAB05AB5C0F92F3C2378D9CEC8B7BFD49458D5C20FE05A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772864657, "uuid": "3af7a1f3-c98c-43e4-a662-d8eed9c7ca0e", "value": "24576:Kn4UAmn4UA7CzV7Iplm0l/5n+vXhU0eUsom1baOoS2Pd6:yzV7Iplm0lT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772864657, "uuid": "e2d03578-4b3b-4649-bfa1-3bcedab1ed0f", "value": 4621466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772864657, "uuid": "708f7bca-b102-43d7-9ef7-540b591cabd1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772864657, "uuid": "58f65dd4-4e28-4bda-95cf-5cc411754f4d", "value": "4289cf7cdfe0063b2252e6cf609bf9dba38a7923a3c2db43ea2a821adaae7575.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d2184d-19d6-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1772854248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854248, "uuid": "8f1f1756-004d-420e-8c00-45e86477c7ca", "comment": "Malware payload (AteraAgent)", "value": "241918f70447c5870d3ac2fc8593c615", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854248, "uuid": "4e4cce51-550b-4c0d-9131-303c47af64ce", "comment": "Malware payload (AteraAgent)", "value": "42b9d965bbcdbcd98dd4104379e46b23c5238fe4dc23b3ee5cf8689435ddfd55", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854248, "uuid": "6e225388-77d1-4f15-8b2c-b99cc85a7832", "comment": "Malware payload (AteraAgent)", "value": "bb594bd559cd5d495bfe2a0c63273d18801e7428", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854248, "uuid": "fab40d92-0e5a-4250-be66-408cb40f2061", "comment": "Malware payload (AteraAgent)", "value": "b5085b40f198495f0c332785a84c9d62f76aac09cb1271ce02b4d2397e132feafcf89d73ac1db2fdbfb53302a4237fbe", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854248, "uuid": "e36fbe04-14c5-450e-b1a7-6a09835fa210", "value": "T1AF862318FBE009AEE5778276C56A8520EA327C8D3720C54F47A4B6295F3B7A075BF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854248, "uuid": "df58baa2-7a62-4bc7-aa5a-d2dc5d9e681b", "value": "196608:WW/FAmnGYLnWgziirlb4/ieF3GrAfedpvCs3md8r:RAqGYLpZreF3G82yc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772854248, "uuid": "4aea2da5-3902-4d78-acb4-3bf424ae0876", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772854248, "uuid": "85c83621-3b7a-4536-a8c6-efe6e646c7fd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854248, "uuid": "3643fadd-a3d3-4f3f-9659-3ae1e306f1b9", "value": "ZoomWorkspace.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cdb135-1a31-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772893329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893329, "uuid": "d1c230f3-e8f4-4e16-b470-87a7c3b4c62d", "comment": "Malware payload (ACRStealer)", "value": "e5125c49f5c2d8484fd36ba78e08012f", "object_relation": "md5", "Tag": [ { "name": "45-150-34-0", "colour": "#0F914F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893329, "uuid": "00227ae3-8f36-4048-b55e-5cc06cff8171", "comment": "Malware payload (ACRStealer)", "value": "430b69b2268bb1f2f0821c8cf65d648917e1d13fd5c6f945b5830534e1d0e559", "object_relation": "sha256", "Tag": [ { "name": "45-150-34-0", "colour": "#0F914F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893329, "uuid": "97d043e7-3d04-4552-97c2-b746a427ad78", "comment": "Malware payload (ACRStealer)", "value": "27d210e4bd4f0154b60850233d3ee67565f727e4", "object_relation": "sha1", "Tag": [ { "name": "45-150-34-0", "colour": "#0F914F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893329, "uuid": "c2d1e367-f1c0-4b64-a086-ef4b446c4ea4", "comment": "Malware payload (ACRStealer)", "value": "eea5962690049145f3e38c510ce5ee7a81bf5c4073d8ce1461270d05c6f9693d0a297a80b284544d10097282d32a7331", "object_relation": "sha3-384", "Tag": [ { "name": "45-150-34-0", "colour": "#0F914F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893329, "uuid": "95267ab5-dc03-41c4-957b-94c88b665ea5", "value": "T146B56A027951C03BE22215708CB9EBB6947E76B86EA140037F7DD74C9BB57A16F27223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893329, "uuid": "cf9878e2-6b2b-49b4-b05a-627d44a03e25", "value": "b6797b4ed203d86b901db4ea2add63a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893329, "uuid": "567e2d47-c9f5-4d0a-b2cd-85c74659aefe", "value": "49152:KJ8jh6iOZgWkHcFe4F9t/REHL7HeHrTHIHvH2H/HOHaTCo8h4NDGoG+Xo6jqgGUH:Tl6i6TJg10XxV+eLdSAPZ+UiS1FD1qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772893329, "uuid": "d6d40c8c-aa70-4555-8cf0-9ca38627bffe", "value": 2444696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772893329, "uuid": "101bc177-7527-41a1-91f0-defff40a5995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893329, "uuid": "1b8ae458-e816-4559-a7b9-c971b2ccdbb8", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512cd88a-19ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772864677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864677, "uuid": "956b40a4-c003-4c7d-b491-34611ec1c971", "comment": "Malware payload", "value": "845e577500714e436ed1eb89b70218c2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864677, "uuid": "bba8144a-e5f5-49ca-93cf-92da0dc6534e", "comment": "Malware payload", "value": "467f622d2e2580c17858cfe70064e5377346b477ee94faa68edfd8a2f1188e6e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864677, "uuid": "c8118b1a-1a72-4361-afc2-b60f87b4b630", "comment": "Malware payload", "value": "3f2713b21cdae9b041df71eb487c7b8252f26aa0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772864677, "uuid": "2a5071f4-f89d-4b19-8e1a-f2dd52f12f98", "comment": "Malware payload", "value": "a49019bab4d18e6f79274f39ead06943259b285d928ec7d63ca11c7f1b9840c5e544e07dd58167772cca74f2fe029904", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772864677, "uuid": "0d372002-f997-4ae3-90ec-6f2425ac22af", "value": "T167C422734ADABEBEDA6E41FB1003743176040F66843539265A03AFCC8D6241E8A702FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772864677, "uuid": "7b286a59-1956-461e-8b08-16c9fb0d841f", "value": "12288:Xktl/NXlQBkUK1DvgdeBrsy1G8XuOZe9ri0s1BNjlHTW/:yx6k71D4Gf1R9A9ri0yRW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772864677, "uuid": "a10fc4e0-e782-4f13-96c3-bd64556a4c09", "value": 550529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772864677, "uuid": "679a7824-245e-42c2-b2e0-c2b050a8ef94", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772864677, "uuid": "2d92f05c-8282-4457-960a-f01ab522ed5e", "value": "467f622d2e2580c17858cfe70064e5377346b477ee94faa68edfd8a2f1188e6e.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceeb562d-1a2d-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostSocks)", "timestamp": 1772891947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891947, "uuid": "db7bb050-c134-439d-8f79-9bddbaa13a5e", "comment": "Malware payload (GhostSocks)", "value": "60fdfc5772ef21691341efbc3e081209", "object_relation": "md5", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891947, "uuid": "187a780b-bf3d-496f-81e0-9e0b739efc22", "comment": "Malware payload (GhostSocks)", "value": "46a9b249a70d194437c8f2d655003fe582aa4c108861448b34b6f9fdb8a80614", "object_relation": "sha256", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891947, "uuid": "b509cb02-b5dd-4bc6-8337-fecf17626f41", "comment": "Malware payload (GhostSocks)", "value": "7dd550ce0633466d7a7f12edfe037fbbd456c4ce", "object_relation": "sha1", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891947, "uuid": "091a7054-0fa6-4c1e-9401-c6c62743fede", "comment": "Malware payload (GhostSocks)", "value": "cc2434ba3d763108da8c267d2c9b2a9c2b52092e6959729eeb35f084c6534df7328903a14634400562816ca1445dbd3d", "object_relation": "sha3-384", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891947, "uuid": "11279678-4b0b-4f21-9804-cc6f06815b35", "value": "T1A38622B52EED5137E1F9B2B9F8B4250F5FA8BA9095A16DE854A0408C4CC48806D3DF7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891947, "uuid": "589d5737-e834-442e-83f1-80be040ea603", "value": "196608:+PEItqQpiEKQ3aZEihcrZSJrkeF6FVkHSH94O:CjqQoQ0FiUJ4QCRd4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891947, "uuid": "3a4feb59-ad31-4287-80a4-7529882568b3", "value": 8138232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891947, "uuid": "45eb5fec-c87c-4b7e-bc68-1a2469e4e8d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891947, "uuid": "492ee51d-1df9-4439-ba0e-e63eadce7931", "value": "Geany.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55195d80-1a53-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772908063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908063, "uuid": "e80e75ba-f3ec-48d1-a787-c893da1943ce", "comment": "Malware payload (NetSupport)", "value": "0c27564e4870d49b6cb0be53777d876a", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908063, "uuid": "57f1d0af-32b3-4a4e-8619-b194eea6cdf4", "comment": "Malware payload (NetSupport)", "value": "487715299f14c581a2032cf18a1afd2a65ec3852dc6dd39e15268cce1af8ee7d", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908063, "uuid": "1ee7e130-deff-4694-ae58-b56b0faab523", "comment": "Malware payload (NetSupport)", "value": "05ed4acd0d7a61bfa6dc99c4d5487fb4225d7b2f", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908063, "uuid": "ecb16c36-c8b9-4d17-aa7a-e1b185918c03", "comment": "Malware payload (NetSupport)", "value": "0d478b8acf48502a815864c2d25859ccb2683fc101ab9be1fc5ff3e91966e8ed082c5d3e5642ed3f9c98acb5417b3a48", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908063, "uuid": "e7161e9b-e58f-4978-8cb1-3bf18b9b41f5", "value": "T1BBB67C648B84975EAE6F191BE078572F7BF33F66E08271FC46622743256FC046639C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908063, "uuid": "98a8cab4-cdbe-4f93-a7dd-5928104425a3", "value": "49152:WgupCkVQ3tlT7k1IvGaA1UzZtjELmHjopdKs3BqGVd1FfIMPxfLhTS9BxCmdR:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908063, "uuid": "2a766114-f918-4d5d-949e-04453c0df4d4", "value": 10758513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908063, "uuid": "e1e567f3-1e6e-465f-92ff-f710d70b0cb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908063, "uuid": "1dd3a7e9-3c37-4324-8f97-9fb6539d8409", "value": "R.GRE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8349339-19d0-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1772851939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772851939, "uuid": "364bd38c-df5a-4992-b603-e5628a3c19c5", "comment": "Malware payload (OffLoader)", "value": "8ee1d63d154866c0ef31d69037afc83d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772851939, "uuid": "290b4c5f-8602-402c-bd5c-68727a5502fc", "comment": "Malware payload (OffLoader)", "value": "48a48aa818438aa9ac6086b788126309ae61094539623d62b6298f3372e222bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772851939, "uuid": "37e2b280-6881-4213-b0ec-797c15e52afb", "comment": "Malware payload (OffLoader)", "value": "789e761d6af5b948536db12801565c66ae4c87de", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772851939, "uuid": "c898fc8e-1457-4cac-b305-701851726ea7", "comment": "Malware payload (OffLoader)", "value": "eb9573ab7f4650f93d52e24ab4d0ed24f8ef6e45924961a70c6f8769d1237fda95d7e73bc696fbc6791d8265e8158326", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772851939, "uuid": "efeeb2f6-bddb-42c5-bbbb-d954207478a1", "value": "T1F2661233B6AA633EE0E9563709F292725C3B6E21740B9C1696E41C4CCF790603E7E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772851939, "uuid": "17c7607c-f88c-40ba-89ec-47b9dd819133", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772851939, "uuid": "026a213a-daa7-4f02-a049-088d3f326dbc", "value": "196608:0I4sQPJyN4wN+4yebqYlN31O1TOJyQXOef4:0IXo4BWWy1yHOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772851939, "uuid": "505a67cf-c40b-4465-ba81-3f143b2fcc2f", "value": 6859271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772851939, "uuid": "870ca010-419f-4c7b-a868-901157de6a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772851939, "uuid": "b5a28d89-8ca9-4c58-a71a-ae19e712debe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f1bddf-1a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772890945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890945, "uuid": "98fcdae7-1600-488e-afe9-82edb1f4896d", "comment": "Malware payload (AsyncRAT)", "value": "60f57a4f3962c9421a4b84c8894052ef", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890945, "uuid": "04febe46-48a1-4ffa-b857-692af960989a", "comment": "Malware payload (AsyncRAT)", "value": "48c8cc4947d4ef59bd849396e84a52493ad14cee265d2ae772ca4ba173f6f2cb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890945, "uuid": "04ce694b-61a2-4f85-b9cd-666877147f5f", "comment": "Malware payload (AsyncRAT)", "value": "542d88f7f083637685c35a533539b609d81c1e61", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890945, "uuid": "54f12cd5-81ce-4a14-804c-fa867008fd2d", "comment": "Malware payload (AsyncRAT)", "value": "da35ee8ad25e2cf2d8e781fe8b8d14842b35defac04162fb0092e840450d502f656e75640dba31c9e0e58f3ae0020d24", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890945, "uuid": "39e0bd49-fc88-48c5-a27b-c4710a68e01a", "value": "T145035A0873F44A25F2FE5B7D9D7686404336FA479D22CB9E1EC4509E5A23788CE24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890945, "uuid": "e252b219-7042-4f51-b583-dbd0bec5ef89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890945, "uuid": "a8043e0e-47e7-44f2-aa24-887d5df36dc6", "value": "384:x7XVPfPzACkQsS9YP8DjKMFEWbnil8393bayse6QxnC7O+WRl3uuhGfrg7UUhCdv:xzVPfPzgPsKsLRbJpB+WP7LvJZ9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890945, "uuid": "8db490e1-ee3e-4b4f-9f4e-2bdae2839c6e", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890945, "uuid": "63781e0c-2aed-480b-bf01-61e331d706f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890945, "uuid": "5f1b25c9-8483-47d2-b71b-26391301a377", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428af368-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871095, "uuid": "4acf40c1-851b-4566-9ecd-fccb6f9215c6", "comment": "Malware payload (Mirai)", "value": "f38fbc45074a816f00ccd358c1b3754a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871095, "uuid": "adc546ec-60d9-4508-8b3d-ab03ff7bd66b", "comment": "Malware payload (Mirai)", "value": "498821bf68d7ec910c2d4ecb559a9f87d4744338414be829ba29f29787ee9039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871095, "uuid": "3dfeabc1-f99d-479f-be30-11694bfd5f21", "comment": "Malware payload (Mirai)", "value": "d7332bb8e68332e8bf6aeb30d0797eae537b6488", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871095, "uuid": "7aaeab71-9d92-49bb-94c7-a4b6e066e18f", "comment": "Malware payload (Mirai)", "value": "d49cb44110bde67722a694748c7720a279d18041e715c41e509035d91636ad330ffef2f775627c514be1189bc5071fae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871095, "uuid": "0068ac40-0696-4c83-b474-ea3993d70c64", "value": "T1AE73BF32C2A51EA0C6848938B3F5D9751773D905A19BBFFA8693C2665017EECF1083F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871095, "uuid": "bcdff0bf-5ea6-4b7d-a5e9-42ee7c0c32c3", "value": "1536:iazlQNNHFV2J2ATUftDNDKgIK9CqpoI/zCmnuog0l:ixNHvwvQv98I/zcGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871095, "uuid": "3efc0689-34b0-4f17-9a06-6b9a57c751c1", "value": 75104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871095, "uuid": "e110ed85-fa34-4b47-aff4-de1cb28e0797", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871095, "uuid": "03f66d14-a024-40b1-b4ea-039fec2e33a6", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2e818d-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842173, "uuid": "32c71704-912a-4878-9c4d-d8715c9efb00", "comment": "Malware payload (Mirai)", "value": "4e0d3cafefb08f150fc825fefd6cb12f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842173, "uuid": "7b577bc9-ad81-4121-8e32-ca9862a42908", "comment": "Malware payload (Mirai)", "value": "4a86fae08a2ca6ef0b48bb2334fdacc7445476724d71a553d2631ba14c2e8613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842173, "uuid": "8b396741-3c65-4299-9cb9-4e755774fe40", "comment": "Malware payload (Mirai)", "value": "3bb49b03c0f574dcf93077b51ef334dd781b7550", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842173, "uuid": "492957e8-1ba0-47e5-ac75-60d11608fde3", "comment": "Malware payload (Mirai)", "value": "497591b4d3761e9b2fd00c6ac66b6b715833ceeb14ea929f0bcb68a4871dc6e2f38a3df29c2d63a5c6817ff8aa1b1d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842173, "uuid": "575a3d81-a5a5-4da6-a6fe-dc60d3a82e5a", "value": "T15D143B45F8818B21C6D012BEFE1D118E33272BB8E1EE72129D245F65778B86F0E7B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842173, "uuid": "45aba082-3b5f-48ed-a913-d772afbd925d", "value": "3072:5UWMghEGqG1GAB/+XBxZU+4XvkYMdayA2nivJ2C5eYSe1u:5wxGIdDZcXsYMaEqJ21YSew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842173, "uuid": "b4bac69e-79fe-41e6-ac4b-b86084b7fa7a", "value": 203644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842173, "uuid": "e0e22509-7f28-4957-a470-30f0ab3c7d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842173, "uuid": "57160152-263e-468a-9e55-4b31d49601fb", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5f7fa9-1a03-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1772873774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873774, "uuid": "6c3ff139-c5be-455f-b205-395a3010431e", "comment": "Malware payload (SheetRAT)", "value": "b93e7713772c65ca2f73bc9dbeb7d8d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873774, "uuid": "c3b30432-730f-4df8-b80c-e3ee2a941a54", "comment": "Malware payload (SheetRAT)", "value": "4ad7e76e5d4a0d948c55f3db8b8f70c7fa301734a1e26f98b0af7d00f22d53e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873774, "uuid": "8e3b0f01-7bcc-46fe-9674-841f76862620", "comment": "Malware payload (SheetRAT)", "value": "0215085f817ff207e7973344d5a050e3705d1064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873774, "uuid": "edced31e-dfdb-4ac0-8913-5335a390375e", "comment": "Malware payload (SheetRAT)", "value": "f62419d5f6579c24dcf1fe07e9ca862e24280a525394b6ea59acd5cbf516a7b5ebab82719a3592fed6e0bc3d6816652a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873774, "uuid": "4ae45b18-d094-4073-939b-cae4d2a9e6ca", "value": "T1F8E34B25DFE48C45EAD8087D86B38514CB3090F66582B317BB95E4A21D40ECEE97E3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873774, "uuid": "bad73c04-9a34-4af9-9d5d-9153987db064", "value": "3072:Gpa7kjfIywzoFO0VcOzqqj2k2+1jbJvA6z08xfjmSfxzo:FgOmcOzlj20bLImj1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873774, "uuid": "f3118a85-8133-4c1c-8a41-49c14eb18d41", "value": 151912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873774, "uuid": "da7d4024-e67c-4ebb-bd0d-de8049289931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873774, "uuid": "6094190d-896e-47c9-8cc7-6f4ab59d6b58", "value": "everythinghelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bc6dab-1a54-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772908432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908432, "uuid": "d7d24552-7dab-47a5-9b94-50ee5293e17f", "comment": "Malware payload (Mirai)", "value": "2702605847ab7e4389a1fd8b5b43836f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908432, "uuid": "18a246c6-e00b-4bab-b4d6-8ee5c343192b", "comment": "Malware payload (Mirai)", "value": "4c5efe32d54de7b8c37fa0a4f242b905cd21fe3dbde1c44b7dba9f044d87c551", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908432, "uuid": "bfdf1705-21ad-41f7-914a-6a3aa5c1bf01", "comment": "Malware payload (Mirai)", "value": "0395933e87d7642c033e26f1a465b689efce52b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908432, "uuid": "2ae93438-c355-4a70-8a1c-d6b323352a6d", "comment": "Malware payload (Mirai)", "value": "185926d12639fdd9674d06da311e4181103a04c8eca2e2ad6a6b2bceee2a5f61fde394097840c0a2a80891a5ac33d7af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908432, "uuid": "945c934c-f45c-4b82-8037-369c22176c28", "value": "T161E47E9CFE4E3D42E2D7E27C9E4D87E1722B71E0D32391A37982434CD5CA9D98BA1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908432, "uuid": "2c93e1f9-ba5f-40a2-abc5-4d783a8a7492", "value": "12288:51uI+T0jtDM7sMtkEZUApV3BzuYyyiT6bgDnjy1/8Uw5dWMqUnad:uD0jts1ZRpV3ByYyBm1GCXUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908432, "uuid": "4301146b-1109-49f4-b7f4-a5a97d3b1f49", "value": 701744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908432, "uuid": "1852630c-2d80-4bc4-a7a3-3d635a00cc86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908432, "uuid": "cc0d2f7e-e0be-4edf-8c5a-f3b5e445224b", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49059f0-1a4e-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772906156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906156, "uuid": "59ceb9a2-be62-4d2d-8d1e-38547e420173", "comment": "Malware payload (ACRStealer)", "value": "49fb7a987544a4a99c743d22a46c78e7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906156, "uuid": "991f349f-f248-444a-9c9d-ea8fe0b13936", "comment": "Malware payload (ACRStealer)", "value": "4df58b7e964f595fbdd1a345ea8a42d7477a473527174eb07aba7a236369933b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906156, "uuid": "078c5ccb-0b59-4fa9-846f-90e1b828942a", "comment": "Malware payload (ACRStealer)", "value": "aae17be8f0910211d807af40a98949e3743019af", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906156, "uuid": "f5bf0def-7fe3-4dd7-8636-b0123d70e2ae", "comment": "Malware payload (ACRStealer)", "value": "0f8ed1472e983822bcbb2c23c83a6e515f55dbd9193b2cf92e06d03349d5d09d88f7323066bbaa732ef5c844e73ce11d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906156, "uuid": "697bd601-05f1-4a69-bdfc-7a39dbecba95", "value": "T143859E1E72E907B3E5AA8139454B564FE77170280B20CACF43908E7E9E27BD13939F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906156, "uuid": "f72e2d0d-3ec3-4abc-a3e6-b34c563f9cfe", "value": "cead280c29db54dab7e26816f98157b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906156, "uuid": "2acecc73-101f-490f-b8d8-c03880f80023", "value": "49152:ucBZxrT3rfB3+zN1iULaQZCV3DUXRBeKLYq:uOxFOiVGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906156, "uuid": "db0ce27a-35ce-480d-8171-04be29c5c3b2", "value": 1720320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906156, "uuid": "484e1212-6b39-42f2-a625-aa5f1ffc91e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906156, "uuid": "fe6857e6-2e0c-41a6-bb4c-b83a0d34e881", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ea9b24-1a20-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1772886214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772886214, "uuid": "7f422766-e12f-400a-a67c-6e950d27f567", "comment": "Malware payload (RustyStealer)", "value": "90664fd48d01a7383a921fddb6389c86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772886214, "uuid": "91d92a62-0836-499d-9425-aacc4ace6266", "comment": "Malware payload (RustyStealer)", "value": "4e0ae7e62564ae0fe2a288b896b04de374100c20bfe48bf436bc6f0c5b609002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772886214, "uuid": "42c712ca-08e7-4522-9d92-1240859ad199", "comment": "Malware payload (RustyStealer)", "value": "0edf1ba1a99789bb799d92adc00eb48079ab9bd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772886214, "uuid": "04d3b5ed-1db0-4cfb-8828-78e730435cfe", "comment": "Malware payload (RustyStealer)", "value": "23ff11b8027fdfbb9861b5c930e16ed92eec0a1ba90c9dc7624c935372473735a5d1141782279b2bdf8e7425035011d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772886214, "uuid": "125388d2-2237-469a-bb64-289fafa3d5e7", "value": "T16FF6281010D56603FC3EEFBD89DCB6444F7AB6A53722EA385B410AE94FD1F18C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772886214, "uuid": "4a50ac9b-91a7-408b-aa86-a16ef4dafe6d", "value": "196608:80c1TttNeNJv9BbuKNCHKDVj2jr8tp1MEWeR:8xtadueiKFTMJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772886214, "uuid": "375fabe0-21dd-4f27-8bab-59ed600768ae", "value": 15973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772886214, "uuid": "41a02f9b-3366-40cc-9f83-361535dc987f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772886214, "uuid": "f58f77fc-8e43-4b59-bed4-29a34b6ed78b", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c909b4-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772865363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865363, "uuid": "c24979bd-8545-4843-bd1b-2ce15d88d822", "comment": "Malware payload (Formbook)", "value": "010006115b6cc6893007d60d314168fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865363, "uuid": "01070d1f-2810-422d-aa49-bc4cfa141a90", "comment": "Malware payload (Formbook)", "value": "4e7ba1ef999b09a32292bb33c8f3f4418280847aef878f5377b48daf7dde272c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865363, "uuid": "f6b4039c-0bc0-4a0a-9026-449842833a07", "comment": "Malware payload (Formbook)", "value": "756d28b2da79b4cf91df4dc7c0345d96a0b41727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865363, "uuid": "4b72eac2-672b-4a37-bb95-9210d4f1e043", "comment": "Malware payload (Formbook)", "value": "0d5f7e2e1248252f53e8201f922983e2fea7e50235bc8f120d858549732dba08a669826cc7ed57767fd791c2cbc17c3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865363, "uuid": "5c797940-b13d-453e-9f9d-c02126f1da83", "value": "T196050A7E5962916AEA8A40FC35458B6249B1B33B03B41FF7016681306717DB2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865363, "uuid": "232184ba-1b1d-4acc-87ee-5841239b1b81", "value": "12288:QLr2ifPXlMGklsSg7L9jjY/0QTb7b+J7oiDWfNJyGuMGzFBF0P6cTOqu37:DyMGkOSg7L9jjYcQDPMM8Do6ciT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865363, "uuid": "1243caa4-3ea2-4b2e-8498-03e9092d29bd", "value": 866688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865363, "uuid": "5cfae59d-b695-4103-9873-daca834042fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865363, "uuid": "58a39e6e-f0ae-4a5e-94e0-b6f8a95048c8", "value": "4e7ba1ef999b09a32292bb33c8f3f4418280847aef878f5377b48daf7dde272c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c431f037-1a45-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772902237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902237, "uuid": "65d5a16a-f704-4291-a1c9-94c0d02868f4", "comment": "Malware payload (CountLoader)", "value": "5839c80a05c81db2e6948d7f29e629ed", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902237, "uuid": "76e0e711-981c-4171-939a-edd6aa883175", "comment": "Malware payload (CountLoader)", "value": "4ee17ce2e1ce0ede59dceabbba28265923ce4e25ddb002617e3cc8f13cfff6a3", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902237, "uuid": "5fbbb05c-9cc4-4d4a-b572-d914191f9e00", "comment": "Malware payload (CountLoader)", "value": "2269040f91d715d473b1494d4d774d769eec3681", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902237, "uuid": "31e39264-6483-4e43-8ff7-7710be7ca2eb", "comment": "Malware payload (CountLoader)", "value": "e6f45e7137cdaf8767de5d0047a40943cf29256d1b967ae0858f00b500d5741c08b404307ca33bcc2c899b006cab6ca1", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902237, "uuid": "93369708-72b4-4559-951c-f1283c5a17db", "value": "T1746541963B63C3E3D51A4679DB8AD47068340AF3B780A8C76784BD8451B4BA0BD65F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902237, "uuid": "ffc0bf05-ab45-415c-90ed-e3cd4bbff150", "value": "ce3bf3d44beb8695e8f62d66f6b0d23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902237, "uuid": "94f3859a-6756-474f-bc96-f10259ca0573", "value": "12288:MkNykVGMBRrLe0vp5d2mRQ3vvvvvvvvvvvvvvvvvvvvvvvvxvvZ9y8KZPE:bNykVGMTJpfu48IPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772902237, "uuid": "8c5b1562-030e-40b8-8754-ca57b7b100aa", "value": 1539584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772902237, "uuid": "690459c2-bebe-494d-9d32-5921ae8ee5f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902237, "uuid": "1c48c527-d5a3-4f63-9355-5b775f257600", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee2d027-1a04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772874149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874149, "uuid": "373e4146-4ee8-49a3-8b3f-1154247004bb", "comment": "Malware payload", "value": "4dd59b66018cbb7cd8273f799d89cf3c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874149, "uuid": "7508c068-296b-43cb-9a93-6d4ed93a2836", "comment": "Malware payload", "value": "4f97dddb3e251daf265c2bcef6ecad5f1b80548ef0b5e646379bd32030c801d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874149, "uuid": "accdda11-71a7-45ce-8bd2-d6924d112554", "comment": "Malware payload", "value": "0bd2ae50acde98c89a74a690bd5d17f1bbfaec21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874149, "uuid": "c8d0994b-800a-4391-aa3c-299e4d463688", "comment": "Malware payload", "value": "0b29247bda053679d0299895882e14f973d0c3e7c05f8aa4dea9b15a5fc593ae3a7e458c4cbb5185bdfe4ac3360449c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874149, "uuid": "a39636a3-391e-42f6-aebe-430ed7db797e", "value": "T1AFA27C437D304472DF49097C60DB6A379EB8BB904ED9584363268A1C1E1A3D2BF3906F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874149, "uuid": "166aff27-1f0a-454a-a0c6-3a6f1f0ee80b", "value": "cf700a4eb7c5177732ca180c6e513af8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874149, "uuid": "39e0cead-c406-4ac5-87b4-95fa0094b08a", "value": "384:cIUfy/qKVIaw9oJmYjIGa+CtzpwK3WVwv4R/qt0e42KzCKjd3gSGBkS:ckiolYoqvce42KzCKZik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772874149, "uuid": "02d9fbb4-0155-496d-a8ad-021ab0907cec", "value": 22296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772874149, "uuid": "072c9026-c516-403b-ab27-423b46200356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874149, "uuid": "c8eb0b4a-680c-44b1-8a0c-9276679199fe", "value": "4f97dddb3e251daf265c2bcef6ecad5f1b80548ef0b5e646379bd32030c801d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa988958-1a18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772882866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772882866, "uuid": "666fd8bb-bc43-4b48-9d36-a7e5f84c8746", "comment": "Malware payload", "value": "70861895bf6fb0d140383aa47233f25f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772882866, "uuid": "ba66aa33-8317-4474-9412-4cecc1637df6", "comment": "Malware payload", "value": "50c771c9dc29be1a5bbe62509ca245ad230db1c1a87f968c53e19e8f941c37fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772882866, "uuid": "d78d0829-2dd5-435e-8136-845465fa8d71", "comment": "Malware payload", "value": "e925f6f5ffe2bcb69a900884755f477a355e3c9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772882866, "uuid": "cf8d8bbe-5090-4dbb-be31-7ad5025e1d8d", "comment": "Malware payload", "value": "2f9053f4423aa4713157c1a74f2ef2aa1878405a25c1e26d3d4d1b1f7f33ecb1cb0f1e9bf93e66f21004465647b01274", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772882866, "uuid": "b0bb3f4f-f8a1-4d0d-b2be-a3e92ed7b087", "value": "T19A26335871EF6EF9D493D072CFFEF2EB4E69281890EA57A111DDF60471602E00678AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772882866, "uuid": "4feda193-2de0-4416-91df-b3246b60d2d4", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772882866, "uuid": "d328ee05-f865-4093-a7c4-989809e6d41c", "value": "98304:6RH5wY26nn1DGC+Os960ijj4fkGwLZP9uA8KtX:6RHv26nnJBs9cGwLZ1D1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772882866, "uuid": "a9ef90e6-560e-4bb0-8860-4a04dfae8b77", "value": 4545536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772882866, "uuid": "dd17a5b8-1780-4565-80e1-2f346a9197ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772882866, "uuid": "a0df64c0-5af5-4c33-94ed-900dd1d40e8e", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.3641.14782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ded67b5-1a4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772906441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906441, "uuid": "bf5eba6a-a60c-46ef-a1c8-cd4b51a2593e", "comment": "Malware payload", "value": "6d5ef24004f40e89d60695afc7ba88fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906441, "uuid": "2b676751-58f6-4dee-b446-0ce362a5014c", "comment": "Malware payload", "value": "513682c9c656a987739fbffaaf518424e589a3abc19ec475e516e7243e277220", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906441, "uuid": "f104b23c-adbd-483d-84df-774d20cb5254", "comment": "Malware payload", "value": "d478b23f621a665f275ea8bed48002db165d9690", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906441, "uuid": "64363149-6943-4d42-85d6-8f54398472e7", "comment": "Malware payload", "value": "7f52bb4755aab9655f519b59981d07f2c75c79adee96b3d1077c3949e3a2553cba3573be77e82de722ddc9f5fcdb1027", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906441, "uuid": "2eee9fb8-d117-4781-8560-35f703e40935", "value": "T17A06BF056EB55FE5CFD85A0AE06DB80893E4C91F613A6C85F99F5AC432F770CB623182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906441, "uuid": "c2d57724-c4a0-4b13-bd00-750ac95d936d", "value": "24576:1ugrrOCH57q4O/yCPlUT7nmSp34RTrFEbDebb96VBCPCK6heENBqZoQYTTCMImaL:3HBufQ2EuqBfDMSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906441, "uuid": "7933ac30-f528-4bc5-b6bf-a2afe8c5f694", "value": 3980940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906441, "uuid": "19c3c89d-b494-425e-b909-03ecbb54ebd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906441, "uuid": "5f7bf262-b179-484e-a651-7992d39d3df0", "value": "6d5ef24004f40e89d60695afc7ba88fd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf025e03-1a63-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1772915113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915113, "uuid": "f801d1a5-04d6-4485-8244-491461258bd3", "comment": "Malware payload (EternalRocks)", "value": "5c414d4dc70111f99932edf4e4f5de02", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915113, "uuid": "a3b7c5be-2644-4345-8df1-eb4b8241ac95", "comment": "Malware payload (EternalRocks)", "value": "51b18b4627a502e8311042ebf1c277f8b94050243c9c6dad70a50feb70c7643c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915113, "uuid": "f6729ed7-3abd-432b-8e83-7bbc03028ca4", "comment": "Malware payload (EternalRocks)", "value": "891a07f700665117f8223c511d3368d8b914f540", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915113, "uuid": "c0c50016-42dc-468d-b345-3420b0b061e3", "comment": "Malware payload (EternalRocks)", "value": "c4fd7e257e321e41768145e617d5f3a888abb081e0221e127c90d8b519b55c0320deb4668068dcc6549f272c2660d886", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915113, "uuid": "ad6996b8-5ebb-4f59-b72c-6faaf63ce76b", "value": "T131456B9566D715F7EA2E417AC2734A1FE73174193B22C6CB82602E7B2E337D1593BA00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915113, "uuid": "a49226df-da16-4569-9912-a7f1e9599f38", "value": "62311d58adc1ae54e46b17206c8f1cda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915113, "uuid": "4c2c8269-9eb2-4947-b269-7f7e028a342a", "value": "24576:nHKu/I+X0X61zExKv2AE7pS9szXSbqlXvYQhQPHE+mXFoInA8:jShXvY3HEdXCmA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772915113, "uuid": "74e65f9f-889a-4592-83d1-3598218d41f1", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772915113, "uuid": "358c407b-a81e-4acd-9a1e-e3f2913da0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915113, "uuid": "d7b7ee6b-417b-4455-9349-9f814fc5a270", "value": "SecuriteInfo.com.Win32.MalwareX-gen.65465887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020c4219-1a23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772887308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772887308, "uuid": "913493be-4fcb-478a-b9af-433b5374a151", "comment": "Malware payload", "value": "f085a73b462e0b338c81b80be266bb25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772887308, "uuid": "47089caf-f222-4fea-9943-e1be2c1ed493", "comment": "Malware payload", "value": "530852b4f1a2c2971893b2163c9866a7879c142bd6a6fc1057bf89140cf87dd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772887308, "uuid": "b997208d-81d1-44d2-82ba-fd11ede6a732", "comment": "Malware payload", "value": "8b692d3c276bba0ad3b5dca899830b1b1e188bd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772887308, "uuid": "95ad8694-739e-4aee-918f-0bcab325141c", "comment": "Malware payload", "value": "80851de74fe4ee8cffcb98999eeacf2862cb3c7ab8cd32c797c8aa405cdaf6ae19f8ce9ca985e0848186772abff2ebd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772887308, "uuid": "8afc863d-91f7-4722-88e3-65e268138cf4", "value": "T181087C42A3EA05D5F9F79A3489E65213D673BC063B3082DF325C172A1F736E08976B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772887308, "uuid": "aa414f95-0c5a-4bae-8f00-c3276ff8a68b", "value": "8062a445f5cd940b5daefb09f80bc2a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772887308, "uuid": "2c1a56e1-6484-45c1-a09a-fd5f6fd60c72", "value": "393216:f9UZyW0PYsIUmgB9S7QJrojJgVXIXT9fN3aoIKF1H5XMutmnnY4nZFUT7HihCLJ+:fJX3mcLmSh81vxOtxth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772887308, "uuid": "ff8f5efa-f89f-4b25-a863-6a368ecf6f45", "value": 82270208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772887308, "uuid": "f60a714d-4e76-42ab-a007-30e4b88d567b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772887308, "uuid": "55de6308-6b91-4cf5-a3f4-b5815d742cae", "value": "Silent Utility V4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52569bd-19f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772869113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869113, "uuid": "0c068308-86e9-49cb-99ec-b3c94281314b", "comment": "Malware payload", "value": "419646fc5352d464d61cad9f94fece4c", "object_relation": "md5", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869113, "uuid": "4ff43ee7-e61b-4d20-b5bd-15a7035c136a", "comment": "Malware payload", "value": "54447799aa58fedef1d03f4e06143cd1e70e8328d35df8f421508c4f5809d6fc", "object_relation": "sha256", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869113, "uuid": "77e3ed09-46c8-40d3-8531-21e08321a646", "comment": "Malware payload", "value": "e58354e3df71b47a19ecd8e1e5fe825c554eb784", "object_relation": "sha1", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869113, "uuid": "c08b31ba-dd1b-47f0-8f06-e0a3fc99431e", "comment": "Malware payload", "value": "dafaaedbcb322897ab095e63e0d788be533295488b3eb90e9dbe2595c5c129adeaed8c9ca0c8df153f749c3684cc48c8", "object_relation": "sha3-384", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869113, "uuid": "5d9f4951-4009-41e5-bcae-501ad9c2048b", "value": "T1C114EBCFF52DC2701B552BB448FDDA0B788D4D3419298EB3E9B189631E20DE6815EE1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869113, "uuid": "9c84ea96-e1f9-4574-8844-51226fa92fe5", "value": "768:CXY8SvP/ce3DN8KH0PRsTCW7xVTJwR0/nFN4LZEPDnW/nFfcPe+:CEHZ3h8vK2XT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772869113, "uuid": "6f749bf3-85ea-42b1-bb15-aaa05df22fa9", "value": 191089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772869113, "uuid": "b53227ed-92bd-41a7-81b0-c54d7dfa2bb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869113, "uuid": "e8fba496-a58e-41d9-ac42-096f112225cf", "value": "54447799aa58fedef1d03f4e06143cd1e70e8328d35df8f421508c4f5809d6fc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8af819-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871084, "uuid": "9a224d5e-d698-46e0-b4c2-d7bbf161ddfa", "comment": "Malware payload (Mirai)", "value": "ad7c708332c0341b8a3fd23482f0f8fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871084, "uuid": "2f4f9b6b-7264-4d2e-beea-0391f07b0a81", "comment": "Malware payload (Mirai)", "value": "54b4d835ac88e17b7fd9cfaaac0b65ce7e11c3ff14f6bf0ba5ef95759e16d314", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871084, "uuid": "b1da01d2-b923-4224-9c36-08afe8868469", "comment": "Malware payload (Mirai)", "value": "3366c116b7973a39799988de6f87569ad010b471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871084, "uuid": "aa68082a-e161-4568-86e8-15581c18b261", "comment": "Malware payload (Mirai)", "value": "70571ad19afc1ef727c54fdcb47e857e85ce1d1352b671979ac62ecf064c77ac6b7ecb3f3391bb9533a993b4422f5db3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871084, "uuid": "34ca348c-ce41-4dd7-ab85-be2de8ada0c1", "value": "T14933E845BD829906CAD84377FA1E42CD331173D8E2ED7226CD157F51B7CA62B0EAB062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871084, "uuid": "17721a21-d098-46a5-9973-3d80a41a32b5", "value": "1536:ZZ373CYePDBvT48TgEoxmnv44D0bwbZn:f3738PFcVEouv6bwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871084, "uuid": "b4d757cc-48d8-4432-ba47-261fa872b187", "value": 51624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871084, "uuid": "b466a321-c9d8-4a21-85e4-82f62769ef2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871084, "uuid": "a7dec2f8-091c-417e-88fa-403ff94b54b8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf2b6cd-1a36-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772895621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895621, "uuid": "2d0e7d18-2f5f-4ac4-9e08-0966384b8c92", "comment": "Malware payload", "value": "456a4d90e78c8ecc80d13bce893508a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895621, "uuid": "43d2a717-fbbb-4bb8-89f5-ad2c7a13c373", "comment": "Malware payload", "value": "551006be1d93d5c26f5eb7596b471756350d31fad728c708d52a88b6bc3f82f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895621, "uuid": "0c10b5b9-5193-4dfb-9cae-b46bb33f5966", "comment": "Malware payload", "value": "6c1a0697bc48a4f6b0f35cbfd210fec052a36ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895621, "uuid": "45dfaf6e-9aec-4ecf-b242-0acf45a1ba01", "comment": "Malware payload", "value": "4934fcc535e05edeeaafffda9564952d5d4e40bfa4761b1efcc86c80aab6a609c42d5a8d7974e03a17363e39bef671de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895621, "uuid": "3f2798a1-af4a-43e8-8589-6c7a6212edcb", "value": "T1C0F26C4876ACC763DE5F8E7CA8EA561B0BB2A612ED12DB4D5CDC90C80DE23904A1475B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895621, "uuid": "3a25032f-ed77-442b-bf33-5be1398beb15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895621, "uuid": "78ae63e1-b82e-4543-8bd6-187ffc71d75a", "value": "768:ze46up/W/DpbBbZTfUHK2bwVZBThFWSZaqtWI9:i46u/WprUq2bQTTmKaWWI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772895621, "uuid": "6e7b7d21-8976-4bcb-8ce4-114d6903a46e", "value": 36424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772895621, "uuid": "95abd48f-de57-4c07-bb65-b6a68eed7986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895621, "uuid": "8096cd02-6993-492b-bfc1-d6dd4e2d9037", "value": "Feedback.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919e840e-1a52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772907735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907735, "uuid": "bcc008fc-d6c1-4fda-b078-4841627509d3", "comment": "Malware payload", "value": "30b9e03a2f0805bfdddbd8686e770fb3", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907735, "uuid": "16756540-b742-4b56-b088-8ab8b50f1f1d", "comment": "Malware payload", "value": "55bdea005bcb13a68a76a3aaead5b274968b1798dc86f63fdb80ffa60cfd8afc", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907735, "uuid": "97c4a3b0-7b89-4d30-917b-8246caea4002", "comment": "Malware payload", "value": "d82ae205e396c713eddf03af24831a1618d2b789", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907735, "uuid": "da32e714-0ebd-42c2-8c8e-5d2c233838fd", "comment": "Malware payload", "value": "9fd969267b5eba0e1ff607d8ff40b62da3d9b0310f657cbbddef5e6c7643c72efde3a5d162f7d96891325ed560d5b0fe", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907735, "uuid": "b1668cbb-a2a7-41c7-b346-ef6af47278e6", "value": "T1B4164A21764AC52BD66205B019BC9EAF111C6F720F6214C7B6DC39AE0FB5FC21A36E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907735, "uuid": "f449897d-9452-4036-b91a-b7fe4feae059", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907735, "uuid": "37c847c4-9d4f-4322-8221-588e76ae85db", "value": "98304:Rr99u4kc8Hao8eRjYBU4UAir2Y5NppPi:z9upko8Rr6rPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772907735, "uuid": "319e6778-d662-4121-8132-5b84b58654f9", "value": 4209664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772907735, "uuid": "be59b799-283a-4136-8644-9ebc6e436c61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907735, "uuid": "0c18879d-e5b9-4e14-be6c-bc8042c28cb2", "value": "9418c8070453d3aa7298aff2a03547e5c4398e9311338d03c3fca04821bbc7ba~", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1986a01-1a02-11f1-a769-42010a9c0008", "comment": "Malware payload (OrcusRAT)", "timestamp": 1772873483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873483, "uuid": "141e9fcb-4e95-44ce-99f2-2006312c7f54", "comment": "Malware payload (OrcusRAT)", "value": "4cfa5db4226278154c89e8f42be0ceff", "object_relation": "md5", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873483, "uuid": "cef9caad-c3e9-4c35-b8f7-f5918dd964a5", "comment": "Malware payload (OrcusRAT)", "value": "57ce6187be65c1c692a309c08457290ae74a0047304de6805dbb4feb89c0d7e5", "object_relation": "sha256", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873483, "uuid": "476c305b-0e8a-4b61-bde4-5d6fea50e700", "comment": "Malware payload (OrcusRAT)", "value": "54f397857ba93d30a8b0d193f85605ee34559399", "object_relation": "sha1", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873483, "uuid": "b8963f6e-3529-40e4-8eaf-3f819471b3a0", "comment": "Malware payload (OrcusRAT)", "value": "d976e11b806917d2681682fa4ad0dc60379a4e64b996cf59ac8b3fa7b4318f93077f1cadaa9cbd103abf90223c732d22", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873483, "uuid": "35590248-87d4-44c5-8018-b89cabb9ffa9", "value": "T1F41633946855C6F2CC73003541DF972B6A2AF6312B67D2C7E8CF1E357E251E2A7A02C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873483, "uuid": "3440e660-ed98-408a-80f2-173946f6b25b", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873483, "uuid": "90ecee55-ac2e-4e86-b889-ccceb72442e9", "value": "98304:Qaa8BmLVMIC7szN7Gp8557Zi+XNA/mSFHA:Q7L6gzlG+V7XNAOSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873483, "uuid": "bc512799-86b0-41cd-b6b9-73cd2de55a02", "value": 4059136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873483, "uuid": "f0a428af-4c87-4e43-8d49-b492f3a46d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873483, "uuid": "29ca8894-a4e8-4bae-8f4b-4e85fd7fc3b2", "value": "57ce6187be65c1c692a309c08457290ae74a0047304de6805dbb4feb89c0d7e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f594c9-1a25-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1772888303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888303, "uuid": "62f622fb-587d-40ba-94f3-8dd9c34b7738", "comment": "Malware payload (SliverFox)", "value": "9b9a66e7daf631bd58db4f9f44f47d1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888303, "uuid": "be0c0f2f-d6a4-4598-af49-ee2da4198752", "comment": "Malware payload (SliverFox)", "value": "5906b6ba7e378bed08a1704bae966ce5a161f2c1a80a44361969abcb2260eaa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888303, "uuid": "b5742567-11c5-49aa-af4e-23b51313b3df", "comment": "Malware payload (SliverFox)", "value": "aa57ae808f8e1b2d0770d24fb8fa062756b62f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888303, "uuid": "797383e2-9d32-47ad-a4a2-56dc8971c20c", "comment": "Malware payload (SliverFox)", "value": "ef18bae39a99760bc1fdb472955b5b02a69e8e3c599fd9f02ba334dc3d945dc481a18dd4049541254fb49759df9a2664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888303, "uuid": "9a0f6a43-1208-4d92-a12a-935536bfe36f", "value": "T1F265120AC26885C0E15E1778D721B680705F2D119AE58EAF63D2FD7D2F312255CEBAE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888303, "uuid": "a9be08ab-fe56-40d2-a663-a7dffe90fb2c", "value": "2375883eb1e7dc125ccab70c39c11d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888303, "uuid": "e03f3048-ca27-4a38-9d45-4dbd6d7a40fb", "value": "24576:va7Ta7aa79a7sa7Za7KHHqnjzJqaY6OmMNUmSpqQalbmRN/yvZd0QCC3ZfS1x8oS:0oPCh+KHKnwaDPMymSpqQ1i0+p61xSbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888303, "uuid": "ad86e675-0205-4458-92aa-818a0b5adce1", "value": 1538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888303, "uuid": "3c1286fe-9e5f-4020-b148-f3e074c607eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888303, "uuid": "70dd3611-b10a-4197-b7df-d5ab786de422", "value": "2026.03.04\u540d\u5355.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05032782-19f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772865409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865409, "uuid": "c5d88206-81cb-4cc5-93d8-820b2dd1f3df", "comment": "Malware payload", "value": "142e2dfe5b163d1f7eb9d026b60d10e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865409, "uuid": "5ef62ea1-80b9-47bd-9768-b680ae1223b7", "comment": "Malware payload", "value": "59211217d9357bf5468ed7ea5b5da67df01fdf2984fd46f8c15ccdc9fdbd5999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865409, "uuid": "e095ab1c-e1f1-4d02-ac8b-973f5313c467", "comment": "Malware payload", "value": "b76cb91a05cafb88f4c9356f5254e2233ed8d994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865409, "uuid": "e2c7e598-e433-4828-8554-541010b589a5", "comment": "Malware payload", "value": "3a2f390b736a521e8318bfc95e84d2725b220143bc4017bdf2efd918d0238ac5434634dea7fedf5afe150f9a4146dcbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865409, "uuid": "46df0854-bf80-4e40-86e4-d0abf703235e", "value": "T161052C7E5962912ADD8A80FC35594B6259B1B33B03B41FF300A6913167079B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865409, "uuid": "262b981a-e9ab-46d5-8d53-7d62de8f08eb", "value": "24576:NVpixn2ptr2x2FtfElwb9BOg7VedXgrth4Tn:NVC2brx3BelTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865409, "uuid": "3e46eb52-5eb5-490a-a783-fe90406f6edd", "value": 853376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865409, "uuid": "81164871-5b2b-408b-a050-665561792ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865409, "uuid": "ac7101d0-a1c9-4d5d-b0a4-4d0993e9f878", "value": "59211217d9357bf5468ed7ea5b5da67df01fdf2984fd46f8c15ccdc9fdbd5999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6496a3f3-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871153, "uuid": "37d62f6f-a9c0-4285-88d6-c91d8de15bfd", "comment": "Malware payload (Mirai)", "value": "735217327b81a6050ae0ff0020303341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871153, "uuid": "55d06eb6-353a-4f34-940d-2dd533ba4599", "comment": "Malware payload (Mirai)", "value": "5bb94998bbc3fdb1c164499bdd4d883beb95b3a16059ba97cc27843d4eac95c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871153, "uuid": "ac1d556e-389b-4b4a-8174-1521ac933ccf", "comment": "Malware payload (Mirai)", "value": "56950fb3e04100eebdafeeb13dbc930130a6f02b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871153, "uuid": "817ce159-af64-456b-89e8-ce5f3d852611", "comment": "Malware payload (Mirai)", "value": "840cc895e91032b4078b949f1b33e5efecbb691630950194be3531c59b67cebea657456b21fd6d59b629f84f74e3244f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871153, "uuid": "b14512c0-d125-453f-a924-0d9e8c1665ff", "value": "T149A3B64E6E315FBDFFBC823547B74A21A64523DA2AD1C5C4D1ACE9011EB0249342FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871153, "uuid": "784ffc76-d5b6-47fb-a243-ec6ae8a1c247", "value": "3072:h2R2yJbpiwGiRDSg052eC7raYzBLRC1zNNbU2f:YIyHNGgAC7raYzBLRURRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871153, "uuid": "a7ed08b0-867c-4cff-b901-2ed7e3ec9d33", "value": 105744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871153, "uuid": "1cd508e3-577b-4761-b3eb-2eeae30e79df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871153, "uuid": "806f1f9c-4419-41eb-9a1f-c78f0855f071", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdb0125-1a4f-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772906471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906471, "uuid": "fef9883d-b3cc-4e84-9b08-97f50a87dd37", "comment": "Malware payload (LummaStealer)", "value": "6ef41176ac6be2ae6302831ad4ad2cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906471, "uuid": "e905a9c1-4251-4dd5-86c7-fc30a7bf235f", "comment": "Malware payload (LummaStealer)", "value": "5c47f62de622440aa88faa2bcafd0d1af4971b02e8d39b046a573c6cbe97a6c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906471, "uuid": "3b26ac38-7706-4256-bdff-c47e1cf2f0de", "comment": "Malware payload (LummaStealer)", "value": "2017d0a1163db09333559ab65dd71a501b353ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906471, "uuid": "fa4ed0f6-c5ba-4ec2-9a59-f42a8b24c9a4", "comment": "Malware payload (LummaStealer)", "value": "4bdc68a269d30ba4c6954bf8c2621629f771a04b89dd5baefbcbe5ba9243f22ff43cae70b118776e7c701edcc8208db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906471, "uuid": "25e4b60d-3470-45f9-8db9-c2aafe692691", "value": "T114D5DFF03EBFD557E54B5BB184846A267D6BBDEB26C5CCE07884C4140F1F4B62A2AC21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906471, "uuid": "987a9eb4-ba30-49f0-81d4-934295a8e8c1", "value": "5c8ba713d5aca387ad9fd4bebe8ba31d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906471, "uuid": "25f53588-ffe3-487d-9ca6-6d9c96342bd6", "value": "49152:PCzq2o1Cfpa9S6JGUBISwRKXfoqqU4vqsSaizJ3ZzY5Hi7G:KPTfpaI2Ge0RLvqq6ZzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906471, "uuid": "7cd3b3f9-a785-4c28-bffe-2085ff636cf0", "value": 2889784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906471, "uuid": "c8aa34bb-9d8b-499a-9aa2-4c728075f40a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906471, "uuid": "ccf2dcfb-3d70-47c4-a0db-59893457b428", "value": "6ef41176ac6be2ae6302831ad4ad2cbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2bf853-1a26-11f1-a769-42010a9c0008", "comment": "Malware payload (Gozi)", "timestamp": 1772888615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888615, "uuid": "bffd01fe-3816-4b17-814d-541211d84997", "comment": "Malware payload (Gozi)", "value": "b308aed68a8085fd653058662d94c810", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888615, "uuid": "46fa9927-1555-4059-9b53-25ad37361f58", "comment": "Malware payload (Gozi)", "value": "5db92f1296c7d7146dd9a5a10bfb393973ae04e1fcb03002679592090a3b928d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888615, "uuid": "19e1d706-8b35-4edf-9eef-6161d5bf6df8", "comment": "Malware payload (Gozi)", "value": "46769fe40eaa112a1b5737edc4bdf8d7d58fdae9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888615, "uuid": "20cea2f9-c643-4a00-9a17-3096c4e954d8", "comment": "Malware payload (Gozi)", "value": "82491508fc14b490b0fe08e8297c5f5ad92a8f07bd7588897df8f5f6cf5551a2756b199414f4c13e81489c830542e288", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888615, "uuid": "bfdf6b3c-1cab-4bdd-8625-3f0dc821a25b", "value": "T1BE7442A67CEA3414C6E3CF7722F95EF747A38A7B3045F62A1A72BE4C455227065A3103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888615, "uuid": "21a40984-a9ae-4670-a095-6deadb6590cc", "value": "ca484531570fddd7e0a79a1fd8ee4362", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888615, "uuid": "b2683892-1914-4693-b884-be6a4a1fa59c", "value": "1536:S+89U1jgzJRtW3qlW7V6VPHpxCeosaMoioQ+upt:8K1jgQyWp6VjCxlYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888615, "uuid": "2c6c1241-ab8d-44f3-be91-88be571d9c89", "value": 340825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888615, "uuid": "b6f4b5d4-ea61-4b28-9391-cb62c6cd767f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888615, "uuid": "2878557f-6382-4165-b102-f076679885a2", "value": "1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8709b979-19f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772868204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868204, "uuid": "07cbf37a-6937-4592-acb6-903c5dbf6e85", "comment": "Malware payload", "value": "82e764f5c708ddbd99f9aab6f2b4acdd", "object_relation": "md5", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868204, "uuid": "7de643fb-2ad0-4782-a81a-e860e9304416", "comment": "Malware payload", "value": "5e534c47c98f71732a31f88f28c2b2e97fab03b75e8a6ea9435ff37062f4ea7a", "object_relation": "sha256", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868204, "uuid": "c031e0df-e74b-4621-8c29-21b4354041fa", "comment": "Malware payload", "value": "d4942d875ccdef5f963cc6360a4908db62c66e73", "object_relation": "sha1", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868204, "uuid": "2bcbb6d9-d1bb-4a32-bfdf-f96f17c872d0", "comment": "Malware payload", "value": "7ae63acee8aec28e29722cdfbbc9e2071722482c31bba1f072e93a103a14d053da85a861af5d7e23020dbb0ff90aea43", "object_relation": "sha3-384", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868204, "uuid": "9e52f968-e8c2-4305-a8c4-8d3e7c57540b", "value": "T1D5D0A759118E1A32564161CF2F9947C6ADD42E827D31359DD0144D93074AA1A6119592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868204, "uuid": "ff4912da-5f5d-4259-9ff5-693e93d839c2", "value": "3:TKHwvNIEATRyS+FZgtwXc2WG0/dwqhNL77S3m5npKqLzk0fVF60NRTuwSKRPSh3H:vt27ygtT2nMwqhdS36/4W60IKPStBKKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772868204, "uuid": "ff2cae6f-dfdb-4cdb-b771-e68e799f9ccf", "value": 237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772868204, "uuid": "81ce8059-afe1-4d24-835a-4152c55e5146", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868204, "uuid": "b99bf12b-1c93-44c6-8b25-be895398cbd4", "value": "5e534c47c98f71732a31f88f28c2b2e97fab03b75e8a6ea9435ff37062f4ea7a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d069b10-1a04-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772874254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874254, "uuid": "cc0d2bdc-2a53-4aec-a6c2-48ec97dcbe6b", "comment": "Malware payload (Gafgyt)", "value": "2f6013b2889f66b319b45aa3ed4879e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874254, "uuid": "92e2a4ee-cee7-4fdc-a958-094999624016", "comment": "Malware payload (Gafgyt)", "value": "5fa09e32f55c66f298eb174ddb1b453e2b42338aae9c8b45f63f125e767bcfbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874254, "uuid": "f6004d95-2b9d-4f22-b749-bb527c082c0c", "comment": "Malware payload (Gafgyt)", "value": "9b69ae87603b65eabb0a91802440729805167307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874254, "uuid": "fc0cc706-c9f2-4777-b076-651136e2db3c", "comment": "Malware payload (Gafgyt)", "value": "86d339a6ec04112464950606f284665c995aaf06d56ecdad1c6691e34c5577b5c3930d3520021a1c5a5594188b6b72a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874254, "uuid": "057994dd-66d2-4c5a-8aa4-c851bbb8b7a0", "value": "T101F35B1BB4C180FDC8D5C2B44FEEB226DA72F45D2238B25B27947E262E4EE205F5D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874254, "uuid": "32b9668d-119a-4851-baa8-2f7acef68dc6", "value": "3072:Iimwf+8dIZqvctr3hq48KiMz80i9QSMDJGrsLhfp:Il8StVj/iLm7Zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772874254, "uuid": "2f7edd20-2ba1-4cea-ba5b-a1c4216621ab", "value": 169928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772874254, "uuid": "35ee10be-0185-48dc-9f04-55f42b56d410", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874254, "uuid": "94c36138-88e7-467f-a2d5-a5e47c4bec86", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0180d8-1a54-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772908370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908370, "uuid": "4363661d-cdbb-41da-b851-542d423c255d", "comment": "Malware payload (Mirai)", "value": "f7f69c63d16b9167210721f7b1cbd6ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908370, "uuid": "b604ac27-800a-462e-831d-255b2aba7ec6", "comment": "Malware payload (Mirai)", "value": "5fae4370735e01518bfa6fa64491e947ac864e31b960379a7f8192b0a1c67f00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908370, "uuid": "7e88af9f-0cb7-4645-a2a4-ce1d99378866", "comment": "Malware payload (Mirai)", "value": "26cf4aa4df245d6ad486ad21a1d4b9ea9c8bbbcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908370, "uuid": "a37df077-fa8d-454e-9ab0-bf02313337c5", "comment": "Malware payload (Mirai)", "value": "9f76b7deb2b3a96260881bc0a9a3f2299e78480b56c684f7be2442a9566d562ae7c5b1842f1912e0c89d3472f729acd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908370, "uuid": "8233d39e-84e9-459f-b773-6cd46504b7ac", "value": "T19DB31A56BD829F13C5C325F6FBAE02483B126B78D6EE3142ED247FA127478DA0E27511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908370, "uuid": "d4d20f8b-a0cc-4afd-8130-59cbd59f91bf", "value": "3072:olJVJd1NCX4Clv9D2RqcjS4A4DM4vwhy9rX:EVJd1N89VUdjS4AaMfhIrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908370, "uuid": "0e3a044f-beef-493a-bf27-7d1bbafd0d7a", "value": 113068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908370, "uuid": "f07cc13a-bcbe-4963-b09a-fb8bd6c165ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908370, "uuid": "f32146f6-2a47-4438-a6c4-fe6462371fbd", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73f48c4-1a54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772908711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908711, "uuid": "34c3bf9c-f59d-4fd9-a1e3-b127ade477e2", "comment": "Malware payload", "value": "72e7095b5123beb56e3377b29240a177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908711, "uuid": "49aa6bd0-d1a2-4f91-a03d-4f1b4fe84e84", "comment": "Malware payload", "value": "6064742f07e20c04ba5944cb8c3998779f8fe8d138f918040401386d78c49771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908711, "uuid": "629ac82b-df84-441d-9a33-f187c9102805", "comment": "Malware payload", "value": "eb6a80ac73770a1128f94e8d02f396d7799d0635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908711, "uuid": "1a343715-4a69-4bd9-bf59-566e9e99ded4", "comment": "Malware payload", "value": "d211beb7057278d78ff986379fc4eee5151153cb921b37d56e302e84beac8357abe5f826ca02450437ba63f0680d604b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908711, "uuid": "93f54e41-9f14-4473-a676-505b9ff9ef47", "value": "T1A708333FB187AA3AE56E123529306220593F7DB256134D8906F4B928DF781706F3F786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908711, "uuid": "20aa7b8e-82fe-4a58-8686-f3d420ae270b", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908711, "uuid": "9a7b3be5-77b3-4685-aeb1-f98d3d772073", "value": "1572864:t81quE0Nr8d4Xxc+U0nU/oEknkxqhGbs+yUgxEhMFmmoViu2As+H:t81ZEI4mBc+NnQxeGw+yUgks/As+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908711, "uuid": "9e5df384-593c-48a9-859f-8bc06215c62d", "value": 79088216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908711, "uuid": "8e9c86d1-17e8-463e-8439-5934a0e9075d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908711, "uuid": "60554f2b-a2e4-4c4d-a322-2cc8fd8eb140", "value": "RDP_x64_1911__2_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecec7c4c-19d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772854201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854201, "uuid": "977e375e-e25b-499b-a8eb-a2683fbb71a6", "comment": "Malware payload", "value": "1e7a226879fa3ce6136e81fc9890449e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854201, "uuid": "7a278dd5-3cb5-4d00-85bd-c2605daa66d3", "comment": "Malware payload", "value": "6140d7686184a7e77fba77aac06a71cc5dfa46500e316ebed1e5e8e3e6e3df45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854201, "uuid": "04323aa4-9f1c-41d9-9749-6c9cec398d91", "comment": "Malware payload", "value": "341480909f2d2836db389dd28fdab646141890da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772854201, "uuid": "49abf2ed-e31c-4a44-8c50-059463b92992", "comment": "Malware payload", "value": "1f5fa73db1c44446f5f60f23f5a516258e85e0d0004d1a9fb85ee35aa4443842f1d2f11a61e544077141430decbb76bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854201, "uuid": "f68f5496-1a35-44d8-9b2c-641eaa78b6ba", "value": "T1203160C6BF203D4DC44F8AB409630B06D7C0661229D33935832CFEA74E7E19C98879C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854201, "uuid": "f2b30581-c249-4e14-a6d1-5b4ca2509ef2", "value": "48:gWb7qdyNKMWGJ0UnbwhIm9bzU9UdFrJ5Oh0xe0flFikANScAw:7XqdyA4K/zU2zrg0xEScAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772854201, "uuid": "a7db0098-c370-4964-b32c-f4bdb685d9df", "value": 1785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772854201, "uuid": "7ca02da6-2568-49d7-b060-9c2898772ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772854201, "uuid": "a528aa28-0521-4792-9c9c-b19164cf0946", "value": "Hilix.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b869402-1a08-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772875781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772875781, "uuid": "bd5b7dd1-79e6-41f5-8c9f-b979f012f26b", "comment": "Malware payload (Mirai)", "value": "e9e2a62b32a40651ddbbe6d28ee50238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772875781, "uuid": "a50b1e5c-1509-4881-93b3-2432c56dddba", "comment": "Malware payload (Mirai)", "value": "62c30f8b5a6b4f631d8029dfe8f14b8bf063b43d06ddcd4d33786dfdaac191b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772875781, "uuid": "5e0ff0c2-51cd-4ba9-b9a2-52ebd42da775", "comment": "Malware payload (Mirai)", "value": "3365c0cee726a77e73e3872745e94f22a543d8d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772875781, "uuid": "3e4508dd-daf2-450a-a213-a907e3ce3a4c", "comment": "Malware payload (Mirai)", "value": "e6adcf44e96670afdd192ff6fc1c3e5e56a2766222221e6bbb569730cb11bc4e6d22e43610d2c551204befea00ca3768", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772875781, "uuid": "1d74ea86-5693-40ac-b3da-6e92556a70e1", "value": "T14CC31859FD819B11D5D626BEFE4E528D33131B6CE3EE7212DE145B2027CAA5B0E7B002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772875781, "uuid": "8ae320c5-219b-49ce-a446-fdb8764f381a", "value": "3072:96JtuG9chKpONhEYVsXc/aYbLxG5awIsoJ/0YdV9TT/UjduK:AJtux0ONhEYVsxY/c5awIsoJ/0YV9HUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772875781, "uuid": "677aca6d-0a2f-4e96-913f-36f301d41514", "value": 126076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772875781, "uuid": "98aa299f-f114-4847-bc1b-7f6a2a87ad24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772875781, "uuid": "3fca72f7-79ad-472c-90bb-4a875ea1e2b0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71607bfe-1a3b-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772897803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897803, "uuid": "fe6d8792-e606-4db8-896b-e6cb692b71b6", "comment": "Malware payload (Smoke Loader)", "value": "ed841836a1bb746a2a2bb2c4ce4efb29", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897803, "uuid": "7fac7761-60d0-47fe-9c8c-996322c0b0a5", "comment": "Malware payload (Smoke Loader)", "value": "62d0b74a54a7284ed71024b2076fb129e1c20df2d6f37342b236d1c70765a44e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897803, "uuid": "cbae185d-a966-4fb9-989c-476df747f443", "comment": "Malware payload (Smoke Loader)", "value": "20f85ff41fcea863ad87d15df191085a937b7374", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897803, "uuid": "d55b6164-f16e-4f8d-8e0c-53d23f00e978", "comment": "Malware payload (Smoke Loader)", "value": "e55a6ede51869f2115f2edd9bfc7d88718889e5071a5e3a868dc8336634d94f1ea99b4b9e3ae208faf761360498db40b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897803, "uuid": "5842abe7-1f0a-4438-b872-b510a55870a9", "value": "T1D9243A2BC25330FCE553C07892A66232B772BA3D47358EE70293D3359D61AC05FBA965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897803, "uuid": "7a37dae7-bb0c-4ce6-a04c-2663adccdef0", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897803, "uuid": "13ee3cc6-6b2f-4bab-802c-6401ea9b732d", "value": "3072:Ry+NC+3FGCgIuXHbTZvQJoUaCSC0CwMQv7PfyeLZlwABcJwXr:dDPgIuXHnZQyUSC/5ubfhce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772897803, "uuid": "dc95c2b9-0954-46ac-b351-05a94d3503b1", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772897803, "uuid": "df2d28d8-c85b-4d29-be50-d17a3f434a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897803, "uuid": "095128f0-d9d8-462a-a1ec-73a4aeaf7ba3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bae9c9e-19f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772866735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866735, "uuid": "3251c8f1-2a9b-4723-b924-762ed27e0838", "comment": "Malware payload (Stealc)", "value": "5e6dd4cc8717844fe72fda2827b70c99", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866735, "uuid": "def7e691-9844-47be-b702-f40fb1192120", "comment": "Malware payload (Stealc)", "value": "640d3f034e41cb7ee11e60742dd19b7049de6161ec62272821a21fa4dad5f3a5", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866735, "uuid": "e905efe5-949c-4242-979f-04d45f45b45f", "comment": "Malware payload (Stealc)", "value": "5df51c5b80003d4d6e542deedfe5102c7496bd3c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866735, "uuid": "cc4b0866-fb8b-41c3-9c1b-9f85f13f6f83", "comment": "Malware payload (Stealc)", "value": "269f48403ff209f81099381bdb4e72c3e03b50c3e9530575da2e2b0fbce44516359a1a42477ace46093ce91534baff5b", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866735, "uuid": "a953cf83-6ce3-4b04-8279-50254184f86c", "value": "T12AA58B47BCD0A4B9D0A9D2328AB212A17730FC594B3177C73E55BAB83EB67D41A35384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866735, "uuid": "ea3c5139-96b9-4bf2-9c8f-2a3030514665", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866735, "uuid": "dd0e0323-9960-43ba-aecd-3117d53ffe3e", "value": "24576:nBK25w8LOWJHdhxyjLjpHQ53OnBq6GmBj24F65etwgnyUYjiMyOcsYgtzlN+EK1P:n82yonJGnH/Bi4YetHnyUjMYgtWEK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772866735, "uuid": "68f594d5-1cc2-489f-9ab5-518de75e6ced", "value": 2260992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772866735, "uuid": "2bd4e02b-e31c-452e-87f6-d83af26f6d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866735, "uuid": "00b96283-58a1-40c2-9b78-145df6004211", "value": "downloadsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dabf619-1a4e-11f1-a769-42010a9c0008", "comment": "Malware payload (ResolverRAT)", "timestamp": 1772905823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905823, "uuid": "66c07d64-af4b-460b-a421-a77295d8536d", "comment": "Malware payload (ResolverRAT)", "value": "729e1fea387939d388ef597d9bd5c35e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905823, "uuid": "ff75aa6d-515d-49c2-b8b6-e3f50b82aa50", "comment": "Malware payload (ResolverRAT)", "value": "6454800ab6f4ab71e29cc0dd8b7fc97aceb5e63c47b32df2425e56e4ad8069ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905823, "uuid": "ad3a4544-91df-43b1-9b05-622c6a487fc7", "comment": "Malware payload (ResolverRAT)", "value": "19209a3481c5d6a8f40caea761caeee056ec71f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905823, "uuid": "4ba568a5-0542-46af-8f96-009954436640", "comment": "Malware payload (ResolverRAT)", "value": "ae3d72b023fd919d47616b154da9d55f5206232be826fde1bbd0e7dedae8c4dc47e0033ad02999a809b368f0656f32ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905823, "uuid": "3badf3dc-183c-4fa9-a186-76696eaa7c84", "value": "T151D49EA772224E20D2892377D1DA8A4293A4574AB5F3F74F718413E614433EFDE0B6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905823, "uuid": "fa374a70-04ab-442d-abb7-fc8f6f5e1ef3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905823, "uuid": "c1b1ea54-ad3c-4c59-8ed4-7092327c4c81", "value": "6144:4Fu/QuCKWd7yR0u1KPiVHB20P+VXoMLQTjCS1OKvhJqb9Tq5FyugLBWldJNZqUNk:Cu4pKb0jyMl4Mmjn58KeCfVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772905823, "uuid": "0cb6091f-ad4c-4896-a1b4-21cfe8c5256c", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772905823, "uuid": "ffe879f1-a374-482e-901a-54de44022387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905823, "uuid": "59f94af1-f0be-4661-9be8-df30ba1651f2", "value": "729e1fea387939d388ef597d9bd5c35e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98aee02-19f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772868369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868369, "uuid": "4f714d83-ca46-4209-9c15-afe3adfec749", "comment": "Malware payload", "value": "a7c6f827d525c7fe494d14a77410c697", "object_relation": "md5", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868369, "uuid": "7f6cd01d-b9ea-4303-b275-94265c60b792", "comment": "Malware payload", "value": "6607ac4ee5adc6b5cb5353d374d01d2a227cbea4f67a45ca345b5295d858c3d1", "object_relation": "sha256", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868369, "uuid": "004d8782-87fd-4d1f-8ca3-8c53b0de2015", "comment": "Malware payload", "value": "432938762b02bf070251b022cb62ae1341adedc0", "object_relation": "sha1", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868369, "uuid": "b969988e-bd9c-432c-ada4-3c826b5905be", "comment": "Malware payload", "value": "edfb761fdf824b42c7b92e151a8d3e0e9f1c56b216b43a97db936ec41fd16a518781ab6b63f04c1296d78f545eef3ca7", "object_relation": "sha3-384", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868369, "uuid": "bb3ebf45-7b28-4c9f-b89c-e0e29f02a95e", "value": "T15045237CC2061D30EF6B4531FBDC0BC61C25994364E8DFAC78C562952AF2E60BA41EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868369, "uuid": "ca71e427-4255-407e-89bc-8f670667e240", "value": "24576:4rEgV6dABDNOjAl6Gu7NYReSjQNEwUi2sgQ27kBrLkw1NUWFg9XY3R4Iump5:4IgV6dABUmi6jzbi2lhuQSK5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772868369, "uuid": "f6945311-3549-4f9a-a913-b19a9f54c053", "value": 1259532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772868369, "uuid": "bf29cdc7-5890-4a43-b689-aa6dec430cb3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868369, "uuid": "c3aaa7c3-f864-4d54-a1ca-3ba2babda415", "value": "6607ac4ee5adc6b5cb5353d374d01d2a227cbea4f67a45ca345b5295d858c3d1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9fd881-1a3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772898818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898818, "uuid": "38a81b86-9605-45ae-93f9-0bfd1c13392b", "comment": "Malware payload", "value": "a35720e248c8b89a58f7fe516459181c", "object_relation": "md5", "Tag": [ { "name": "BruteEntry", "colour": "#3D16F3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898818, "uuid": "d8c2f2f1-90aa-4333-9ebf-789f834e9820", "comment": "Malware payload", "value": "66adeedfb739774fcc09aa7426c8fad29f8047ab4caee8040d07c0e84d011611", "object_relation": "sha256", "Tag": [ { "name": "BruteEntry", "colour": "#3D16F3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898818, "uuid": "57f14b83-8198-499d-b24a-6d6f663823fa", "comment": "Malware payload", "value": "74cb41b383be4be3004bdba25974d120eb8d1395", "object_relation": "sha1", "Tag": [ { "name": "BruteEntry", "colour": "#3D16F3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898818, "uuid": "54e7894a-ddca-4ef7-9c5c-140b22cf52af", "comment": "Malware payload", "value": "4fb85b4d4eafb4f723e41a4c8eb66ba4c609e2b81e47786502dfaf295f1f454a9f1e908444a67ae149be16dd80e28abf", "object_relation": "sha3-384", "Tag": [ { "name": "BruteEntry", "colour": "#3D16F3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898818, "uuid": "dfcd1b5b-7fde-455f-bea9-d66c5b840aa3", "value": "T1FBE66E07AC5414F9C99EE6748A56825B6B71BCCC5B3097C72F21B3287A71FD06ABE304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898818, "uuid": "5e219662-69c5-45d5-b602-a9ed228ac568", "value": "196608:TJZmbRXdThUp8dnz3Trc1XXR/gDmoWuahiJ2C:1Z2ddTC8x/c1GDBNau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772898818, "uuid": "0392fce3-3aac-4976-b9bb-652d3d3e3d0d", "value": 14062057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772898818, "uuid": "07563fcf-e94d-4677-9e06-c1af19fd2c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898818, "uuid": "553c66d1-25ed-4a42-be52-361a2d2acf6d", "value": "os_check_agent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610b1955-1a5d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772912378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772912378, "uuid": "f828ff63-b406-4f38-b5bb-c3d2e97f41db", "comment": "Malware payload", "value": "a098a7816d2b028d2a1df4c611d76798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772912378, "uuid": "2a587a37-d4cc-4465-9d68-46d6751022f5", "comment": "Malware payload", "value": "67ac1914241db5466d1f81e6de3dab52a8f0a159944dac20962092b19e6d7267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772912378, "uuid": "30e528ab-c3a2-4f75-8087-4a3d14f3a52f", "comment": "Malware payload", "value": "f21d9a86d026519fdecc42f0ea272295d9019870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772912378, "uuid": "68184e12-bd44-4637-abd2-9f97ae903356", "comment": "Malware payload", "value": "1636a9a4c52b8988c87abfd8392c22b1bd4e20a6fbde17fe0c4c1960d057bca8774e351972ed6d44f6d5f021bd3f0197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772912378, "uuid": "56178c9b-e43b-4caf-bf44-4822fe5e6c31", "value": "T1DD56F1281F10CB6DE01F6EFADE5B0909F523B711292EC61189E79CC985FE1E1507ADA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772912378, "uuid": "1d3a655b-5db3-4415-a0f9-069a54e0f813", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772912378, "uuid": "cdcf6cc9-9b54-4e6a-94ef-9d449d1fba73", "value": "98304:8xJxjuXantBh1S1qKMPNkWwrH7lsyWOGon:aTSABucKokWydb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772912378, "uuid": "9fe38fd8-d881-4508-a8da-65c846785032", "value": 6453248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772912378, "uuid": "abee38b4-a046-4f6b-969d-d60142e8a6bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772912378, "uuid": "e6d08d5a-cb50-4240-8e0c-c5d95e7b2734", "value": "SecuriteInfo.com.Win32.MalwareX-gen.79418531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f17ef75-1a71-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772920938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772920938, "uuid": "47913b03-e1af-44c3-b2e9-14da77b15bda", "comment": "Malware payload (Smoke Loader)", "value": "d8e3b0ae8e45fbc5896d2cefad4aa1fd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772920938, "uuid": "7753a804-790e-426b-a9bd-6d5097903de8", "comment": "Malware payload (Smoke Loader)", "value": "683e24e5ccf6d051ec121496b60703e25b45f59d78cac3be0928d2d4f8a38c98", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772920938, "uuid": "054634df-1d48-49d2-838e-bc2d751e100e", "comment": "Malware payload (Smoke Loader)", "value": "5079f5b48a998434f3d0c1a7c2b75063dd561c7d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772920938, "uuid": "1a34ba20-b8d0-4b03-b366-61fed24e5212", "comment": "Malware payload (Smoke Loader)", "value": "de8e49a8f1b96bf41e5a9736f7218acbe140c4b82cd357a67c61e565d186ae0e20b4ac4ce062541619f66ad03a473609", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772920938, "uuid": "8c4835af-e22a-4b43-b046-3a16e2117a91", "value": "T160855C06BCD144B6D4AAE33289A652A6B735F8090B3233D72F916B783F7A3D05E35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772920938, "uuid": "531d2c18-1dd7-44ff-b15d-3d0980c18049", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772920938, "uuid": "8e900a7e-6b06-4e30-ad87-d454bfa46deb", "value": "24576:qUKp9guubwCaGY7UIAQ0FGgV7GiWkKXeYlu:qUg91uOGY7pAGaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772920938, "uuid": "9ffa757a-f452-40c4-8215-a6c47b6d9f8e", "value": 1757696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772920938, "uuid": "128f7a27-2deb-4e98-a896-42dab3ca7159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772920938, "uuid": "26b8a065-2113-46fc-b01c-5b0820e1d558", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6356149-19fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772870833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870833, "uuid": "9fc0d2bd-5ef5-4145-b296-eed2febf73c5", "comment": "Malware payload", "value": "b551a014af52a03bae2e61863f926592", "object_relation": "md5", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870833, "uuid": "61d4f88c-da5b-4d99-93d5-d00a17e59345", "comment": "Malware payload", "value": "6898fa164271170bed069152016e8914964c2a378f8c01a9b9276c429e64dc42", "object_relation": "sha256", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870833, "uuid": "89cb5d98-cc14-4c4e-818b-22ddb3f2d6fd", "comment": "Malware payload", "value": "72c54d823debb9eddfbc60bc9f734850b5daa030", "object_relation": "sha1", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870833, "uuid": "5f560fb3-7284-4156-95a4-32556bb7ada0", "comment": "Malware payload", "value": "e28e93fcbd93e26ef19970f8fd68fe3924c9ae6df3e7e008f3efc4c3c3a81cf22eaab4a94bf5fd5c950c00d8c13f2387", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870833, "uuid": "e8acba98-8837-44b5-ae37-8e5f745800c4", "value": "T125651290BE75A1F5C69ACB43939BFF29D71A2773064A2D9F412821C15BA37C35A07C0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870833, "uuid": "90be64ed-2e10-46ca-85a4-a5c5d6df381a", "value": "24576:c4QL3mCaocqGHuI3qRHRsoQjOeV+P9BT5irj0rlF5OzfbpT+VFNVv1j:cz3mEDGAjRX+IixgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772870833, "uuid": "f985c91e-8ec7-499a-b0f2-6371a1807b81", "value": 1420197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772870833, "uuid": "4893d06b-8723-457a-a094-44f2fa134c1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870833, "uuid": "37b41e48-b849-428b-bbda-356473c3d33f", "value": "Defence_Planning_Committee_Meeting_13_Nov_2025.desktop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25a7c8c-19fa-11f1-a769-42010a9c0008", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1772870021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870021, "uuid": "a453fcab-3cdf-49d2-8b01-a529948a82da", "comment": "Malware payload (CrimsonRAT)", "value": "6db2018760b44e7e8d2fa3603c40988f", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870021, "uuid": "8b90bed8-5f37-4c9d-9db3-83d6dfa821ed", "comment": "Malware payload (CrimsonRAT)", "value": "690cb1f68b15a54438509e1ec1ce57bd1c617ce6c429a62a694b85da9c09542c", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870021, "uuid": "d17a6b30-3336-4e19-b7c7-53e449d7b50f", "comment": "Malware payload (CrimsonRAT)", "value": "5890ae555fd273293543a6ebb61d1d32e203448c", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870021, "uuid": "f47296db-2fa0-49b6-bfa2-0ba0fc33bba2", "comment": "Malware payload (CrimsonRAT)", "value": "52778018887861b76bd37ec9da0e28bf72764d3f2f3eb45456d29aa867b81077f9eed6c52a5e517ec004dee1a86ec780", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870021, "uuid": "1e2fefc9-7601-43f0-9d9b-4bf2ce33aea4", "value": "T1368633BC95B757FF87BB073E3DA0B97211E8FD839381772414A217717830AA158BA192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870021, "uuid": "f00ae286-53c9-4b99-8310-87ec9cae9cc5", "value": "196608:Y6UOwL4bELEoLL56ZRaMcJeLG9KAbpvGHzpiM/K/U/IO5DTcT12:YROwL4MfLL5QaMcJeUZbpvopiM/K+b5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772870021, "uuid": "ee853da4-d291-4c0f-a148-542d277d978d", "value": 7931599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772870021, "uuid": "55d02299-8af5-4139-af6b-016a73ea9700", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870021, "uuid": "5f06f09e-d07d-4944-add9-f4858d84c8a4", "value": "690cb1f68b15a54438509e1ec1ce57bd1c617ce6c429a62a694b85da9c09542c.XLSX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08bfe83-1a63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772915115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915115, "uuid": "f9fe8f41-6b77-4be7-ad62-8e32a2b0c303", "comment": "Malware payload", "value": "c407373f97233bab167b84eaeefa4962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915115, "uuid": "19d1bd8d-038e-4e4c-b0b4-df616354faec", "comment": "Malware payload", "value": "69645cff07f7dbb3b27ee59ba60f2bbd0d6ac7abd9e954e3b2be8f14adcfefc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915115, "uuid": "847aaae6-0dab-4de0-a02d-f84724d64a59", "comment": "Malware payload", "value": "dd761689bbf41d9e46a03cb81df945767ed40d0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915115, "uuid": "43ce1671-9fd0-4868-a114-ad6f9abbfd3a", "comment": "Malware payload", "value": "e4527d766732cb7bd803f623e9ea4e89779bfedd71b755f61bd0dc483b2a0b0409d1decc296532abd558a581443b2d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915115, "uuid": "403ac76e-f138-4a06-bce6-ab8deb770df0", "value": "T17D6602856265C9F3ECC2333CF944D64AE635DCB02685A0CCB2A7CBCA4C5B76267A5CC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915115, "uuid": "1799c891-4e42-4ec8-82e2-fdb3ee39050a", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915115, "uuid": "6f17a0ff-3314-4635-b1fd-1ec9ab078b49", "value": "49152:NxJlqrPqHben3tCXIQ8UyuT1+mdFXwvm/hS854fRv4kFQ0/elwfP189IbH8j:NxJlgqHbCtCYC5jGHd4k+FlwfP1yIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772915115, "uuid": "5c0708e5-6757-4d16-9da7-d778fb8f0ca3", "value": 6571520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772915115, "uuid": "4f9d2caf-ef4d-4be6-beb3-39f2fb52e0d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915115, "uuid": "a140b291-f9fe-4ca0-82e5-854ee2e588e9", "value": "SecuriteInfo.com.Win32.MalwareX-gen.19285569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d3ac56-1a30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772893061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893061, "uuid": "3aa9a057-8874-423a-92ab-afd463c67473", "comment": "Malware payload", "value": "deccdb1e0897cfc547e4fb3944642fd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893061, "uuid": "ad4dbbb7-8b45-47d9-85fe-46b0ef9923cd", "comment": "Malware payload", "value": "6b06675949158473125e2323355c62fd3874fabc2e4def2d3912a7574a010387", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893061, "uuid": "9ef31724-186b-4fce-bc69-fe1f55ff8477", "comment": "Malware payload", "value": "33dc22cc3e35e08dddc42c2b77f46d3f296eb0ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893061, "uuid": "61e238bd-5e57-493f-aa9e-d0ee20a7d188", "comment": "Malware payload", "value": "ba6164382591f3095d37150877314b7707a646a415e91e30527e819647d46ab57ce91490a626223efaccd590db580694", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893061, "uuid": "b0eaf898-5988-438c-9b45-27c8048df18e", "value": "T1C9142347944207BED7A55A7ED6A013C7F1D06C320A3E88998BAF47ED046247B6EDC933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893061, "uuid": "c0c76308-b028-4e28-9f07-e43dde7573ec", "value": "3072:ju//Hbj0LJcoFNADabtfJGFwkTO/S0sUJ7MzdaULC4ekFVxJpl5EfJ5qd1P:ju//HKcG2wchSnsUNMzdaCCDUox5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772893061, "uuid": "1b070ac9-5e54-4f65-ae32-b612559d626f", "value": 196348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772893061, "uuid": "472b816d-53ce-4b41-b363-640c83cd5da4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893061, "uuid": "13fdaeb6-461f-47c7-b458-4fcaf25a4210", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df149d1-1a39-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1772896777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772896777, "uuid": "c53ef440-d676-4e23-9d58-4c5878a1a8c9", "comment": "Malware payload (SmartLoader)", "value": "2fe5604dd602762b382fa812436d5352", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772896777, "uuid": "acb9c35f-03f1-44b7-9786-daf7b28fb6d9", "comment": "Malware payload (SmartLoader)", "value": "6b30c4ad47bd3435d727c76c87fcee66d668b694405b36f4ff2fe2f879a2918a", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772896777, "uuid": "4f0fc229-5a7f-4eda-8ea5-c5270b6ae56d", "comment": "Malware payload (SmartLoader)", "value": "3462ab98f560cdb75c589e061e9de2286cd0de50", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772896777, "uuid": "edacef63-9559-49f7-9108-e23a18abace0", "comment": "Malware payload (SmartLoader)", "value": "4210465362a2d583b3f69d283cb4211c264f02fb77c92159236ba74fac6012ba733cc570e6d873d49380d322297da828", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772896777, "uuid": "261db091-32a9-427f-8659-b7b46f378ec7", "value": "T176C4239603689624787407B197BF9F8DC6028E5329921BFD9FC8BF0CA1356489D5FBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772896777, "uuid": "83311012-7726-4e5a-90ff-2e30c06aa48d", "value": "12288:oOCBcIqB0liubzqtYBpfsz4TKPozt4CTo4Pl/2Ar57:oZ+LubzqyB9sz4TKPE1l/Zrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772896777, "uuid": "697f3247-cc86-4824-9930-ad81925074c2", "value": 546982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772896777, "uuid": "c82d0b97-4d3f-4168-8238-3b35b46d0230", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772896777, "uuid": "7e61ddeb-ca10-43a5-9f8c-bf380cda1041", "value": "LAMP_Client_v2.8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d003b89-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871086, "uuid": "41c0c43c-d961-4664-a7a4-78be26bfe305", "comment": "Malware payload (Mirai)", "value": "62dac0a1b098f82828598f5cb32dc8bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871086, "uuid": "4e80628e-7cd0-4238-8647-6e397cacb2cc", "comment": "Malware payload (Mirai)", "value": "6ff82948382469b7a4ca05e2542a8c054c4a2147d24fe1a9db8e60428348acb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871086, "uuid": "27527ea4-4c29-4e6b-a84b-bd653f2eae52", "comment": "Malware payload (Mirai)", "value": "a790f9b79d58aad1e9e4c37ab04c51182654d79c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871086, "uuid": "f73db220-4f98-45b3-a117-1b567d76494d", "comment": "Malware payload (Mirai)", "value": "511b9eba940c7adba0035d01da0c8d605894cf49f31151fa0e63a6e84db27b0ca7a1eb4803798609c6e6e5896460f2a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871086, "uuid": "82dca400-5a57-41a7-a24c-b75990097030", "value": "T14FE2F13402BAE5A0C276463DE591C9D3F7E637E5E17E3429F44102B69982D80B4F5ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871086, "uuid": "23ec5a64-3fc7-4ac2-a8bf-5db50771b10f", "value": "768:a0hH9ToVh9veHH1HjX+3EDaPEBG3bWh44CTs3UozG:a2gvenVjTD43L7+zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871086, "uuid": "8312c9a0-654c-41e9-b4ed-cea5e89190dc", "value": 33944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871086, "uuid": "ecc5762a-53c3-44b0-90fa-4ade516dcd4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871086, "uuid": "25cce50a-d729-45f0-a323-03a07f9fa591", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82459f4e-1a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772890530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890530, "uuid": "2814654f-9883-4e49-93a7-7b4c4d052177", "comment": "Malware payload (CountLoader)", "value": "848e275660db2017f9d1f352a388a168", "object_relation": "md5", "Tag": [ { "name": "ccleaner-gl", "colour": "#7F04B4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIXNEW2", "colour": "#D1D6D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890530, "uuid": "484b5a36-1286-4951-81a0-855bb0b8667e", "comment": "Malware payload (CountLoader)", "value": "71057e2370ef3af03fc3edc5a9a52371a27917638c20857ce4677bcc860d3b48", "object_relation": "sha256", "Tag": [ { "name": "ccleaner-gl", "colour": "#7F04B4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIXNEW2", "colour": "#D1D6D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890530, "uuid": "d81df4b3-72fa-4d99-bbf9-d3002de5fa9e", "comment": "Malware payload (CountLoader)", "value": "a342dfee72dccc49bfc42cb5e80b7820031f5572", "object_relation": "sha1", "Tag": [ { "name": "ccleaner-gl", "colour": "#7F04B4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIXNEW2", "colour": "#D1D6D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890530, "uuid": "56f839c7-ae16-4c08-8043-f464a3781bae", "comment": "Malware payload (CountLoader)", "value": "017fc009360b7456a22a4707d911e326bc1360b44d21d21d0d46d93fd9cbd88ddce3dd1fecfbaa72fa52b593628d00e0", "object_relation": "sha3-384", "Tag": [ { "name": "ccleaner-gl", "colour": "#7F04B4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIXNEW2", "colour": "#D1D6D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890530, "uuid": "305cbae6-ca24-45d7-b4f6-947f831f9864", "value": "T10A77CF1277E88076D07B8234CA6B9726E6757C22173096CF2254BA6D1F73BD05E3AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890530, "uuid": "3d70edc2-d61a-4acc-bec0-345088710821", "value": "ce3bf3d44beb8695e8f62d66f6b0d23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890530, "uuid": "4f1bb8c8-67fc-4df0-aef3-e382c7ad1e12", "value": "393216:ySwAOrX0ATL0YHIwGRktEN5S27SS08PD5GXz7Qwn0:yXYALoOkv0aD5GnPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890530, "uuid": "d2dc200f-230f-4317-8e1e-cfd5b0f2c95e", "value": 33490944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890530, "uuid": "36f3df28-2388-4def-8448-001cce299e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890530, "uuid": "0209810d-133b-45c1-9498-e87fc3c2a83a", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a801c65f-1a3c-11f1-a769-42010a9c0008", "comment": "Malware payload (TernDoor)", "timestamp": 1772898324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898324, "uuid": "5900f8d2-59f9-499c-86b3-4231accee434", "comment": "Malware payload (TernDoor)", "value": "e81e06a98494d3a207a9406b87ebcf7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TernDoor", "colour": "#E286A7", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898324, "uuid": "f55e4836-8307-4ac9-90b2-29a70b428bea", "comment": "Malware payload (TernDoor)", "value": "711d9427ee43bc2186b9124f31cba2db5f54ec9a0d56dc2948e1a4377bada289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TernDoor", "colour": "#E286A7", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898324, "uuid": "450cc3fe-b7b9-4f2d-9369-9143e9915d8b", "comment": "Malware payload (TernDoor)", "value": "8d4fea00c24eaefdaa77781648bafda7b9eceafc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TernDoor", "colour": "#E286A7", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898324, "uuid": "052a6899-2ddb-47a9-ae32-b4fe40318246", "comment": "Malware payload (TernDoor)", "value": "fdadf5186233403774d4683881c129d64bcc4b17b34fe52ab447099273ab70accc7630191f010b715f3051ce652e9602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TernDoor", "colour": "#E286A7", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898324, "uuid": "39672d41-29a1-41aa-8f20-546f498400e6", "value": "T1A0934A1BA2E500BBE4728239C8634E09D776F8125661DF6F07A4065E1F273D29D3AF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898324, "uuid": "018972bb-3c40-45fd-bdf0-474047327a97", "value": "a3276639e4ae06e47669991dd5db8a7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898324, "uuid": "3934537b-0369-433a-b332-4b3325209b8a", "value": "1536:7jKZINBMC1qdzcSzxFtNbpElP6JLFXsW7SId09dl01YUN:HKZIPv1IzcaZNbp8P6lFtLMu1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772898324, "uuid": "7680faa4-0a1d-4b78-b352-01b703b51cd1", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772898324, "uuid": "81c7d935-dfec-4d93-9ed8-59a96a778d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898324, "uuid": "3d0c5765-87f8-4dd7-a0b9-922bd7d15859", "value": "BugSplatRc64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c38491-1a31-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1772893560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893560, "uuid": "a74c1677-fc81-46c2-8369-2809442aabe9", "comment": "Malware payload (EternalRocks)", "value": "3a40b9e3347637b831a03c63ae21254e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893560, "uuid": "0be5178f-df53-4df3-98df-95bfcdc8abc0", "comment": "Malware payload (EternalRocks)", "value": "72c08e044dd427964bc14339f95838e3d45f51f6a586330c683fbb59ea374b1d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893560, "uuid": "5af1a553-ae9f-4899-b293-3a6ca5b76295", "comment": "Malware payload (EternalRocks)", "value": "f47daea44c3f3dc766b487733bb894c453c046b9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893560, "uuid": "7f966ce4-8bc7-4bb2-b600-399bfc05dcd3", "comment": "Malware payload (EternalRocks)", "value": "5d64d0e88c62949e7726683a6632ada230a5fcb4aded43bc543dc3ed86602acc27eea95305ec5a9e7808ebcac3d758aa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893560, "uuid": "70f13e00-5ade-4f8e-ae2c-f26e106a21e1", "value": "T192951A4DDF179E5670DEE2D78D97B48BDC64E2FE122720D833E980492069E99037B92C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893560, "uuid": "2abdd109-a16b-4dc6-92e2-e507796b86e5", "value": "12288:H0MnIRtRY8Qc0UBr/H73+GiEJurPwxW/eYSmdP4RgkjKbq8GjHM8WWpzixKMDt:UMaHY8Qr+aGitrPwxWEum7HiWpzaKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772893560, "uuid": "fd6a3b53-e065-492c-92c2-c6483ac7e0c7", "value": 1956575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772893560, "uuid": "5ea4f72f-757d-42ef-97da-e4f785db7c3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893560, "uuid": "8ded0ec1-4403-4e02-92f3-2af60f019eb1", "value": "oqqqqoa.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb387d21-1a02-11f1-a769-42010a9c0008", "comment": "Malware payload (OrcusRAT)", "timestamp": 1772873472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873472, "uuid": "d0d210da-8028-416e-9b43-e44d89a39883", "comment": "Malware payload (OrcusRAT)", "value": "2b9bfc5f9bc639e27e2a61ed5d2d5005", "object_relation": "md5", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873472, "uuid": "ff7e020b-0cc3-46a6-9b01-35e3da080701", "comment": "Malware payload (OrcusRAT)", "value": "72f9481a8dfc4ac2c28ea11be50966a78fb5df7541a1952df098f15789e8a998", "object_relation": "sha256", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873472, "uuid": "35fca2b0-e0fe-4a3d-b3de-0fb099ae636a", "comment": "Malware payload (OrcusRAT)", "value": "f76e2010592700e48f4ed666b8167e33ce3dbc3a", "object_relation": "sha1", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873472, "uuid": "efe6ef2b-08b9-4a19-9bc2-bfee2f479afc", "comment": "Malware payload (OrcusRAT)", "value": "c154e48dd455a946e6d697f5f3ab35a83e0ee1e8f14111639c035ca66cb1246963d5e20f48b2aaf8c1302f110f3beb24", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873472, "uuid": "0e38621a-b73e-4878-8da7-085c1ab7eac7", "value": "T11A06338E60F40360D29A67F55087582313F9410768FFE79B3B18F5A68F2139A47B6B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873472, "uuid": "f0a0a002-0fee-4968-9780-2c4e6be1d72c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873472, "uuid": "10712d2b-3c09-448a-b919-3c62a35ac291", "value": "98304:euO8xCsskaRod/MWfOf3GLMMzsva+vG/s944RJ5+ylIIa5umX3i:euXxClkaRa/MwK2xACd/sXLsw65umC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873472, "uuid": "df705acc-c1ae-4c9b-938f-984eb442ec28", "value": 3956736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873472, "uuid": "3ae8fcec-d667-41f2-aba9-4009b52bf022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873472, "uuid": "5c2be14b-f868-4d3b-8349-dfce7236f1d0", "value": "72f9481a8dfc4ac2c28ea11be50966a78fb5df7541a1952df098f15789e8a998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e764dbd1-19d2-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772852904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852904, "uuid": "46ccad23-9d6b-4c4b-9475-087e462f14a4", "comment": "Malware payload (GoToResolve)", "value": "5661cf54dd991527ea4399155fe06872", "object_relation": "md5", "Tag": [ { "name": "144-172-92-217", "colour": "#FC151D", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852904, "uuid": "b8413d7d-fc00-4825-88b9-b7dbb4a514b1", "comment": "Malware payload (GoToResolve)", "value": "73813e7ab280691da1ba021e45081f7150da8e92a609c8ea668695df21a08697", "object_relation": "sha256", "Tag": [ { "name": "144-172-92-217", "colour": "#FC151D", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852904, "uuid": "e5507944-55d7-430a-a819-5fbd661507fc", "comment": "Malware payload (GoToResolve)", "value": "cbeb8d2ebbe84b2cf3213b5a5577da6274a784b3", "object_relation": "sha1", "Tag": [ { "name": "144-172-92-217", "colour": "#FC151D", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852904, "uuid": "c44aa7e1-6269-484e-bb8f-938065316966", "comment": "Malware payload (GoToResolve)", "value": "5978111c7c6954be14c6f7514af439e7c04b0b2dd8023638b39b27e804f11f112a1afa084e9ea356ce9ac043fd38f180", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-92-217", "colour": "#FC151D", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772852904, "uuid": "97b3833b-0032-4624-a328-d4f06e71492e", "value": "T1093733217A99C635D17D0072A869ABFE427CAE150F2145CFB3DCBB584F306D2273629B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772852904, "uuid": "451256c1-222e-4c98-81d1-b85c984c1a41", "value": "393216:tuqJ2i4eQObGUDkozmUttmljjOnLCaiKk3MRh9MYI+hQW7cwftlgDA4BZikRwtgu:gQOObGUDkozZTC/yLXikFjxgDHB9RwtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772852904, "uuid": "5bc2fcc8-24ff-437a-bf32-26089eb307ab", "value": 24535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772852904, "uuid": "3672f80b-a036-455f-a1d9-399682132c40", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772852904, "uuid": "7bc0d566-86b5-46c7-8b0f-fa236e888e23", "value": "SSA-E-Statementpdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6dda28-1a2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772891644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891644, "uuid": "310084c8-03d1-4606-a9bc-5b3318cac026", "comment": "Malware payload", "value": "c6feec82fe888ac20f98322f2cfcbf25", "object_relation": "md5", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891644, "uuid": "74a97526-8474-461c-8cd9-b569e06e4afc", "comment": "Malware payload", "value": "73b6d0a0961306006bff16ae23a87de66972d342649702ea0f425bc1609ff3fc", "object_relation": "sha256", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891644, "uuid": "4cc440ba-a592-4c2a-a73b-96167e541ff5", "comment": "Malware payload", "value": "da9b582fad8349dc74bcfe2419a22d517bb6da5e", "object_relation": "sha1", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891644, "uuid": "ea849e17-a120-4d80-91f4-3cfeef8834de", "comment": "Malware payload", "value": "fbf529666489d608b8981a52dc1ca2dfc7a8d76d423cf9b8267e8a0c5e80fc864c4879ead7849f69f24fb8c403fcbf18", "object_relation": "sha3-384", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891644, "uuid": "5a462c11-edaa-4c41-b756-1af6eb3d6a1d", "value": "T1C0A633E4F680AFC1F032D83553F880A4E9DA186270D3DC72BD132F5926926F7E69E549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891644, "uuid": "0334a120-ea80-4d3b-97c8-17244154669b", "value": "196608:Rv3345+uWL63x+mb2ZYYLqIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9NPZ8/Y:RvdL63Mmb212hOnn7FUNyhGprLz0Xh8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891644, "uuid": "ee37b686-b767-4090-b03f-86cdb7eb6368", "value": 10280006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891644, "uuid": "6524c982-2048-4d6d-bb5b-5dda57ebcfd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891644, "uuid": "17ec0985-1c9b-4b97-b834-1512a9af8c73", "value": "wslservice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb17243-1a52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772907754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907754, "uuid": "ed28d360-b0ea-4baa-86e2-0e88cda310cd", "comment": "Malware payload", "value": "21a6b907559b97307fefbfae3806905e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907754, "uuid": "be8fd1a4-9595-407e-b15c-f12ecac906a5", "comment": "Malware payload", "value": "74548adc0158b704c0776920cf0f8cfc2c3022b2cae56b5aae239d70df1f7d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907754, "uuid": "10ac677e-7d90-437e-ae24-2b3ec619d01f", "comment": "Malware payload", "value": "75b38c5c4e2354b3ebdab05bd9587ae99d8345ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772907754, "uuid": "92064632-0d3a-4043-9af6-49df84a2152d", "comment": "Malware payload", "value": "8221613720e9517305744d4c01a90b04eab003f4750a9f5d01ed024c105c21d43a0525f4c8ae069379b4c8c665be8bd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907754, "uuid": "4100f120-dc0e-40ce-aaa2-5aa19e259c41", "value": "T19608333FA187AA3AE51E1636253062345D3F6DB265134C8916F4BA64DF381702F3FB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907754, "uuid": "13116855-e67e-4298-b627-7e7428976216", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907754, "uuid": "f19e6100-c89e-43ae-a178-877ca05b53c1", "value": "1572864:F81quE0Nr8d4Xxc+U0nU/oEknkxqhGJs+yUgxEhMFmmiU+4:F81ZEI4mBc+NnQxeGy+yUgksV+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772907754, "uuid": "92421cf6-1465-4f8c-9079-a87131cc09d2", "value": 77649240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772907754, "uuid": "c016cb58-d012-43f3-af05-842625ff69e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772907754, "uuid": "92658ef1-a266-4007-a6de-a51473250cf6", "value": "IElegance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601825e4-1a7b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772925262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925262, "uuid": "67df9c64-8f75-4032-9b8f-142cf988788f", "comment": "Malware payload (ConnectWise)", "value": "a5eb90e66712f27d172b0bfd987d36e5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925262, "uuid": "1467c87e-0da9-43e9-911d-a997e270fde0", "comment": "Malware payload (ConnectWise)", "value": "74d37470689e9ea87ba558d0adc254517b8e181642ae43daff9713ee63210077", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925262, "uuid": "98273a3c-0dcd-4e38-96dd-a5a24463f970", "comment": "Malware payload (ConnectWise)", "value": "2be894d434f6189b62da88ce3714b5effd47bde4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925262, "uuid": "3c68a5a0-2c63-4911-8b1a-b4eb59b2c359", "comment": "Malware payload (ConnectWise)", "value": "fe65b6ea0214c5b6b7dd634b911de0f8a7f7b35efd686c175ff32a17a3273d213b78fa5c32021984037fb03fff677e57", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925262, "uuid": "06cc8e95-4254-4aa0-b777-582a9da81aaa", "value": "T15E56F001B3D299B5D17F0638D8799269A774BC009712C7AF53D4BEB96D327C08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925262, "uuid": "134d5ae1-8e28-40e9-af02-b8bdc16c2da1", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925262, "uuid": "24e6fd64-baeb-4a56-9cb2-973cc25f9b9b", "value": "98304:EGs6efPMjb2w6LeJR+WJ0dX2DSQG1oqryAqqlDQg+l:FfefPMjb2w6L4Rr0AP0yANlDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772925262, "uuid": "1c3692dc-6242-4a9e-b187-99671f10c41f", "value": 5939688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772925262, "uuid": "d5b96e7d-5162-4ea4-9c36-d456b5090bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925262, "uuid": "5984791a-0f4f-42b6-b577-0ec0dc7f7a1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8afd46-19f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772866230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866230, "uuid": "e6f9b742-1d49-49a6-8085-d0afef9f9c39", "comment": "Malware payload", "value": "2cc0c58da1be8467658bde43db94549d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866230, "uuid": "e6961444-1a05-4c23-af0f-1a9e799083c3", "comment": "Malware payload", "value": "752681ddd88ecd8189270e8a3e0ea209ab40d8fb22ee22964aa902833efc04ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866230, "uuid": "145e6e97-61c4-4fdb-97dc-ef29994b5c32", "comment": "Malware payload", "value": "84a906349a13723bd68bb895a4114a36cff8936d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866230, "uuid": "e7dd1e53-83e7-47c0-b12a-428d2517b78a", "comment": "Malware payload", "value": "5efbaa8bef2662cd11f31bf1c8f10eba0a12d78108b19bcc5c7bf695372c8367131fa1e6df39e2fcb288bde85ae56ead", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866230, "uuid": "7784f48b-77ef-4d8f-ab0a-701713fac65b", "value": "T1C603F1C4B282CB163D11DC7F163E3FB5115C25A3C88607EE77F1A6181E99188EB05DE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866230, "uuid": "110028f7-0833-44ff-9815-e30164133de6", "value": "768:ROEk6Y0b7J434kRql2J6p2ryeIeZchkoqOEIbdQD+pOA3:0Ekw58qlayeZchiOr0+pP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772866230, "uuid": "f9e164b7-d191-4864-b1c0-69018ad0fabb", "value": 38190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772866230, "uuid": "e3d0c1f3-1384-4e88-a9a0-e47ad21c5eba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866230, "uuid": "5d5db9cd-84d6-421b-ad4b-8f1626702548", "value": "LIST OF OUTSTANDING AIPR IN RESPECT OF GP 'A' OFFICERS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c98ba08-1a6a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772918008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918008, "uuid": "e9438fc3-5c06-4d65-9aef-5478f8572397", "comment": "Malware payload (AgentTesla)", "value": "29ac179b24464ca9d6f4342f08edd34e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918008, "uuid": "36ef0cf0-f1c6-4cac-8dc0-d2fe1bc0382e", "comment": "Malware payload (AgentTesla)", "value": "756e2527fd5a40547e66224ba0933785c1c6cc607b89510e863f18f5ef4dcc8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918008, "uuid": "50f0fde3-c532-4e27-ad33-f2e79fd3c37f", "comment": "Malware payload (AgentTesla)", "value": "aa0ddcf8abe7051d33403edc2d17314217d9d20f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918008, "uuid": "4e70cb3b-7f93-4748-80df-d494f32d5721", "comment": "Malware payload (AgentTesla)", "value": "9240d2597f04f69ffa7ecc07a5710f5fbcac1ce82b9f46097083dd01aa3e74f91615b0fbd2af3c53ce4e09793ec43269", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918008, "uuid": "aad4c9d7-f033-4a5a-ae33-962f38fcc7e9", "value": "T1438533EDEE99E098B58B8B3326C705E40B4A5388026487FFC7A53FDDE719010BE65616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918008, "uuid": "a366e229-32c6-4a29-806a-f1539c42d127", "value": "49152:4pGqaABEbpQRUsIRyrCFPu68TukOp4h1OWLt1a6W:KG98EbpQRUsIrFPgukOe9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772918008, "uuid": "87f51e2b-7583-47fc-b013-499e8d1ba509", "value": 1839413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772918008, "uuid": "b0553b4d-b7f4-4a0a-abcf-0f47ae7ed3b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918008, "uuid": "c374fec3-2465-47e0-a1b0-7fc805c4f46c", "value": "AMENDED PO NO. 55963.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fb1baa-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871098, "uuid": "3b38afe8-a8bd-4e86-a383-18fe305bffd4", "comment": "Malware payload (Mirai)", "value": "69bcf3d8066af65a52efec8dd9503003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871098, "uuid": "5fcc780c-3e7b-44ee-b82c-4c82d28eaad0", "comment": "Malware payload (Mirai)", "value": "7642e5a3babf161d0f6888ad411612026c29d808c2aca6baa36f060faecf1410", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871098, "uuid": "58d5655b-28a1-4e7e-a58a-5cb740672794", "comment": "Malware payload (Mirai)", "value": "9c8ecc18cfdb39c199b17bb75fb79e40785a031c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871098, "uuid": "904cd36e-9b70-4d13-ba59-353096d5e864", "comment": "Malware payload (Mirai)", "value": "5bf1feb06c7c51a491b59fa86a017471649935e255252faf792a57b5600c47ff5a70ab41ae1696d11b0ca1be19922ffb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871098, "uuid": "6f08cf38-4b35-437e-813e-f9f8f03fccc1", "value": "T16873074AF9829F10D4D913BBFE0E018D33536798E3EE71129E116F11A7CAA5B0B7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871098, "uuid": "dd0a04a5-46c0-4520-9bbc-1ab9f4f38029", "value": "1536:K9nq3zwiiI5npnFUNh0n2eooZnknrw6iYhf8XllzfisgAXU5wbZn:5jwFI5pWNh0Wo2nrw6iYhMVgAE5wbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871098, "uuid": "615259d5-30d2-49d8-a791-34b5ed06655d", "value": 75616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871098, "uuid": "b1aafe39-8873-4cb6-bfb4-5a8fe4dc55c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871098, "uuid": "3cee6fe0-a226-492e-9595-45ebc657f2a2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785198aa-1a2d-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772891801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891801, "uuid": "50f35d95-b624-464e-87b8-2fe35c97d17d", "comment": "Malware payload (ACRStealer)", "value": "fcd35ef896f26712942e07af78b1805e", "object_relation": "md5", "Tag": [ { "name": "94-26-106-216", "colour": "#E0ECEC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891801, "uuid": "6da60b36-c889-4f52-92a8-b4366433ebe3", "comment": "Malware payload (ACRStealer)", "value": "77cb520ef9fe93eaafa8bc7bad967f9aabfb22ea51ad2d05fa9b9d2702b33c84", "object_relation": "sha256", "Tag": [ { "name": "94-26-106-216", "colour": "#E0ECEC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891801, "uuid": "0481be05-1dc8-44ea-931a-da8b455f5def", "comment": "Malware payload (ACRStealer)", "value": "9a066068ae56b26dfe0ea08e17ea3d14fbe23478", "object_relation": "sha1", "Tag": [ { "name": "94-26-106-216", "colour": "#E0ECEC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891801, "uuid": "74ccde9e-996e-4ef5-becc-3b151ba0aa46", "comment": "Malware payload (ACRStealer)", "value": "732dd309ea9347f428cd0901430ec747b4a06284fd753d8b090990eb53007dae0bf41d4dd9502e5e13fb19f70582a24d", "object_relation": "sha3-384", "Tag": [ { "name": "94-26-106-216", "colour": "#E0ECEC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891801, "uuid": "57ae63a8-732a-45cc-bb4a-a10a93d64634", "value": "T1899529D19F97DE26C3912ADEC683B60DDD28809E073270C472DDF04D36A9D9A138997E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891801, "uuid": "7d638338-dd74-46e2-91a8-391e74865080", "value": "12288:P/nnjFU+QXeNqmixy9Q3coQv0AqPZdMrbF/rHV9148rO1LvCDVu58Ol:njKRONvi6Q3tQ8AMMV/rK8wvHCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891801, "uuid": "ff0e09de-7e1b-4878-9371-d63725dd0be4", "value": 1979799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891801, "uuid": "4d642f07-cd1d-4690-92d2-55108f429064", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891801, "uuid": "be3e2af9-02a5-435a-92ed-971660dd0800", "value": "eq8e1l4b0qjd22w.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15866224-1a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772890777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890777, "uuid": "38bb5ea8-3ef0-4136-aaf5-dda96bf29db5", "comment": "Malware payload (PureLogsStealer)", "value": "9fb7bc3b49c38251b72cd356329b5ef6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890777, "uuid": "be8c1246-9148-46b2-be64-1cd4ea4c1dac", "comment": "Malware payload (PureLogsStealer)", "value": "78619458a4cc2bd00c4a58745d262d7c3fd89f0e4126e97bf24d428ab9944cf2", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890777, "uuid": "a7cca4dd-cc36-453f-91c7-4bdc1048a462", "comment": "Malware payload (PureLogsStealer)", "value": "e53448233820ce609ab25030c0bfc46b081a1a2a", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890777, "uuid": "4832dfa7-a282-4e9d-8955-6d2939d4e8c5", "comment": "Malware payload (PureLogsStealer)", "value": "34ef612411621b4e456e0423cc0751b52b6c29e73d13d1c44188708daa80ea496423531410bb60605144c0d60e9e56f1", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890777, "uuid": "f9077ff0-5c75-4cfb-898f-acd28d338665", "value": "T11FE63389BF44A1D1D6202C38442496A66E12DD4B6D1C11C5FBEF1FAACFF3688DE9F610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890777, "uuid": "e3322397-ecfc-4ce4-8741-9bc090dfc46c", "value": "393216:guiyBGmbIl7bY1+kUhR6+RATTG944OaZbdAdW2:guiyhZzwR6+T4/qp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890777, "uuid": "1d1e029b-2510-4e3b-9d2e-8a5af35ae7cc", "value": 15001600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890777, "uuid": "4850c577-d444-4773-8e8a-fcec2ab379a3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890777, "uuid": "a045888d-862d-44b3-96df-4fff85622461", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00de6725-19f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772868408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868408, "uuid": "670ce64e-8f5b-4944-8ad7-a13d99276d3f", "comment": "Malware payload", "value": "67e5e1afb8019d76debc52ae52c03a24", "object_relation": "md5", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868408, "uuid": "e4bb0b25-8a5f-4da4-bb32-697e7098e570", "comment": "Malware payload", "value": "79054ad80239289285289f34dbb3fac9d7a0d5f28caa99252827506e91c29d1c", "object_relation": "sha256", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868408, "uuid": "c091ed06-ddf4-4245-9fc7-b6e0ea003403", "comment": "Malware payload", "value": "b1d3fe098a6eea8588bbd79137d4775631c512f2", "object_relation": "sha1", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868408, "uuid": "04e78f68-db2b-4ea7-b15e-a895c757b8d6", "comment": "Malware payload", "value": "d5e5d45d2cb73e3dae4a3490dff4c84e91eab5da2ab651a802ab0c2f9fc0be6814330d32578fcf7e1c0dd7bdc1d33741", "object_relation": "sha3-384", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868408, "uuid": "5c58d337-b643-41fe-9bd7-856a15812d56", "value": "T181A011A20228A3F3F8A02202220B280EA32280C220802820B2230380AA002AA0A0800A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868408, "uuid": "73134899-c871-4ce1-aedc-0bb974fca1ff", "value": "3:oX6rOYMoIGauaaFL/KdJEZn:oXqOYMoIG/hFDKdJEZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772868408, "uuid": "9966e6e5-39c0-4fab-859d-59e5a8f6a376", "value": 77, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772868408, "uuid": "3eea4bc6-0e08-44bf-bf9d-70c5c903b518", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868408, "uuid": "147d145e-e0da-48d7-9691-9fc0282a179a", "value": "79054ad80239289285289f34dbb3fac9d7a0d5f28caa99252827506e91c29d1c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28486ab8-19d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772852153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852153, "uuid": "9161cead-90e7-48dc-a617-3fb24d648672", "comment": "Malware payload (Mirai)", "value": "5cba114f28e7a560e1d5b5bb4fa3cc98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852153, "uuid": "e3053333-0809-495d-b769-3e4df826cb20", "comment": "Malware payload (Mirai)", "value": "794f475f14bbab00f7a8b1d698f9919f0ec81b07c594507f702382c4006ad08e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852153, "uuid": "9b986cd8-6ad9-45bd-a771-9de9ac5a555a", "comment": "Malware payload (Mirai)", "value": "a37be2e729f6ea0c210f3d5ca1e6e7aa1fa0cb33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852153, "uuid": "be043537-219d-44c3-b095-db7b8f5bfef2", "comment": "Malware payload (Mirai)", "value": "4c9fd8f8efa50211688641720c6de3928c07c51c12d28da40f3518b960edc6c1d69abff887dd7ba138dc7683a59e8bcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772852153, "uuid": "2358617c-7be2-4aec-8b08-99719a29d595", "value": "T18124A75E6E228F7DF668C73447F74A31A76D23D627E1D684D2ACC1101E2434E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772852153, "uuid": "f0caf12b-d33b-40e5-8622-ce7792e48bd1", "value": "3072:ufcgRj0E+1s91YrfcWYsvvH95DZ/H9DRWxeQbB0AigxvS8JRC:ujonsnEfJvvd5L0x/beAzvSW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772852153, "uuid": "889ad2d4-2a7a-44a6-a797-49cbf176b6a2", "value": 225176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772852153, "uuid": "03061fac-c8a1-4569-846e-a5c2fa4b857f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772852153, "uuid": "c173aadc-a68d-4280-bd1c-fc9237d9aa75", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f8135d-19f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772868261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868261, "uuid": "b6be8660-9777-4afd-8e00-65a1ecd5bfaf", "comment": "Malware payload", "value": "f2e4f83e998b320b43b4671192917a85", "object_relation": "md5", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868261, "uuid": "a31bbe09-c486-4a0d-881c-1935124cd907", "comment": "Malware payload", "value": "79cd21185c51a5bfe2cfebdc51e14b258d91549fc0e4e09b6939c2a8a1c5ac19", "object_relation": "sha256", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868261, "uuid": "04f77ce8-02d7-4591-9dec-e01d9ef01f6c", "comment": "Malware payload", "value": "f8a2fb31dfadd1130b0470854cc055e72351fe3c", "object_relation": "sha1", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868261, "uuid": "127d827d-7384-4f9e-bd54-d3f08a3bbe32", "comment": "Malware payload", "value": "e0bd79ed702630a166b618470822f18a988b139023b7652ab76be039ee00bc00029370258a66f1283a3264cf1a078800", "object_relation": "sha3-384", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868261, "uuid": "deb06038-6e5c-4164-9c48-8795c9479476", "value": "T18BB59031B75DB071D59A413DA1F697BEAD39F9470314CEC36AF07A9588308C2AA393C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868261, "uuid": "7420d126-c0cc-424a-8af4-7ff1c271f3cd", "value": "69e004cacee9f778c72033e650a87caf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868261, "uuid": "e70a6c82-8db7-43e2-97bf-a6e691cc8c07", "value": "49152:WaKHm1tiaBTYmhrYdlCu7uBAp51b8vPr5LsYSZq:WaF1hBTOdlH74C1b8vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772868261, "uuid": "f246d465-9435-4317-bdac-3c261c3dc01f", "value": 2493968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772868261, "uuid": "b371acf9-3f2b-447d-a8a1-45dff030e923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868261, "uuid": "252b2a9f-97e4-444f-8483-4a97f94835e3", "value": "79cd21185c51a5bfe2cfebdc51e14b258d91549fc0e4e09b6939c2a8a1c5ac19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de3d36d-1a54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772908615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908615, "uuid": "ce4c16c2-97cc-4ced-8f54-dddcfc9dafbd", "comment": "Malware payload", "value": "1a6462c84c916bd2088e2ba5b39062fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908615, "uuid": "492e3389-a03e-4db9-bd37-eef58436dbea", "comment": "Malware payload", "value": "79fc3da9b21349f2c77195a287374ece5a1978b07ca3f61bd12ff4657048d48c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908615, "uuid": "c8503126-2ffb-4779-84ce-eb47389d69fa", "comment": "Malware payload", "value": "14f8bce9360c323b400e3afaa6f1c624439b91c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908615, "uuid": "63286ebb-cc05-4ac8-8418-d05593312f10", "comment": "Malware payload", "value": "ba5e213a1be1ba5b3cf17aaee8774a2c5030fccd3da5edd564161fbad76becb1d456453b964b41188463dcb0fe7ad62e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908615, "uuid": "51f4ce4d-ec46-4ba4-96c6-e7102f6a91bd", "value": "T186B78C0673E601A6E5B3D2388AAB5103D773B4675730CBDF315C03642FAB6E49A7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908615, "uuid": "25476e40-0d22-46b0-bde3-4d454bd453ce", "value": "bfdf360405e2a60f93db21d6a40d07ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908615, "uuid": "6d3a6641-daf3-40df-91c7-da90f7f44536", "value": "393216:M6F3TI9E/wpw2/pblsj7KfEfJInv3lMz5/oZxGsnxylfyYr8BUkpcI43Xr3/hIxQ:M9HlkOm6QXdIxO1MiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908615, "uuid": "0d50519b-d61b-4c56-b366-c5255e69c8c0", "value": 48609042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908615, "uuid": "39dfca41-994d-4ab7-bcb1-ac31ef30e445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908615, "uuid": "999a22e0-9312-4faf-a195-3b404c320c0d", "value": "1a6462c84c916bd2088e2ba5b39062fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0a76b7-19cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772849987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772849987, "uuid": "0585ffcb-f5bb-4611-9cff-00acf861423b", "comment": "Malware payload (Mirai)", "value": "c6642f362922aa33adbb40bbac2ded34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772849987, "uuid": "1e5f0f92-999a-4a36-8db0-dc55525a58fd", "comment": "Malware payload (Mirai)", "value": "7a3267f244ea2a3edaee6b4016e7a9e6e6573ac786b56e70114819c351590ddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772849987, "uuid": "17d01dd2-de85-4998-b819-24690c8137f8", "comment": "Malware payload (Mirai)", "value": "bee3406e9f715754483300e09ced4d89f3236fa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772849987, "uuid": "2534485a-77c0-442c-bbe6-eb4416cac5d5", "comment": "Malware payload (Mirai)", "value": "25093581a18e08934bbbfd223a5679643a116caa86406f99d5acb3c3b51634eb1961af4cf2aaeba0289d61084258ea9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772849987, "uuid": "27964ff0-d5e4-4362-b786-bdca47153edf", "value": "T16FF3F745B8519B17C6C516BBFF5E42CC772A2798E2EE7203CD256F20378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772849987, "uuid": "5b8e7b61-810e-45c0-bc91-409b8c9c3d28", "value": "3072:348PX40ZbWAJkzBLuHX/89WT5l4/kwQ3NjxOUfN/o:37PX4WbWAJkzBLuHX/89WNl4/xQ3NdpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772849987, "uuid": "90be05c5-8916-405c-80fd-181d5bf57269", "value": 164728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772849987, "uuid": "b84d5eb1-15d5-4e24-81a9-3b17f3fb5cef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772849987, "uuid": "8bd7d550-58e5-4ac7-8ff9-9d6ef53550ec", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a7895d-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772865378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865378, "uuid": "d880dacf-ffc7-41b6-8eb2-fe1b3ca96764", "comment": "Malware payload", "value": "731668aa7bc2c33b9923519209ceb958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865378, "uuid": "7d1cb169-07fc-4136-b62f-5c3d3033e3a5", "comment": "Malware payload", "value": "7b0da57bf5987bb3a63de1f8ebaee5505e05f691984dfc03218ea29daa8440b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865378, "uuid": "b049dfd1-702e-437b-90a3-2dd2585b40b4", "comment": "Malware payload", "value": "e0707f3877c8891c93ad57386dfd208e58614761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865378, "uuid": "7e3b7f25-f787-4c21-896d-4ba263822cb7", "comment": "Malware payload", "value": "75778664ee3a7625e2ba7fa72b6b1f6e9a3704961ab3c31c9460863b422ab5f76ed5c703500c3e33dabe6b9eef5c0879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865378, "uuid": "cdb747c7-5fdc-4850-8ae1-83cb092056bb", "value": "T14B052C7E5962912ADD8A80FC35594B6249B1B33B03B41FF300A6913167179B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865378, "uuid": "ff49fb8f-f0ef-4d7e-9b5e-72c8d0e9423e", "value": "24576:8LYLjX/atV0GAbTzUcO0Kp7+wh0m1Ovb9NYTf:8LAvQVZAwhR1OvITf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865378, "uuid": "d7bb27d1-716e-4ea4-a67f-3efef483c88a", "value": 853376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865378, "uuid": "dae3bf65-fa6d-4e79-b47c-b13c84b44653", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865378, "uuid": "7d6e61c2-d2da-4e2d-b33e-7a2728ced155", "value": "7b0da57bf5987bb3a63de1f8ebaee5505e05f691984dfc03218ea29daa8440b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e02ae3-1a30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772893056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893056, "uuid": "83c740a5-ec4c-40e1-b4ad-31562c9fe3c8", "comment": "Malware payload", "value": "1fc5c20bfe421edea44b564f362f86d6", "object_relation": "md5", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seventhvictoryira-com", "colour": "#B6AED4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893056, "uuid": "764f095c-72cd-47bf-8155-bd4cfa75e9d3", "comment": "Malware payload", "value": "7bac71aeae6a58c2a287efe6a983f431671bb02eb1f2b229b2ff4b4501e5d34f", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seventhvictoryira-com", "colour": "#B6AED4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893056, "uuid": "ace2b47d-519a-40b5-a89f-72b97ba324de", "comment": "Malware payload", "value": "8755d991b5e035460098ebde9ada50569eebe965", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seventhvictoryira-com", "colour": "#B6AED4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893056, "uuid": "5785440c-3a29-4b3c-8ee7-32ba759e38e5", "comment": "Malware payload", "value": "b9693b677574f909454130d091fca1ef7ab1f630bc79bdfc87a3e59a5c2937153ca088c7f57a845ab36ea9cd82f6f262", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seventhvictoryira-com", "colour": "#B6AED4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893056, "uuid": "d1eb6575-d6a1-4980-8e9e-d98b0a550159", "value": "T172F5E03CBEDE53F1D5A57FB6A6A16100BE947C40DDAB41ADD464F2C80C368037A39A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893056, "uuid": "f029bfa7-4875-4770-b834-83df29d63c0a", "value": "49152:1rbvS7tZjQa6kGU8gzVV6xZkrZt2F7Wx3JQJ9XnC9M+Dribg5SIun5dlO1CFKEro:1ruwkVzP6rMZt2g3JUBn7JhIun5DjY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772893056, "uuid": "ae06b966-a4ff-4553-ae39-3d0b1644369b", "value": 3496392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772893056, "uuid": "2da51ae2-9f5e-4c87-a6e6-40e217d78091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893056, "uuid": "b03b6fed-f0e2-4d05-b8ca-adfbba9ffdd8", "value": "Blox-CDT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9893cd7-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842170, "uuid": "d281bd56-495b-41bb-a5c1-00f3f5cce03a", "comment": "Malware payload (Mirai)", "value": "e3d89877913cee6a822cd2d3df4982e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842170, "uuid": "b560fbeb-f9a5-46f2-aabd-282396dd50b0", "comment": "Malware payload (Mirai)", "value": "7c25983d8fbcca69654c830b27afbd86f548d4454b9d4764b93353b47ed7c6e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842170, "uuid": "34f82b7d-a95c-4516-8628-a2b487cb97c3", "comment": "Malware payload (Mirai)", "value": "4e5ab1bf98dbd1fe7191a69d41c613a5b95ab2f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842170, "uuid": "af5e1118-193b-433a-8452-9f8d42a8c5e6", "comment": "Malware payload (Mirai)", "value": "2d8786b406d5ff0f85e27615025c825486ab9083aae318441375e3d851ccad4893f61300685d45e2b95e7757aea2fba5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842170, "uuid": "1d203cb2-d8a0-473c-89f6-ca7081b7630e", "value": "T173143A45BC815F27C6D122BBFB6D418D372A27A8D2EE32078C255F21778A85F0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842170, "uuid": "794432a8-6e80-4524-a495-8502218c53c1", "value": "3072:tlatRDblRmFt3fVyKPWX4/sskcpSGh1rCw52:tlanDmFBNPeX4/Ac481rCwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842170, "uuid": "9e3db0f9-130e-438f-8563-4ee3baf3563b", "value": 193344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842170, "uuid": "407098ec-b977-4720-acc4-cce2cbf0c047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842170, "uuid": "091da514-4097-497b-8b19-1fc2e19c84e1", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60c1757-1a02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772873464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873464, "uuid": "a2e6ec21-1a26-4e6f-9c86-d78208419125", "comment": "Malware payload", "value": "e9815216a4c6e4fcff85ab3c86452ab2", "object_relation": "md5", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873464, "uuid": "c641effe-a6e0-47bb-b403-a4cbb5a2de18", "comment": "Malware payload", "value": "7c529a18ff39ed48bc5d816c5b80ddb9ea59693afd5a14f7130813385aa311c4", "object_relation": "sha256", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873464, "uuid": "89beb7e2-a93a-48c6-b153-fce4e79719de", "comment": "Malware payload", "value": "7f6063d12bb051bb647933d83b1fb4e426a890f3", "object_relation": "sha1", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873464, "uuid": "c735da70-8cfb-414c-97f3-e6c659461199", "comment": "Malware payload", "value": "608ccc999bde8f372304a9c5a5e8788fd360f11430668e486aeaaf4b6183a168a6504b6a95accb00d18b72e6d1f1500c", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873464, "uuid": "03a1f10d-2428-4439-bfc3-2cde573a82ce", "value": "T15BE4F12067927A0CFEE78B70A41D46042AAD8A06535EDDBD5B193730BF0A691FDD83C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873464, "uuid": "c01946e8-23be-4323-b591-1163fe2e93d2", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873464, "uuid": "2caa2cb9-1138-43a1-847c-ef380c3238b7", "value": "12288:1EpCfXVrxbsm8I6BaGSXvu7pPCnX6bGiroLFiV5Pc2nkXsYQbbMS:1E6XVrxbz8FBaPWtPCnKboFijEskUgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873464, "uuid": "11b11c43-042d-42c0-bcbb-c3803bc5ce34", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873464, "uuid": "994a15b5-9c26-47fd-91b5-de0909c78854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873464, "uuid": "bd30881f-8393-4d7f-85d9-84068dc8d4b2", "value": "7c529a18ff39ed48bc5d816c5b80ddb9ea59693afd5a14f7130813385aa311c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da50dcc-19ce-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772850901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850901, "uuid": "f1ea2130-ac87-4772-b929-bb4f8a72208b", "comment": "Malware payload (CoinMiner)", "value": "ac65b89c09bbb53406dad3d42915c231", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850901, "uuid": "6bfde2f2-0b4d-44eb-98a3-61e390ca63df", "comment": "Malware payload (CoinMiner)", "value": "7d6032764df8e706c458e663e5501ce627e4f2985c16ea61e299f2ac429cbcc9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850901, "uuid": "893b915b-8c63-4065-b5c2-8b0ca11c5735", "comment": "Malware payload (CoinMiner)", "value": "ed2908416e2bc881e12241b46a30be5c38270a58", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850901, "uuid": "ec7e235f-92e7-4713-9cb2-2f8ba0d2190c", "comment": "Malware payload (CoinMiner)", "value": "bf017ced7d31c375a98f8d0fb36ac691c74d3e694b3e55f7d480d838f6ad9310046d1196b222c4935078652b703435c6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850901, "uuid": "06652fef-f200-4bd3-9835-eae2f5ef191d", "value": "T18E5533F1D73B8258F9F250666AFA424062B773B37A0CF9360510BC6C2564AC6E60B5E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850901, "uuid": "53872a76-4174-4596-8fd0-2adbd2bfafb0", "value": "24576:5IrSo8lbGgoJWdBfZlTp8hz5bWTLIKV6x4WjyBgZbMrdo98hqrpi+FBOjMQM+:5IrLqbSJM5ZlShz5uIKVGvjyAD9kqrps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772850901, "uuid": "7af95377-4213-4fa0-8bce-d052e858f4e4", "value": 1309300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772850901, "uuid": "c076f2ce-b8fa-41f3-b439-4e8b26def130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850901, "uuid": "e9527bb1-cc89-4697-9f76-34db4822948e", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673f44fb-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871157, "uuid": "09329d44-c517-4456-866b-163efb010869", "comment": "Malware payload (Mirai)", "value": "63e7c52fbf81125770b38ae57f5c49e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871157, "uuid": "89afa52e-b28c-45e1-8799-e2888b737a5f", "comment": "Malware payload (Mirai)", "value": "807dabeeeaad8354828c3de43fb2a2084dc63a53e6816459b3be29f6a877f15e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871157, "uuid": "bc31941e-3e39-45cf-9e52-d335a118dabb", "comment": "Malware payload (Mirai)", "value": "9c8376fa784c700f9bdb315ee2ea68a274232f94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871157, "uuid": "298069b2-68fc-4576-ad4d-d3a0701e6550", "comment": "Malware payload (Mirai)", "value": "4cb542b2cd66ba30fcbc6273dfe00bff10bb7ef05d2c82fa0ff70445a84ee21d90e73cbefee659866a94a2cb8410ac6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871157, "uuid": "628aa24c-44a7-4e8b-856f-cdbd4bc0db5c", "value": "T100736B01B3984A43D5A61DF93D3F27D543FFEE8112F4A184A80FDA4A4370E73555AEA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871157, "uuid": "a5dd6689-a00b-404f-ba49-c03a3f78e0d2", "value": "768:O3i6CnKZuGq0WQI2Ir7rqicWb3D6VP4nWbY9Ih70fHLodDMJgYnIATBFtMtC9lN2:yi60TouMADIBWrqDMtnI+JMw9lZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871157, "uuid": "cd4264e8-6dda-4d4f-83be-2b1e8f03e6d1", "value": 80116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871157, "uuid": "a17588b6-7782-4e26-a6eb-5cab6ff3ff24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871157, "uuid": "3216cfd6-a906-42d1-bd7b-e5252b352ed4", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166d3712-1a3a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772897221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897221, "uuid": "db71a5ef-45c4-4a31-baf2-67f5101152fa", "comment": "Malware payload", "value": "617cfbfdb2a0e8bf20f6313b14640318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897221, "uuid": "fe29591a-daed-4706-9a85-76c24ec6844c", "comment": "Malware payload", "value": "81ab59bf327a28416e39866c2256dd54820e9c5fdaee411688f86a6baf648ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897221, "uuid": "9935db3a-3654-4f58-9841-da103ce32aba", "comment": "Malware payload", "value": "f67e2d769de84946da54a48e47a6e2caddd7a412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772897221, "uuid": "30e4053e-3292-4de2-aa5c-9aa1bc83232b", "comment": "Malware payload", "value": "0b7ae72195d5fee96c2ce4388db51962a394fbabfa9c03ab3f959fa9464962536c05909fdf519c79fb9ecb4979485941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897221, "uuid": "99b9d002-14a9-434d-837b-b3cd9d8ef681", "value": "T1AA26339BB1EFAEBAC597D132CDF7F2D60A1E1849C0CA66A131EDE94431C03D40A68DC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897221, "uuid": "e38d1ae9-c046-4b61-956a-b69816b2684a", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897221, "uuid": "8db17788-c5e1-4c60-bc17-9c8462d357b2", "value": "98304:L9pZg5W5y9GhNnOs960ijj4fkGwLZP9uA8Kt9:L9pWWJCs9cGwLZ1D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772897221, "uuid": "c77fb4b5-2dff-48af-8b29-e5435a867b81", "value": 4544512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772897221, "uuid": "e406b338-918a-478f-b46f-73ebd9b16fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772897221, "uuid": "1da6741c-87e4-4287-a104-6e004ccdbbe8", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.24247.9545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0ecfb3-19fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772870846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870846, "uuid": "38faba75-c006-448a-b71a-d2630e6c68c0", "comment": "Malware payload", "value": "0deea247e6180a569ef977047c69cc13", "object_relation": "md5", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870846, "uuid": "506f45cb-b230-452a-bfd9-6c272aa36a30", "comment": "Malware payload", "value": "823472db83668a4995bc42274b0e8f38d092577fe0d1a648a23495332a911035", "object_relation": "sha256", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870846, "uuid": "02facfbf-0256-409d-8d38-37d873d12084", "comment": "Malware payload", "value": "eba07921fa82e2730ed379a6b5acc9825e059e9a", "object_relation": "sha1", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870846, "uuid": "c1a769c1-a27a-4e0c-be1f-106bdbc6a109", "comment": "Malware payload", "value": "2e38dab1cb4657bcbb62d2ffce82cbef4d5da1d46e224f61c97ff1d6428bd17d4a12b744bf7675f6d8b8b299c3f8d126", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870846, "uuid": "bae716db-e131-4816-9136-c4cc13b2414a", "value": "T1693533F5D1D85C856F6B1CE42EEFE83AA982953B57C16D3A949B81310ACB3B14184F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870846, "uuid": "1152ab02-4556-4919-a268-7ff7fb54c9ee", "value": "24576:FB/pKjdtbvs8EtSppYlZ4QV0PTQd8YVeFh2UTUzdKfwrwBoz8eQ4N:FBojdt7FG/cs8YVeGUgzZGNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772870846, "uuid": "77a9dbfc-34f7-4827-aeaa-fa3083099ef3", "value": 1061912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772870846, "uuid": "b5f0f5eb-683e-43ae-b7bf-0398aa5d935e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870846, "uuid": "4a097410-9b75-49fe-bad8-5cfa804f8f76", "value": "Defence_Planning_Committee_Meeting_13_Nov_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f73ac3-1a03-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1772873678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873678, "uuid": "dbc76991-830e-4b70-b2bb-e2ccc266c870", "comment": "Malware payload (SheetRAT)", "value": "142ced39acb26fa5e7fe13b9bd286ea5", "object_relation": "md5", "Tag": [ { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873678, "uuid": "5236fc4b-9531-4cc2-951d-70333f4981e3", "comment": "Malware payload (SheetRAT)", "value": "833b2b48c32f96f7661a14195ee7cc0542c0f8cc94cb6934a97f0ab01e8ec0eb", "object_relation": "sha256", "Tag": [ { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873678, "uuid": "c878faf5-7678-4c4a-8df7-cd4467244d41", "comment": "Malware payload (SheetRAT)", "value": "fce890a67a04992bd87db3009feda705a6ab3d00", "object_relation": "sha1", "Tag": [ { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873678, "uuid": "1a2698f5-c7ee-4b32-abb5-978353471a90", "comment": "Malware payload (SheetRAT)", "value": "2085f0cb1567bfc7af5a2d417207bab61e374303e41238593c43ed117c76597fc65bbbfb8cbeb4a45e9dbf2943758409", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--adyvot", "colour": "#E44827", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873678, "uuid": "261129ad-608b-498d-98ba-8185c7263387", "value": "T16EF533F61763042F489592BD74F4BFB2895603ABE0825C8ED4B8F2DE6D7686136E01C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873678, "uuid": "1f53b25b-4c30-482c-9a28-aeb87a1639fc", "value": "49152:A38jTc9ws54Cldg8kH93tmrPU6vyBmN6aQJ/Um0DrPVo8u3SVnm2f7SUQ1qT:Ng9RR1guPU6v4SmU53No93SVm2jSUSqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873678, "uuid": "61b82425-25a5-49f3-b907-5bd7bd547475", "value": 3469885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873678, "uuid": "d4cae31a-458c-4c9f-91f2-cce775b50e74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873678, "uuid": "3179c444-2586-45cf-8f1b-1eb8ebf68c5c", "value": "update-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c877908-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871166, "uuid": "6fa8e594-11b9-446d-8350-56b1cfe94b88", "comment": "Malware payload (Mirai)", "value": "cccb375bb656dca931e64bc88fbc2c13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871166, "uuid": "f2533ed0-b7e4-421f-beb5-37773d643482", "comment": "Malware payload (Mirai)", "value": "833dd72bef3fbe5178f63547739a6587c13a20a841ad4337e63f519b9b6f7245", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871166, "uuid": "5bbd88e0-15a5-4e53-ac6d-50b6b7688157", "comment": "Malware payload (Mirai)", "value": "7a17cb978548b858729f19c0d3b9fb2cad6f2e7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871166, "uuid": "eb0208b9-f324-46a8-8fcf-0d586338723c", "comment": "Malware payload (Mirai)", "value": "f7cc3b220f12f89a56da59de9835f0ccf875c52298bcfb8a0f17fa4d9e5c0a1ed94fa745a7f33035d13b9016744ee47d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871166, "uuid": "fe6e8e3d-4960-44ff-ba56-f66e0c49b921", "value": "T171B3F80ABFA10FF7E8AFDD3745992B05248D551621A93B79B930D828F25B24F15E3CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871166, "uuid": "d7a9e4ad-6013-4f1e-8ffc-f8f299d85744", "value": "1536:1iwGfcz7rhq5A/muP2DwR7GnCWz3ltLGpZawY3Ckqe/:1iwG07rhcAJP2z3lt6prS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871166, "uuid": "d94f9865-ccbe-4a83-a794-d0dc0b12501a", "value": 109312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871166, "uuid": "139f54c7-ea41-44df-8107-921fe95d4678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871166, "uuid": "051aa1e3-2f54-49a8-a0f9-59f99d986f95", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2396279-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772865350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865350, "uuid": "57e3874c-2e3e-4de0-9a8b-5445287d9b44", "comment": "Malware payload", "value": "336487d4c344715828573b26d0d9970a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865350, "uuid": "7f31c751-abd8-424c-9e12-2c5aa4724ec5", "comment": "Malware payload", "value": "84682f0ce66f401e3d335ebe35fe94c357c74ca491f7f14eb4d021e960477baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865350, "uuid": "01ef6902-6a69-464b-a177-ce90cb417cd3", "comment": "Malware payload", "value": "f05b4ac8d471daafc726b93e85c88aa97cdeac6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865350, "uuid": "c5215c48-34ad-49a7-9320-1b11e834fa93", "comment": "Malware payload", "value": "4e1c0035bb5856fb4ddb3e7e2601242bf9f561185952b1f8205a421e86a0ad3a6fa54298c8bb1bc78bfcfdd802126176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865350, "uuid": "eeaa32ac-643c-422f-b5fc-a2439f312941", "value": "T105051C7E5D62916ADA8A80FC654A4B624971B33B03B41FF30166C13067179B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865350, "uuid": "8e045a2b-a42e-4ebe-a491-a6eed757852f", "value": "12288:ovXzsvF0r3y9KoPbW7nMtY0hb8DGIu3NvPxPgKvYUt09S6TS4CDOqu35:ovXzgF0bMrPbW7Hwiq5z0HQyT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865350, "uuid": "60598f01-e326-44d7-8c23-f1c87c54eea6", "value": 840064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865350, "uuid": "156f3032-7d99-4556-8304-f83ce2982b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865350, "uuid": "c43f34ad-68c4-4202-9482-55b3c1888433", "value": "84682f0ce66f401e3d335ebe35fe94c357c74ca491f7f14eb4d021e960477baa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05751fc-1a7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772925020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925020, "uuid": "2e138864-2414-498f-ae0b-782585f60d1f", "comment": "Malware payload", "value": "db8b519b3bc88206a3da1d8b3ca261ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925020, "uuid": "04896181-1fa8-4730-85d7-6d781a6381b8", "comment": "Malware payload", "value": "850be6ac28c99a9957ccbd67e75427e1c783b4aa50b838bb58cb311fdf51a5a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925020, "uuid": "2434941b-e19c-466a-8c96-3df0d95202e2", "comment": "Malware payload", "value": "fab7675d38d3ffdb2b199b66f449e3737bacbe17", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925020, "uuid": "271f67c0-31fd-4876-a7fe-752abc010808", "comment": "Malware payload", "value": "c568fae912905df32d4e676b30656538f921d4409a1d5f6835b919a795f6d2a0e5c5ff595a185206160f54abc42df63d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925020, "uuid": "6a98d400-7774-4802-befc-ce1c456e3d8b", "value": "T166E068AB3288B45855AB27D4FB490D979CBE276578C4C7B1803C51A02E003FC4119CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925020, "uuid": "65aba108-0869-4d96-8b0f-a9c8982b8ea8", "value": "6:uk2IqXffzCtjg1mttVlOA/CLOPFF3q+th0ZX29HLCPHl5wSvsxC1YEwwzP8KMCUc:ufVXf2K1mtXKUJthYsHQlRvGQwWbDzmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772925020, "uuid": "4f7c2cae-67f0-499d-8bd3-602187d88cc5", "value": 394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772925020, "uuid": "ca309123-58d5-4c2d-a165-8b87af71b534", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925020, "uuid": "da55cf1a-066e-426d-bf1c-2057f1d61d76", "value": "ffcbffea33c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61f0279-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842110, "uuid": "8c30615b-3531-449f-8df5-afac6bb636d7", "comment": "Malware payload (Mirai)", "value": "169b35edb886253668defb0308fa128e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842110, "uuid": "973b0ca5-2a97-4cad-b0a0-362a60eb6a8a", "comment": "Malware payload (Mirai)", "value": "858d9659183cb8eaea14a8a391ef319cd723f1b6e5dba04adbfb799c8e3bbd73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842110, "uuid": "f3483b51-e64f-4bb1-abcd-def6ab427599", "comment": "Malware payload (Mirai)", "value": "f261ceed2ed80e01fa4fb43d8309d426f9cce50c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842110, "uuid": "e00e285b-5618-4fb3-921a-4a7f73e69bdb", "comment": "Malware payload (Mirai)", "value": "a7b7e35c7cd911087d28617b858d2ea5b4adc190fbbff5c895fc18aa3d16d0cc1251303bf4a2b569a247453f75cad15a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842110, "uuid": "09be3462-6a3d-48b7-bbab-5625fb58789f", "value": "T1C96302ED62FD2E35E7F23BB5D4AD98812B6D0DFCCA711B383C640761591818FA91848B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842110, "uuid": "f0ec5c01-8bcf-49ca-bb59-80b2977a3110", "value": "1536:S2vblfb+bvzRmT5JmpENlL/IOk8dt0ucb+8XcIjcfQQiLDLzo:SklfbqNefMENlL/I96t0r+8XcIjzV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842110, "uuid": "ea05b881-92e9-44fa-a52a-1b4535b408c4", "value": 68584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842110, "uuid": "d78384f3-a865-40ee-bc29-04fd164b624e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842110, "uuid": "e2894d70-5c30-4a1e-bdfa-1f3d9e9a0a3a", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa2793e-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772865400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865400, "uuid": "336d0c5a-ccac-4af1-872c-688607804f29", "comment": "Malware payload", "value": "ee9c8f12d34fef001f8f69aac197b005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865400, "uuid": "479dc5ea-fd67-4c04-9e3e-4fa19379fdb7", "comment": "Malware payload", "value": "865c0e1ce96ae6ff4c6f27f3dfd662b8f21210c4eb3256cd84935f765c82aa62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865400, "uuid": "cd88cf49-86b8-4dde-b6e8-ccbe8d6575d6", "comment": "Malware payload", "value": "55ca676bb324911e6f8560530f9f28683bad9f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865400, "uuid": "1a91da60-5021-4732-bc1d-6066070ab33e", "comment": "Malware payload", "value": "3bd5435a7d9a9ac537fcd3a30301ca919560297cf49e63ac1f83b5ba405d93fa1e46efb4de960930ac48bf00b22623d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865400, "uuid": "03e9728d-cc22-490c-accb-1df23a741788", "value": "T16F052C7E59639126D98A80FC35594B6249B1B33B03B41FF300A69131671B9B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865400, "uuid": "0148fae7-e101-49b4-9bc7-34d2f52d17e6", "value": "24576:3eGL8T6btk5UUWyMHz5PxEpRDr0aKjfPVvjITJQ:3ehmBk5iDLfPSTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865400, "uuid": "1c932c5e-d229-4b24-ac0f-0e258ccaf43e", "value": 853376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865400, "uuid": "b15cc1e6-67cd-47ad-8851-61c513954e15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865400, "uuid": "9b354e3a-8b2c-4370-806c-f0b3810e2e5e", "value": "865c0e1ce96ae6ff4c6f27f3dfd662b8f21210c4eb3256cd84935f765c82aa62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6173586d-1a2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772892622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892622, "uuid": "b476e719-416d-43d9-95a1-e60872212f64", "comment": "Malware payload (Smoke Loader)", "value": "e570255a304227095bd635a92f9720ba", "object_relation": "md5", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892622, "uuid": "395f8484-9ca4-44ad-a138-9f63d0067f41", "comment": "Malware payload (Smoke Loader)", "value": "86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d", "object_relation": "sha256", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892622, "uuid": "e3de4e23-2617-413b-8f60-cda40177b3e7", "comment": "Malware payload (Smoke Loader)", "value": "cd8bff9f9492a6c114af35708b0f1c0372b91656", "object_relation": "sha1", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892622, "uuid": "fb6cddc9-bba6-49df-971b-a71fbbe39fc0", "comment": "Malware payload (Smoke Loader)", "value": "43de0521bbdade38bcb374a6241caf7f765d165b016658e2c90c57584feb36fc9f186675665cd9f11974831814e9e242", "object_relation": "sha3-384", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892622, "uuid": "f050afc6-a869-4db6-91bd-9edd28482157", "value": "T1AAC501322FDE5132E4AD73B4D5E17A05AE787D90E5944AF9E4A862C90C758003E3ED3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892622, "uuid": "2ea57ae3-54c9-4d84-a2dc-61013d4e1887", "value": "49152:VljSvNCIk3PJSH6jypriqNP0WyvDtLH0/cvDhNlulRYQTeKADxJryXEQ9V1dIjnd:QNuxSH6u5iwOR0/ihNwlTT3KqXr3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772892622, "uuid": "d750010d-22af-4255-b560-c9a7a0059a86", "value": 2711000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772892622, "uuid": "4df20ea7-53ff-489e-9281-ca44f5dc823c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892622, "uuid": "2fffdee7-1cb2-4102-bfb7-a96070d0a258", "value": "Qtum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9276ff57-19e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772861781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772861781, "uuid": "02917a27-381a-4755-b40a-8c4de15d0ecd", "comment": "Malware payload", "value": "5300f118dff8330345ecdf4b7d373edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772861781, "uuid": "15dffd5d-d39c-4c5a-93ee-4d65ff5ff95c", "comment": "Malware payload", "value": "8c64037a916744a78e8fd273273ec4e3223fc2d2c1f79235b746a62c644d1971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772861781, "uuid": "c526edd4-156c-4ff3-8015-2bc9496b50af", "comment": "Malware payload", "value": "3f01aa2b89f8a80210934e353677a5229bf8e2e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772861781, "uuid": "4f69a29c-4d3d-4508-88b2-f2079d7cdb91", "comment": "Malware payload", "value": "87f537f8b07c3b0c8c13daa45b09449e52442b4ccd42fbb3c2cac0323b9053cf5711b8f445cb247ab1aaa2420a0158b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772861781, "uuid": "85a5f319-4e74-4ad2-a8bf-d6ccf7231252", "value": "T1632633A150D3C75AE14314327973B4B7C8263C60C5DB97BA43FA4590A9E73E81A2BFD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772861781, "uuid": "ad4ea747-ad0e-45e3-9879-3b9743bcaa3d", "value": "98304:tv+yBxaeJSOF2RXAGK4D49dtVeaaV/JAbn:tv+yGeJSOmQG09Vea2RAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772861781, "uuid": "6d65fdc2-ce9e-47ca-8f70-929963491cf1", "value": 4629504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772861781, "uuid": "074adef7-b23a-4df9-b433-81a0b20a641d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772861781, "uuid": "fab75998-a11c-41d4-9667-e198f2b8b4b6", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.32175.16962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c81dac-1a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772890729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890729, "uuid": "98ad98ba-2932-423a-ac22-f9127d2b4ed1", "comment": "Malware payload (ACRStealer)", "value": "7c991c85ab6f90b2c25c541da33a2cd2", "object_relation": "md5", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890729, "uuid": "16abd469-77e1-4052-ad33-16f90d722c63", "comment": "Malware payload (ACRStealer)", "value": "8e6bc92bf150ecb9f27400b21dd2c4392248aad8dfff04e7c98b3183013c9e64", "object_relation": "sha256", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890729, "uuid": "a55562b8-dd46-4b1e-b4f2-160d1b76c169", "comment": "Malware payload (ACRStealer)", "value": "e6ffd01eb7938b93357e88cc9a561edd0dcf3a4c", "object_relation": "sha1", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890729, "uuid": "a1381bd4-4d1e-42bb-a720-ed93af195bf7", "comment": "Malware payload (ACRStealer)", "value": "af1d6c1defe475b14eeca85e7cbf988aadd7889a4e7bfad9dad0d1308d45dd164a9e935c23cb4a41ff25f4e6f4028241", "object_relation": "sha3-384", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890729, "uuid": "c91cdb65-4144-484f-8bd5-ad8e7bbc6dec", "value": "T15FF69D236D808275E5DA61FA86FD3B6AC86C8A05033590D795C83C995B319E73B3DF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890729, "uuid": "fda3ac00-a230-415d-8f07-46b3a9c52d60", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890729, "uuid": "74425a0a-5ca7-407c-8cf0-30fb81968dc3", "value": "196608:kQke5A05AXFN3delxDtPAFGfcn+hr7QhhKK+y1bLTO:kYA0aFsDXcn+B7Qhh7TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890729, "uuid": "95fe5718-5c5a-430d-8a03-d73dba0a848d", "value": 15678568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890729, "uuid": "c0f89ee6-0219-4201-ad21-016dbd9ad7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890729, "uuid": "e8442903-9bd2-491d-a302-474d134805de", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae01c0c-19e3-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772860050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860050, "uuid": "0b368da0-4d8f-4781-8e1e-aa1485bb1b0c", "comment": "Malware payload (QuasarRAT)", "value": "cce6fa5373a7a8c3804de9048073afc0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860050, "uuid": "40af895e-e156-4d7d-aa21-89bf458cd5f0", "comment": "Malware payload (QuasarRAT)", "value": "8ff80af7d51289e13443a22df16d96b6c5e6354246c5d1f3074a5e689d81dbda", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860050, "uuid": "e9a74409-d368-4703-9acd-b945e7a4e055", "comment": "Malware payload (QuasarRAT)", "value": "90de5578bf2abbebbc6ab40a9cd7b3671c57a91f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860050, "uuid": "77df5e53-2072-4157-81f6-b7d3fe156036", "comment": "Malware payload (QuasarRAT)", "value": "7826884a369be38c2232f4c6541addf6893b98bd08b60cf8a56ace4a92a9dd4ea5146782d4948a78ab9961d37cbbba4f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860050, "uuid": "d55e09fc-44c7-4d73-a553-81b552d27037", "value": "T11FF633034F6E4E6F466C21AC247F0E4E2BD84E054155BFE6F7F2789A6E8DE12105B1E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860050, "uuid": "dffcd905-1c15-49f9-86a2-71365c3c92ae", "value": "49152:9nPF49i8kS8V4/gu+zj5OA8W/+igKKFfW5gT5rG81qO0tyNk5wYGgJzJe5zg1rMd:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772860050, "uuid": "97bbf86c-daa4-4eaa-b7a9-259948ca75f1", "value": 15283351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772860050, "uuid": "2e8811d0-1cd3-44a5-9deb-12255377a91b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860050, "uuid": "14435bb6-6c7f-4c69-9bee-617d2d1f3ee0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc866211-1a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772925014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925014, "uuid": "46759978-b875-41b9-a8eb-28da60244515", "comment": "Malware payload (DattoRMM)", "value": "83d70e338162fe43b844827222a75e21", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925014, "uuid": "69a1336e-ac18-4515-8ec2-3acf27fe274c", "comment": "Malware payload (DattoRMM)", "value": "902ab3ee6746647911371e56ecd3d90dcfe3d5f79e8f6c4b1ad4384f4b26bf5f", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925014, "uuid": "ef554014-d292-4bb0-8bc4-b10b085c3339", "comment": "Malware payload (DattoRMM)", "value": "2aa9ac0a5fe814be5dd192c2afaaa51df1d00145", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925014, "uuid": "b4b80cd1-3e46-4986-b896-a2873d144d92", "comment": "Malware payload (DattoRMM)", "value": "34b08039c5ebf2b6a7747c320556a98b2d2fb38cf3384a88682c4ee143a4f960a5f13820b4b00141a50fb108c3171ca5", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925014, "uuid": "f91deb32-f884-4e02-a241-bac35d636cf9", "value": "T1C2B63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AA9D2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925014, "uuid": "64be8360-0603-41ff-8806-ace61a762c7d", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925014, "uuid": "2c031464-a18b-4a37-ac09-9ee4cafd8c17", "value": "196608:5aZk+wTP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:dnCmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772925014, "uuid": "0be352ef-69f2-4d8f-a67e-04f3c3378d22", "value": 11056104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772925014, "uuid": "e54d062e-b6a9-49ca-90e4-af6caa34bb30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925014, "uuid": "3435f695-024a-4c3a-b69c-faadebf000b3", "value": "RSVP_Invite_access_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be3775a-19f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772869017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869017, "uuid": "98fc0e65-60e2-4d2f-a3c6-b2b76b96b658", "comment": "Malware payload", "value": "73f52b47a91aa4a7967e6ad010ee489f", "object_relation": "md5", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869017, "uuid": "166ca670-02db-40af-92b4-27ed2f70a25f", "comment": "Malware payload", "value": "9045ace6571b508721b067eb56274fa9b07b382e73d698efa6b538dba1f4e6f2", "object_relation": "sha256", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869017, "uuid": "e6cb5ed4-f928-453f-93d4-695430894365", "comment": "Malware payload", "value": "920f44996aca164935d37c5b378398959574f72d", "object_relation": "sha1", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869017, "uuid": "c780959a-40d9-4bc0-ba36-7d1e7fd092a4", "comment": "Malware payload", "value": "de9084f66c6063c082f4ec88cb91c4ec4740b0e7fd69faf69ca93e734575b0b128aa6a6e8c0194ca6e7876bf836933cb", "object_relation": "sha3-384", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869017, "uuid": "ece241e8-be27-4387-ab05-b9b4e080195c", "value": "T11856335D65051E5D89370DEFFFC6103A0982BCC615B72149CBE5F36FB1AC6A8A6BE002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869017, "uuid": "ef49c385-9f7a-4c97-85b4-693fda88d08d", "value": "98304:C7Mk1+ygCHGOtN0lgH+U1G9b2bfSQDFIqnGaVrylo1KgBabr2zhowzyN:O9HlHY6Lr9nh1OqF1uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772869017, "uuid": "90e6e7bd-e2ae-4634-8229-e71394426001", "value": 6369219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772869017, "uuid": "6d3da711-b880-4a61-bcf7-de0803128887", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869017, "uuid": "693b9363-0b6b-4f87-a673-915596a49699", "value": "9045ace6571b508721b067eb56274fa9b07b382e73d698efa6b538dba1f4e6f2.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c909037-19e3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772859945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772859945, "uuid": "e4223e57-8738-4ea6-ba2a-2f62624c81fb", "comment": "Malware payload (ConnectWise)", "value": "edb9019ca46a74958352f947ba133031", "object_relation": "md5", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772859945, "uuid": "4abae678-43d4-491a-b1b4-4b1d1dfb61a4", "comment": "Malware payload (ConnectWise)", "value": "90876b3f9084e0679aac234e57dc9d82c4b09121dc3de6852491d84f85ad5f6e", "object_relation": "sha256", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772859945, "uuid": "b21adf5b-6a9c-4528-82e8-ea73204f3636", "comment": "Malware payload (ConnectWise)", "value": "0551cc4e427cb4869ec4cd827f06a490afeee7b6", "object_relation": "sha1", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772859945, "uuid": "ec100d67-2ffd-4efb-8ee6-8bfda5ac378f", "comment": "Malware payload (ConnectWise)", "value": "3edc3bfc44a3cb8a49f40562fe98130d7a02944b4b12dc7d22fcc0a5115ebdb9ce733110ce99c72a52dc40b6d1100260", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772859945, "uuid": "08fd5dbc-258a-4d86-9821-7285c98f8d8a", "value": "T1E4A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772859945, "uuid": "3204f7f8-9014-41f6-8e72-d48e99a6a86a", "value": "196608:5KaLNkbgLi4QsKaLNkbgRKaLNkbgHKaLNkbg:dWgLiHCWg1WgfWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772859945, "uuid": "35b15156-6fa6-475a-bcae-0f61cc776050", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772859945, "uuid": "b33c1d67-dc02-4cc6-8756-81370de9fb92", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772859945, "uuid": "0913d8aa-4de6-4454-9bdc-95487b8ae20c", "value": "ZoomWorkspace.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4634faa-1a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772890694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890694, "uuid": "5d6792cd-1226-4c25-93bd-c71b41061a35", "comment": "Malware payload (ACRStealer)", "value": "ab54d693332e99496cbdd1662e7b78ec", "object_relation": "md5", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890694, "uuid": "d7db5781-fe1c-42aa-bdaa-51e5592fd954", "comment": "Malware payload (ACRStealer)", "value": "917de1fe496ee03bd9bbbf58f6b0e22166c9220c1c7f9cc4c9eb3f8d50bb8eb5", "object_relation": "sha256", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890694, "uuid": "e9822b07-1729-4cca-be49-c31644b74856", "comment": "Malware payload (ACRStealer)", "value": "ba201e02a2d482aa35ef50c0b13f22b7d441e336", "object_relation": "sha1", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890694, "uuid": "91f30899-740c-4672-b2bc-98fe495b23a7", "comment": "Malware payload (ACRStealer)", "value": "eff214ae71d72d97f5f110cb07b61a81e2c6e9523d926ad5032254e696b273b93fd84597257218ba34ef5296ff8c81f9", "object_relation": "sha3-384", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890694, "uuid": "93c362c0-76f3-4e97-92a5-bf6cb2a7684d", "value": "T1D81733E4DC62E08FD026BC379587EA6D315AEC934034980A43DD6F8C2EAD4CE5795B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890694, "uuid": "bc5c49a4-da29-43e4-ac16-67d78023394a", "value": "393216:djY1lXrVfsLirOsMsjcFdxrms2X5P3uO/ZC0bsh/fdZw888xr2wnM:al7tfOrsjcFes4vj/QMszztNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890694, "uuid": "4202f079-f08a-4241-96f3-819341c9db1e", "value": 19849683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890694, "uuid": "032eb182-3ca0-475d-a06e-ae4d7103b49d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890694, "uuid": "8b5af549-de56-4684-853d-3047b6bbc898", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2322c8-1a75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772922701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772922701, "uuid": "8720d564-2496-4360-94d1-a9dbabc655cb", "comment": "Malware payload", "value": "eedf968e166f2aba3f88e2a142beed28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772922701, "uuid": "4d459a2d-ebd7-4f0f-a836-14cc75043804", "comment": "Malware payload", "value": "92a51d1107d056f3d570a9bdd0f638b32d97872690d38d2ca20578329c8bb7b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772922701, "uuid": "aae9e296-45ba-4295-9ea9-c0e8d63c9d1d", "comment": "Malware payload", "value": "80ff6f8918bfb43dab8d0c4453a1883e734c4209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772922701, "uuid": "b5944b6d-8e56-4042-a1dc-6c7a851e0898", "comment": "Malware payload", "value": "8195896197783ac122b2d87a9ea7a0421d61ea67288ce494229c390998ed9f7ac0dd17171191c57a200215bdc329da12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772922701, "uuid": "b6340277-9457-4d8c-afe3-bc222ab9c440", "value": "T12E36F1155DE470BAF1CDDAB27B11BEB94C536DC0335EA12E2D90CBF68F286B0D821625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772922701, "uuid": "635bf5b2-adc0-4a0c-9b10-c0f07abaeaa5", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772922701, "uuid": "737a623f-cb9b-4511-b260-adbbbfc8e16c", "value": "98304:axJ3RK4M86xhz9cgOEgGuQncGHoZtIc/eClSKbsak:Y+86xYgNgQIMBClSK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772922701, "uuid": "28fbb00d-d086-4587-96f2-4fe6b133d50a", "value": 4909056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772922701, "uuid": "c51968d1-131f-43a7-9cce-0061e2f9e61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772922701, "uuid": "a4eb4ebe-ad0b-44ff-a88a-f4a939743fcd", "value": "SecuriteInfo.com.Win32.MalwareX-gen.36428653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec92eab1-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842175, "uuid": "be2083b2-488b-423a-9e23-1e7b80b76b79", "comment": "Malware payload (Mirai)", "value": "d4da32aff4850467faf8d19e4e89fe6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842175, "uuid": "090ee121-1d3d-4b7b-9362-a01b0f1fcade", "comment": "Malware payload (Mirai)", "value": "92f285cbad9d112adef08464cb0056add9e91ae353f8846948cdcf57ef76fa5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842175, "uuid": "99ec35d1-2ab8-432d-b92a-c224e3e0a48a", "comment": "Malware payload (Mirai)", "value": "367b582017db32851a61ddaf8493bba6be7ebf88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842175, "uuid": "3dcc3d28-f341-4acb-8259-aa79e17696c3", "comment": "Malware payload (Mirai)", "value": "a76ebb1ca25c8985d14b35040897c91563f64a2c29bd12cdb7f37f15dae9a71a90fa5b19a44d386e7c0568d78ed6826e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842175, "uuid": "19c0c0d3-712a-4d15-bac0-26a37de5100a", "value": "T197930991BD92966FC1E013BAA67E518C336677B4C2DF321BC8254F21BB8551F0E63B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842175, "uuid": "aa0087d8-3abc-4848-b896-cc5e65c31a53", "value": "1536:u/9GQ504WD32pUQD5PeNF6RhgG56uO1WCnr6q+pLz78B0cr+7922X5d+jGLl:u/9GQG4dpUiYlWYYV5Q6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842175, "uuid": "74ef86cc-b577-42db-ab80-a54189193f7a", "value": 93148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842175, "uuid": "f098426d-3f13-4f3a-851e-a0e4032d0767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842175, "uuid": "0593d687-d8b7-4d6f-8cb2-2317636e5d10", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9cf321-19f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772867973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772867973, "uuid": "b87277d1-da71-49a9-a929-721fd66cf8ac", "comment": "Malware payload", "value": "ad5358fa2b1ab62b14bcecb04fc75735", "object_relation": "md5", "Tag": [ { "name": "rapidfilevault4-sbs", "colour": "#ABC253", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772867973, "uuid": "ff511c27-e36c-4c82-ae6a-ff850a73df8c", "comment": "Malware payload", "value": "93ee543aa5a648d350f3585e4f7d4d6e6f34818538480cd5e3cd56adb247b5ce", "object_relation": "sha256", "Tag": [ { "name": "rapidfilevault4-sbs", "colour": "#ABC253", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772867973, "uuid": "c4693b31-187c-4fa2-9d67-ace8ef86156e", "comment": "Malware payload", "value": "0fbe83e385503d8c56cb1ed28439f11dd872ac54", "object_relation": "sha1", "Tag": [ { "name": "rapidfilevault4-sbs", "colour": "#ABC253", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772867973, "uuid": "873cd1c3-2bd4-4ab2-8312-011492816e26", "comment": "Malware payload", "value": "9e4bf47647d6c494d14d9f64643f760e8031d38b9cb8c5bf7e41bc51b97f507ff5b24cadbf99dbe0d91fa7e4f6fe8196", "object_relation": "sha3-384", "Tag": [ { "name": "rapidfilevault4-sbs", "colour": "#ABC253", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772867973, "uuid": "8a5a0986-6496-473d-a065-8d7a65e5df79", "value": "T1330115FF743274B29B43C5EA9D5350960976D36F1ED02D9C68E69B34156D050A12231E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772867973, "uuid": "ede822bf-970c-47c9-9465-92f047c20b15", "value": "12:SYQVG7dG3BCFrCR5Va7hFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:8gdGxCFmkt1EDlgNjTidGXhGIBFVR98c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772867973, "uuid": "1abf2eac-d80d-449f-94a4-aca504e355a9", "value": 750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772867973, "uuid": "fb6cad80-fcbe-4b7b-a86d-5feaa52ac759", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772867973, "uuid": "1a12ce2b-5776-47ff-a43e-1862b7a13d94", "value": "93ee543aa5a648d350f3585e4f7d4d6e6f34818538480cd5e3cd56adb247b5ce.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf1c98e-1a4e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772906144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906144, "uuid": "8323311f-3b1c-4e14-9dab-2d940dffc15d", "comment": "Malware payload", "value": "8ff4e3f8d05bcedd8478ad391197b221", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906144, "uuid": "a20b3842-2a0d-4e1e-bd00-eadc735515a6", "comment": "Malware payload", "value": "9418c8070453d3aa7298aff2a03547e5c4398e9311338d03c3fca04821bbc7ba", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906144, "uuid": "97cc73cb-7063-426d-bac8-e25fdeb3071c", "comment": "Malware payload", "value": "569a2faa01e5cd0a7c3f7ffc318611e421fcdc8a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906144, "uuid": "7d425ffe-1f50-47f6-8f17-25738ea82916", "comment": "Malware payload", "value": "bd8accb7844bc6646175654007ee50b78fa893e31ff4dd6790a70a6758bd228f69175233a7807a8efc1ff2969c790da0", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906144, "uuid": "3f33a745-874a-4a65-81d4-4c0abb642612", "value": "T198953348B607CB0CCC1575BBA19C8A765AC35AF62B390ACB1D1C76E2713D68338E16DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906144, "uuid": "9931ff31-b079-4432-8356-6764b382a694", "value": "49152:DkDK5YauR8zYHDsnuSbtvTSpVKz/VFpCqDkW1u:DTjUD0xvsVK/N4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906144, "uuid": "6f848479-65f0-4df0-8a70-e9ee1c41b446", "value": 1890242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906144, "uuid": "fd46e002-b969-4593-97b0-c8f2b4b4f338", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906144, "uuid": "392c0ee7-4070-496b-99ab-9e366682ac23", "value": "BerryBerryBerry.exe.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632bfc2f-19f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772866855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866855, "uuid": "7e4958db-27b1-4432-92bd-ded10deec0f5", "comment": "Malware payload", "value": "779603e4359ef571aa29b168e747edd5", "object_relation": "md5", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866855, "uuid": "26250e97-4da5-4413-a499-ce06b15cb103", "comment": "Malware payload", "value": "96f8d137b649c613dde231d3a15d5e11320238055e490e4f6d06f4abcb06f3cc", "object_relation": "sha256", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866855, "uuid": "33b5fe14-f853-4b7f-b62a-1b50861cef1f", "comment": "Malware payload", "value": "31442f463791428585fcaf3a740982cf4ebe0960", "object_relation": "sha1", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866855, "uuid": "d8ee0d52-6b76-4652-8e66-1c62b5c6341f", "comment": "Malware payload", "value": "9400873f357e254ab0ff7df70c023b1379dd438ceec0b7ba7013d25b98260d623aa7e96932266b6cc20d5df2acd2544f", "object_relation": "sha3-384", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866855, "uuid": "3eb9c176-d7d6-4705-a7c1-e5d64bd770c6", "value": "T1F9117B75D3F5D30CB969A09B9BBF8B44742991EE93C075094AF482D8ED70120DB78F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866855, "uuid": "8213da4d-c252-4978-97ce-ac20029a4892", "value": "24:0WCDQjj3RmMgW9TcZmO6B2O+ZL/j365HO+v+jO+oO+oO+v2rO+v9ZO+1:SDQjDRmMnTcZVrpJ/D65Hpapopopv2rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772866855, "uuid": "db62dc95-7fa6-4f37-87c7-577ac02f9f00", "value": 1012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772866855, "uuid": "58c9a74a-56ab-4d25-8b54-a8cd06320503", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866855, "uuid": "d8d9765f-1ed4-492d-9ec3-cff61875b40a", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdaa7543-1a6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772918573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918573, "uuid": "bccdeba8-1df3-4193-ad62-8de3c380e367", "comment": "Malware payload (Mirai)", "value": "1b47f0777eeddbb1f0a631ac3e371da5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918573, "uuid": "045e94cc-abc6-4c0f-96ce-7b5380ad3b08", "comment": "Malware payload (Mirai)", "value": "98de7cbb47913b71ad595cdfa153c56593fed69670cb885497ccbfb0a29dc29f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918573, "uuid": "6296361c-6277-4aff-9ce7-549e379b7e6f", "comment": "Malware payload (Mirai)", "value": "e8b0474e7c3b1250c242e4eb7bfffead53bf9727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918573, "uuid": "74e6dd9d-def2-48a5-9817-400acdfcb1ff", "comment": "Malware payload (Mirai)", "value": "3bea201ae7dde86e4d2fda2beb3502fe6f749c0e152e91809b65d908a254f2758625800f755f2317091100e3d33d8dec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918573, "uuid": "55570c78-6a3b-401f-92e0-bc34f14024ec", "value": "T107B3E749BC419B10D9DA36FEFF4E028933571B6CE3FA7202D9215B2167CAA5B0F72512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918573, "uuid": "639f46e9-e0fd-41b2-b650-6309bcd59d83", "value": "3072:Q9dIRpVxelpK2I4bTAaGSRpuHTrh5OAtFZuq:QgRQK2hHAaGSRpuHPeAluq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772918573, "uuid": "a7f38739-1073-424b-a846-436562e1c63a", "value": 114392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772918573, "uuid": "117e57ec-589e-4a7e-a46f-51dd9af482a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918573, "uuid": "a4f555cc-17b3-4773-8b01-8e55f009751f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41aa6866-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871094, "uuid": "c12cf857-ed60-4d12-a41b-8702be5c1388", "comment": "Malware payload (Mirai)", "value": "a2b18d6eed8eda38f29911937a683f88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871094, "uuid": "68beb6e1-8711-48d0-a07b-aa0c32be6cca", "comment": "Malware payload (Mirai)", "value": "99a867d8e1841675d98cce8a441611b610fe2da8c092ab7d0fc0477cc0286feb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871094, "uuid": "7df32ad4-3651-4da0-8bd1-afe1e4cde3f2", "comment": "Malware payload (Mirai)", "value": "1cf4bcfa9145198c9ea57e98012d61673e293d7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871094, "uuid": "cfa8f451-4bf5-4bf3-9ea1-01b566147a46", "comment": "Malware payload (Mirai)", "value": "17181c6f539f6967693843374a2150d6c2eb516e4f6e177e5c7674b75c57cfa08e405d393e7f33e6b14bd41ebee6ad55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871094, "uuid": "8f495a49-cf00-4701-b8bb-493e491d4ee4", "value": "T12EF2E15AD394698ACDCD287C20DE67F6671953C3775D872D1B01DEC2E2B2382B40A9BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871094, "uuid": "498b1d99-5f08-409f-bae5-3ffa98b43f15", "value": "768:0bmSI04D/wiIHcneiSuC7d+vWS2O6bgFZ4lP4pfVoSaW6:gm5QHceiTC7U+diF4P8VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871094, "uuid": "8bb74d7c-df91-47bb-85e1-aee8c9b6cffd", "value": 37512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871094, "uuid": "91143c48-e8c4-4b13-be8b-fc2b1c959f9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871094, "uuid": "6a27a452-bd76-42bc-affa-9bc1865f3fe8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb91820-1a7e-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1772926544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926544, "uuid": "61605d8b-08e9-4cf8-911b-ce8d3e2aacfb", "comment": "Malware payload (OffLoader)", "value": "7ec825e36348768c4102a157e03a81af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926544, "uuid": "6d28e84f-0e2b-4d8c-9579-69fbb4032088", "comment": "Malware payload (OffLoader)", "value": "9b0ab236f901d2cd91d29f7dfbd411702a525d7dcb07194ee3ff2d0ec4a9d81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926544, "uuid": "452ad804-8403-4c58-afa8-21c8559ac696", "comment": "Malware payload (OffLoader)", "value": "6b3b43dab7f72caa2311a96d13a5ef6260a9a5a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926544, "uuid": "57110b37-a10f-4832-9946-8568dc6bec2f", "comment": "Malware payload (OffLoader)", "value": "e9af36c6cdf7d62153b0145e624e0e2280b66bde7a4da61470622bd1b8a00195f6d69d0ac71a9a803f0513c6f6087d8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926544, "uuid": "9d8f331e-8dfe-4bba-bbda-00a863d6a218", "value": "T11B96F133B28A673EE06E5B375AF292205D3B7621A50F8C5696F40C4CCF291A01D7F697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926544, "uuid": "e8175108-12ca-4ab5-969f-6f9542ea452c", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926544, "uuid": "197a849e-eab5-48a6-8e4b-21bf2f3e84dc", "value": "98304:nN66NKsbyKLx+KEmzWPgp4AuPpdxjr2YZX24:fNzbyKtGmzWDAivdr2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772926544, "uuid": "0d8af0b5-fd5b-4051-9a0d-56a3fae92444", "value": 8843065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772926544, "uuid": "914af799-e756-4c7d-82ed-615f46f8cddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926544, "uuid": "6e23fd76-5d71-41e5-88cf-6bf682d19005", "value": "SecuriteInfo.com.Win32.Malware-gen.42757137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf625e2c-1a7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772925019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925019, "uuid": "4f1c74ba-0255-4d99-970b-5224f1805d72", "comment": "Malware payload", "value": "6b4a51f2c2e1bc6786c3ef860b08f5bf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925019, "uuid": "7b2138d9-ccf7-4c13-b417-fcc12d95e0c2", "comment": "Malware payload", "value": "9b6012a201e5fca633fbd1ea4f58cb5ad1dc378c9340e1bb98b7665bda7fe842", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925019, "uuid": "8e5fff0b-bcbb-48fc-9344-02b73a4d4e5d", "comment": "Malware payload", "value": "ad0e2f49840d3f1256dcf42ae8175a83650184bb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772925019, "uuid": "d3064b0e-f7f9-49c2-8aa8-b13766794963", "comment": "Malware payload", "value": "9d45d90f103c724a2c6a3236366cf165b4869a5ec8189951149d3bf5401d0ecd485cdae2e8e307bd5c2506e29ca3e8e9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925019, "uuid": "6aeaeb9e-b7a6-460d-873b-6be2921684d1", "value": "T13AF0C027418D45638F571AB285584219A53FB1464712E8C657B395A4708A2DCC7DDEC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925019, "uuid": "4c5d32b8-85e6-4a67-8fa8-a19954c01167", "value": "12:YerZoA8nUI1kbQpc4N2imUK8ag7JyMvUAb/RWA3S9qAcAl9S:YiyAyYbWpJ/vUAbZWA3xAc8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772925019, "uuid": "f3f3a7ab-b176-4309-a699-0b132453da5f", "value": 543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772925019, "uuid": "1d62a6ef-240b-4f72-bdc2-28f466f877e2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772925019, "uuid": "8b62c12e-c7f2-4a49-994d-dafdf861a395", "value": "partyinvite.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa33011-1a6a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772918094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918094, "uuid": "efca5cd0-ab7e-477e-b768-d45204378fa0", "comment": "Malware payload (AgentTesla)", "value": "eceb978cb9a98c55f7e031c59208ca64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918094, "uuid": "dab48829-5a56-4965-acc8-db6b57ad0aeb", "comment": "Malware payload (AgentTesla)", "value": "9be483c90186e01bcbf15272b95633855684f83a700f3dafeaa945dcc25bc707", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918094, "uuid": "c8757f81-aadf-42e0-b301-aba6a9e7a9a5", "comment": "Malware payload (AgentTesla)", "value": "fec864f2c4b6094af72b3ce1fa796c8e8083ff53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918094, "uuid": "13fb7c7d-1229-4244-aa59-4f8403adb57b", "comment": "Malware payload (AgentTesla)", "value": "74ef03e07c0d9016a36c517a549fd3750ee29c815b893953cc06950274bd67d3d10aac8fa8e61c29634385056a21af26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918094, "uuid": "33198b2e-54c2-4243-9fe9-99f9f01a3c91", "value": "T192161984F594876438137D77BB60B0E0568666EB7D81B502F12F67B3BEA61C1B83123B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918094, "uuid": "f6951c77-edd2-4365-b896-a1389d8666bd", "value": "98304:ew8jeXn1r9q3iWGEpYI3v1FDJnbfiw3ow4hbUd841kYNF/yEJJBMEYI/2SdCj6vw:H8iXn1rgyjcv1FD5bqw3gdYNFq7EYI/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772918094, "uuid": "29ec7b2c-0db9-4781-9bfc-10a359f02a10", "value": 4183707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772918094, "uuid": "d7d620f0-1e71-4091-8c7f-cc99394f886f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918094, "uuid": "2b9c2310-4d2d-4884-9fc2-7618864164e0", "value": "AMENDED PO NO. 55963.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7653a810-1a25-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1772888362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888362, "uuid": "92f7817d-59de-4e62-8489-5b4671bfc191", "comment": "Malware payload (SliverFox)", "value": "3473eed05d1550628337944a6d8cb8dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888362, "uuid": "73ad5f9d-ee08-4386-832d-4cc91cd5ae50", "comment": "Malware payload (SliverFox)", "value": "9c47d8617bdfdd0f68294c1684342d481a047fb2b10b647c97d4bff69488cc9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888362, "uuid": "a9affc79-dc80-4fe9-8315-0267d243b03e", "comment": "Malware payload (SliverFox)", "value": "287fef601bfc4bbaf9c4fadb0dd613ef2af276b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888362, "uuid": "1c3a7bb8-2ff5-412d-8340-679cd25cbe00", "comment": "Malware payload (SliverFox)", "value": "1bc6c7d55bdf887e75c34d04cc1fb4a5f491bcd0e1d41ba52b5a4b6a4f8463bdc406544e31c423ef147543f177b8d59f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888362, "uuid": "044ee16e-4f1a-47d3-a336-26efb640ca56", "value": "T19165021FD6A3C8B0E4426FF8A3865BB5E899B44303E4542F57E590FF84397E067268D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888362, "uuid": "d2f0434a-fd7b-4acf-bfa0-81e35c6bb2e5", "value": "5282726ed791aafbb31d7182b585551c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888362, "uuid": "4fe3d9bb-3f79-4401-9315-518522d178fb", "value": "24576:q2zMDtqb3WKtrktJiaZ7JtGaF4FAoB/HgvME8+QvpJ:hYDtCGniS9MvdHgE9xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888362, "uuid": "678a2aca-f29c-4b24-8860-8d9f8b62281c", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888362, "uuid": "d65ca934-ecd2-4297-8e53-0de218719830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888362, "uuid": "55b322fd-8507-4df2-90a7-61458cfa7fb2", "value": "2026--\u7b2c\u4e00\u5b63\u5ea6\u4f01\u4e1a\u5185\u90e8\u8fdd\u89c4\u4eba\u5458\u540d\u5355\u901a\u62a5\u4fe1\u606f.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54066fcd-1a50-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772906773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906773, "uuid": "85c05d83-bd93-40a3-b0f9-247b96dc3d04", "comment": "Malware payload (AsyncRAT)", "value": "8accd8a3915e3bbda7689143aacc8f54", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906773, "uuid": "233f109d-34be-4eaf-a25f-4515bab5e162", "comment": "Malware payload (AsyncRAT)", "value": "9c970c29df4fb1398940809e6e7a9bc5088eaca54eed4cdd878c06fd0ed030b2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906773, "uuid": "3455b9de-6215-4d67-80d6-921583e8f44e", "comment": "Malware payload (AsyncRAT)", "value": "e6c26ce0aef9a6953806a966f3e8e7d3736cdb0e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906773, "uuid": "a8be0383-bfd6-45b8-a012-cf1242e9e277", "comment": "Malware payload (AsyncRAT)", "value": "0a2e258f0839ed4de0727023e5c322f55bbc5c9c5c1beee05e90ea523c45ac9e4d833405442d98029118b90a5b801ebd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906773, "uuid": "f0d449e9-4ba5-4f11-ad28-59c30f11982f", "value": "T194232B003BE98266F5BE4F74A9F262454679F2533603DA8E1C8412DB5613FC6CA426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906773, "uuid": "65704320-3a8d-478c-9695-aedce04f20ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906773, "uuid": "6a1c779d-1d1d-453a-a2f0-bb2728326c6d", "value": "768:XaMj+L31cWxv+wEGex8P++s36LBK1P+JIjbyg47Fdx2fKiSkgZsPmM5bZf+:XaMj+pVmVMw+Kb14hz2fKOgnM5bZf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906773, "uuid": "615f8dec-4d81-4e97-ba18-f91331a11959", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906773, "uuid": "8b1cb49a-ed83-4c43-bc91-e5e9999c832f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906773, "uuid": "6bdb03e7-fbaf-46cd-85e9-abb69b25729e", "value": "Spotify.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca80a852-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842118, "uuid": "5330a137-11b9-4f3c-82e5-f98c018353f4", "comment": "Malware payload (Mirai)", "value": "fe9aea913017d2b6650267411343677b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842118, "uuid": "e18a4f86-d834-4a6e-bf26-e4319d1d5998", "comment": "Malware payload (Mirai)", "value": "9d06ee531c3857aa7d8923fe498c130d32315e4ad9be4d2c811d1fed384be12f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842118, "uuid": "891951f2-ca89-4d73-ac74-272f1a645d71", "comment": "Malware payload (Mirai)", "value": "fa06011cb72aa327ca4399e1d997ce53f59b8cf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842118, "uuid": "cfebb141-624d-4a53-a22b-40135a355fa8", "comment": "Malware payload (Mirai)", "value": "9b70925bfbf88895b3e39235aaef8757b63cb09393afc649524d586a54b1fec3752d70d939e15e121dcc04498965c4c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842118, "uuid": "f8abfbd4-1d31-4bf2-b90f-8b92ba1a838e", "value": "T15273F1571522809ED612D2B74AEC0FAE19773DC36E83B549A9B0EA5626C21CE6D0BCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842118, "uuid": "64da4e47-8f4c-49b5-9e42-ea8a3dbf3381", "value": "1536:edHuY/4jd4up2YRoRv22poT310nGfcNqLv9s3vPYwEVJu8t:edHuY/4mhKqnGfcNgv9OPREVQ8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842118, "uuid": "8471661b-064f-4fce-8b66-43445fc46389", "value": 73920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842118, "uuid": "c5701c69-3490-42f8-b6bc-6586a47764c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842118, "uuid": "a200bacb-6996-4eaf-8538-7f855cf34ea1", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbbb704-19f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772868299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868299, "uuid": "a6fec57d-fdb8-4203-9e6d-eb289b7ca519", "comment": "Malware payload", "value": "cb4ff7a050814ad5ac96d0afebe71d54", "object_relation": "md5", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868299, "uuid": "bba3fd36-5512-4f24-afad-070b090223ab", "comment": "Malware payload", "value": "9f392a2b0600312e544ad48c196d196e6519224a61bf92cb3c9a801cec50e518", "object_relation": "sha256", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868299, "uuid": "f9fe9213-3028-4539-b5f1-d28bd14f9ad8", "comment": "Malware payload", "value": "78267d66f74150fc9bb7070c98b14d585c1b2c3e", "object_relation": "sha1", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868299, "uuid": "0a4ef2a1-72fe-4962-ab0a-44e9431ac818", "comment": "Malware payload", "value": "ce6d2bd4406efdb41dc97f0a9e192f587c24045f2e371357e4b1e19d093abe2fc7b040ae11eda8bd16e4820b4b55d8bc", "object_relation": "sha3-384", "Tag": [ { "name": "claude-update-version-com", "colour": "#E185B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868299, "uuid": "4f9677a6-4eb4-4829-8b0a-2f879d584a6e", "value": "T18C953377BCE2E00AF4E8576F87AE51FCA5A38BA01A56C6A0318C5590F4167FFC9CC548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868299, "uuid": "6731b7fc-1678-43bc-90e4-a968890b89da", "value": "49152:7ubBMBKAW3XzLUfH+Jpxv+/Cr9JBOETJ4Iohd5rPsMP:yGxeXz7xvwCBOETJcT5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772868299, "uuid": "4e5e18c1-9854-48f4-9dad-8c39eaeec87f", "value": 1891635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772868299, "uuid": "b8ea9e61-2536-4351-9cc0-f3883498c03e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868299, "uuid": "4cb75900-c828-4b3c-b37d-ca4e3630f835", "value": "e3abc40cc24d02b69db09ae106bdf34741341929134b8921d06dc5baeeef4027.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744eeb69-19f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772869031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869031, "uuid": "8c0d3f56-9a4c-4ec3-a358-672237f074a7", "comment": "Malware payload", "value": "bfaac5591cfd46235260cfa0c1362a1d", "object_relation": "md5", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869031, "uuid": "95790e13-3ba9-4773-8087-608519a79984", "comment": "Malware payload", "value": "9fc0dda61ead8eac9c05d0dee310c7ccd8e4e27278517cdf10268148f3b949a4", "object_relation": "sha256", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869031, "uuid": "f38cfc27-6755-4cfa-86ff-6ab9cdf7eced", "comment": "Malware payload", "value": "f374e9073b015717aa55440869a8c5270dcdc42c", "object_relation": "sha1", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869031, "uuid": "e354b5a1-ee07-42eb-99df-3ce580019529", "comment": "Malware payload", "value": "fe24eb39e0cca37ff98fff58f0cb08d327b6692bdb9d7ca1dbde290efc5825249807dd895f10c9f92e1532b9bf66400b", "object_relation": "sha3-384", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869031, "uuid": "587ab45e-b929-4fd1-9db3-f3ae7fe13dd1", "value": "T1F946331E6A081D9D04374EDFBF86103B0883BCC519B62149DBE6E36FF59C6A996FD102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869031, "uuid": "64ac3218-96fe-4b3d-8930-c5f06e08c176", "value": "98304:P6snGMxvibW1wOvatj2/BWOZn6snGMxvibW1wOvatj2/BWOZd:Rnl1sSp/Pnl1sSp/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772869031, "uuid": "7d316f55-90a1-4364-98fc-7bf576e98889", "value": 5487718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772869031, "uuid": "976ec234-ca5d-4914-b8f1-40adfe7450c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869031, "uuid": "8e10e73b-0c8b-41be-bd54-e1ea90e59a98", "value": "9fc0dda61ead8eac9c05d0dee310c7ccd8e4e27278517cdf10268148f3b949a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d9e37c-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871155, "uuid": "e86bcb88-8a26-49ae-9b17-93f7832bbc57", "comment": "Malware payload (Mirai)", "value": "4b115a5e5fe8fadc9bbe7f8a5d1f11f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871155, "uuid": "7d737337-360d-487d-9a00-55a822d99cc4", "comment": "Malware payload (Mirai)", "value": "a04c92de1ac3655c9c225b2f9445b89860594da62e0b0adf1145017140fd3a05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871155, "uuid": "51852f53-91c6-494d-b489-cfbe5e6664cb", "comment": "Malware payload (Mirai)", "value": "cdb0e55f913816678ce403cc4763918106b50531", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871155, "uuid": "e46cf38e-8f4d-44e3-bece-f030db9435c9", "comment": "Malware payload (Mirai)", "value": "416815e93eeddaf0df26610025cca6e89e3ed80c620fb36772548f71dc0e055c24380560f8d7bf5a8cc9144d8e1d66b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871155, "uuid": "c4b93e8d-66e8-4509-ae40-51ef6cebcf14", "value": "T1BE735D86FD819A01DAC4127AFF6E215D371623E8E1EA7203DD359B253BDB81B0E7B500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871155, "uuid": "455b0788-df83-4177-8694-ad6f0f7d08c2", "value": "1536:5EnJw5pcYQEBKL1wVwqYVnHQd3yQT9/CWQHKwTffTk3z03gR:5E0QxlwFy49/C5HFbkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871155, "uuid": "2c1f5c42-c8a8-4900-86cc-01411c8d80bb", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871155, "uuid": "77e8f16c-c379-46da-b9b4-c92b600450cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871155, "uuid": "62368cc8-547e-4971-a269-6d73d8d978fc", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6a79a8-1a10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772879385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772879385, "uuid": "adf0893d-30ab-4690-a4ec-f14da3004e00", "comment": "Malware payload", "value": "1f86ad664c0426d2e4c62f64dd666e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772879385, "uuid": "9c9d1827-962f-4026-97f9-e3cab068593a", "comment": "Malware payload", "value": "a0fc22541c288fadfddb1de69d02f531ba9d88ee507bfeb25aafb071722f1e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772879385, "uuid": "eb58ec69-ba2d-48c3-8be9-81cefffd9987", "comment": "Malware payload", "value": "2911e726999b071efbdceff0ad0a93c9dacb20ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772879385, "uuid": "d614cfdc-2910-42dc-849b-1e3ca5a890b3", "comment": "Malware payload", "value": "dbde760c9b4d48d871e90fda5df629eafbf858f57d4236ab1cc113f51038f17084c8fe99487e82b1d51a0914583fadb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772879385, "uuid": "34e01e5d-ade2-4b40-ac10-c87463842335", "value": "T1F42633C021CBA646E6C7843984BF66CD8B9B1D4045E583B75EDDE259BE322F0263DEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772879385, "uuid": "5694f630-03d5-426a-a384-82ef23c06e2f", "value": "49152:4Rbs12aGSLPdXzvhqMprrrhCS9eqO99SCQ:4u12a3ZkQfrf9eqO9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772879385, "uuid": "f3043299-44a7-49a4-97f3-b527a3008ff5", "value": 4688896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772879385, "uuid": "ae69ea2d-8f3f-4db9-a77b-da27889136ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772879385, "uuid": "08471a02-6e16-4806-87a4-196b5da14f62", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.19728.11110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffdb0ef-1a54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772908430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908430, "uuid": "c69ffe4c-b0c5-48ea-9967-51642949c6c5", "comment": "Malware payload", "value": "4a2b3a0da060407ed7875cb9c6f8e540", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908430, "uuid": "35413146-b28c-448a-83c9-8464438ce1e1", "comment": "Malware payload", "value": "a17a344830e556045218bd17f6004c62203406ba7712154d0bdac44edf8193ca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908430, "uuid": "3a6fd696-ec52-4368-96be-44db6bac9898", "comment": "Malware payload", "value": "ecfa3a4c65820135de905c15bdc44e3ae7670ef0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908430, "uuid": "fcabb2df-dec0-4b05-bf4f-f60dc8b9832a", "comment": "Malware payload", "value": "7af214624f01be8386c6da37a832d903395e35144207886876a18302df053f5c4e64e685906a915dddcec1eee8ace17b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908430, "uuid": "eb3a22d7-bf9b-4c02-8a87-32fdb3796424", "value": "T1FCF0A70FA44BF03AD08419E8EB65FB5AAC30B86B6273DE5C78417660FFD6434BC62244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908430, "uuid": "fb92dd31-78fb-4242-90a4-c177b10f97cb", "value": "12:lSjkOLZpqjW3bo/8pqF82Q/NiTZEfJfat:lzgZpqyM0pqF82QVgmVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908430, "uuid": "1db4fbee-2d95-4308-8b87-7cdb1320f24b", "value": 520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908430, "uuid": "6c4b5d84-ae6c-4358-babb-c84c1cc1f404", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908430, "uuid": "b303c88b-ca4b-46ec-b051-dd23d0fb8d2a", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712b6ee3-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871174, "uuid": "de6fe4f6-5ee2-4102-8bbd-e8db71dba4af", "comment": "Malware payload (Mirai)", "value": "e353ef991ae494db9ca01e157f29932f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871174, "uuid": "57867a94-6535-420c-8eb4-e9f98370a123", "comment": "Malware payload (Mirai)", "value": "a1907e945e735490f37ce7dd0fc39ea6797636975c15fafaa2483c06186f50c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871174, "uuid": "ded19de4-4f45-41d1-97cb-8f7da5116aef", "comment": "Malware payload (Mirai)", "value": "a6adb256da3a5a05c5269648a5490a3450da0248", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871174, "uuid": "6e4820a2-5502-4c78-ad99-709291f702f5", "comment": "Malware payload (Mirai)", "value": "d2c31300f0872c5bbdd305f1b2c5db2aa87b9fd568136f1808a6ea61de0d09ea90f8e201a5429cacb133d2b3c9d11911", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871174, "uuid": "11b239b4-1e34-4e3c-882a-e2f945baf3b0", "value": "T1F7734A4B784484FDC5A9D1391B7E7636C86374BD033973DA27D4FE2A2E05E600B1E629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871174, "uuid": "d703a86e-9d0f-49d6-b248-187047b29c14", "value": "1536:XDc83y6P7iCXFC2RPMfle+IgMZhHB7wnmDwhmqTb7oZg7:Tc83y6P7zXxUflVI3xBmmDwsGb7oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871174, "uuid": "d91c1be0-6b6e-46a2-b1c3-6e693cde7258", "value": 79744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871174, "uuid": "d679d572-b098-42f3-a99d-1c731aa7d256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871174, "uuid": "e17b8293-49d7-4526-945d-3619155db713", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e77c2c-1a02-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1772873413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873413, "uuid": "8c61579d-924b-472d-b911-5530460c5ae6", "comment": "Malware payload (SheetRAT)", "value": "1d74e5dc6f38931c7b7f69734739b603", "object_relation": "md5", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873413, "uuid": "739b77ac-3db0-4bed-b1e0-044c57583c5e", "comment": "Malware payload (SheetRAT)", "value": "a2191aa5335a356d2a147c675efe24d9ff5ee778e2eb8ff09f89f0e7ee28ffb9", "object_relation": "sha256", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873413, "uuid": "4f556431-82de-40e1-a555-75b8db1de43e", "comment": "Malware payload (SheetRAT)", "value": "6eb8ad0391f8e733b75f20eadf274d1ddaa3bad3", "object_relation": "sha1", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873413, "uuid": "fd8ed97a-879e-4c91-9166-adaa186982ab", "comment": "Malware payload (SheetRAT)", "value": "1d56e7d09e3436e82097017363f70ed10decf3a9c2155ff8b385a09c7c0dd6eda1229627f61c17126f14cdf484d6c176", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873413, "uuid": "a31882a8-bff3-4ccc-9e77-93d3e214609e", "value": "T17221943B34EA6B5416A009B29D39E1917B8060C7BF3916CCF1EE813403072BB67664FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873413, "uuid": "70e5ca62-033d-466b-8374-a02faa61ccc7", "value": "24:Qf2l9xNpguahCOgl+2bvMMMMMMMMMMMMML8KzitrxJ5vCboVPMMMMMMMGlpQCuBV:Pl9xDbvOgM2jMMMMMMMMMMMMMoKzizJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873413, "uuid": "2f569244-cb84-410c-bdca-d89ec5460beb", "value": 1392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873413, "uuid": "42ba30cf-8553-4f08-8dfe-14d23b35e6fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873413, "uuid": "9bbad751-ca87-4420-8489-3a98ef9347d0", "value": "a2191aa5335a356d2a147c675efe24d9ff5ee778e2eb8ff09f89f0e7ee28ffb9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cab96c8-19d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772852966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852966, "uuid": "2d296926-7ec7-410b-9c27-c44dec147df5", "comment": "Malware payload", "value": "84bb00b12fab91340cae278139d05f73", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852966, "uuid": "d49f8337-3f6e-4a59-b466-4bf362677e4f", "comment": "Malware payload", "value": "a2242bdd5468098e4b65a5705fe95464a5d8a9715313becccf728480a2f4dcea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852966, "uuid": "18203b1d-4c2b-4200-9785-892b3b6702ad", "comment": "Malware payload", "value": "1c23ae6f9a59aa72bac5dc9e1c0f9a44d0bf2d70", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772852966, "uuid": "1ada172e-4380-4cf5-86cb-b36f929f4336", "comment": "Malware payload", "value": "31deb29f3ed1f2c7f9a181df49d5fbd33d4fe06450b5d34cb26cfafc0d1674446bd12960956ac93188654415f482a231", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772852966, "uuid": "5878e5f1-5847-40f2-ba1f-652ad17dc38c", "value": "T1D4924BB906496C79BBC0CE799F3C7F0CAEE582C42129E39DBA1F39705A2065DC60935D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772852966, "uuid": "5afb2027-42bc-456b-bd66-8ebd48d8c541", "value": "384:V7ncuxOLnVYMStzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:VIuQL+tzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772852966, "uuid": "6b783ce1-8515-422f-8325-900b38e4fc83", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772852966, "uuid": "ccda90cf-61ec-4b7f-bcf0-70d26b200978", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772852966, "uuid": "e8cfde21-2547-476c-8db9-91a31b157072", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b4fd9b-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871099, "uuid": "9fa8781a-cfc2-4bd3-9de2-5e380b89c299", "comment": "Malware payload (Mirai)", "value": "45ff3e56ade1978031b1d9d4db7cc11e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871099, "uuid": "0ca01474-02b7-4aa4-8b4d-10e4e8a58693", "comment": "Malware payload (Mirai)", "value": "a26b82e4ec97c3829755a9332cbe1d9ac362db6b29faf6e06c9460a84b5df341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871099, "uuid": "006cdd54-c91c-4277-adde-50adaebea983", "comment": "Malware payload (Mirai)", "value": "7108a0588b0d7237ca16dbf1f06268befaedaa0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871099, "uuid": "bd1a1819-c903-4171-920c-1935e2775f23", "comment": "Malware payload (Mirai)", "value": "693f68cab8d5906093775f6d954cf4b80e09ebbaec39a2e73943c44d06265b66aefe49f46b5948e1325cc20743c4d121", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871099, "uuid": "13a8d65c-18ca-4b95-b326-d23fb3ba9f31", "value": "T19653E846B9829E11C5C8077BFE1E118D33137798D3DEB222DE116F21BBCA56B0A7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871099, "uuid": "7fba17ae-22ca-461e-9d6d-941a47ab8a4c", "value": "1536:wRn78zEyaRDCvEsDCbscC6xIrqrrYmPOIRiM/3qFsIwbZnE:aSEJDCv7Ssc4rs/3qFsIwbZnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871099, "uuid": "d90dbc82-a2d5-4d6f-9d5e-f35435344424", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871099, "uuid": "599e6824-4ef1-4646-a5e7-b57beac17e7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871099, "uuid": "3051034f-495a-4ef1-8193-772f5c613c4f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c002b7-19f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772866610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866610, "uuid": "634fe3a1-259f-4e1c-a1be-a546549abdd5", "comment": "Malware payload", "value": "d1e8cbbb9c2284d40f3aba9d59c3ef24", "object_relation": "md5", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866610, "uuid": "63ebbdf4-e9b5-4a74-b168-8597177d1aa1", "comment": "Malware payload", "value": "a2932b3cc6e7a0c538c69b6b4b68b8fd82824f50adcc5567105fb844d846094b", "object_relation": "sha256", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866610, "uuid": "1d7b73e5-4bc9-4c0c-9a5d-2ca309361978", "comment": "Malware payload", "value": "bfdc13ae6c7f5d1c0cfcc5dd110f8505b9594372", "object_relation": "sha1", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866610, "uuid": "92cdfd1c-a406-4dda-a471-e25c687a19ec", "comment": "Malware payload", "value": "55bfb176ac40cb4a009a18407a9edc1fb1833253abd94a6c03f4248b591cfcc0a4db16996e50aad9684c67541b18fb10", "object_relation": "sha3-384", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866610, "uuid": "7303eed4-54bc-449b-9ea5-3ca261a8acd9", "value": "T13E11AF36E3F5D30C767AA09B8BBB9A44742891EE93D075090AF482D49D701208B74E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866610, "uuid": "ca72ca8f-4f19-4d90-a93d-3eb02266daf4", "value": "24:+R/LDQjj3RmMgW9TcZxXB2O+ZL/j365HO+v+jO+oO+oO+v2rO+v9ZO+x:uDDQjDRmMnTcZipJ/D65Hpapopopv2rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772866610, "uuid": "5792105b-5122-46eb-b2c1-0247eb579d9d", "value": 1007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772866610, "uuid": "9a90ccbb-a367-43eb-8a85-3f302b891123", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866610, "uuid": "d886ee9d-30f9-4ee8-95a8-91fa4cc4bcfa", "value": "a2932b3cc6e7a0c538c69b6b4b68b8fd82824f50adcc5567105fb844d846094b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fb73cb-1a7e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772926474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926474, "uuid": "9ab51eec-9648-469b-833a-0fce98fc7220", "comment": "Malware payload (AsyncRAT)", "value": "55e27438cf7f3c4397b5cf32ea3514b5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926474, "uuid": "5586a62f-1c3c-4523-bcb3-b8cf9cf810c6", "comment": "Malware payload (AsyncRAT)", "value": "a40193b7b352fe3a14cfe1ca65c9b5250c663f0240cbcda9be70b7898e57f31f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926474, "uuid": "b33e1037-4b0c-4a26-95a2-d936abd60a4b", "comment": "Malware payload (AsyncRAT)", "value": "b228680a1d36593fee0ce22f2cb36ddcb9baade8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926474, "uuid": "55fc1d4f-67c7-46e7-9f21-d84f021088bd", "comment": "Malware payload (AsyncRAT)", "value": "2c4ae06bf5d51a6bdbddf1938210f2d080a770e6b0f4ed0a1356236ef136d532d2e08bbb397a3146f35afb4d58bed175", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926474, "uuid": "a3a6c8d7-a065-4726-9b88-4d6d49fb9ede", "value": "T18F232C007BE9C26AF2BE8B7899F262454575F2533603DA4D2CC412DA5613FC68B436FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926474, "uuid": "0bbc1498-b525-45a6-931f-0337c7855000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926474, "uuid": "b4c450de-369d-404d-b765-b89f1b7ea22a", "value": "768:XakZELQ7GYxvcwZGmx891W66z2+1P1pJIjbNg77FQLW7S//r4+LFwL76mM5bZf+:XakZEIi/Xm1pKba7hQLWO3k+L47M5bZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772926474, "uuid": "1dc5bf91-ae52-480e-8c97-fb0cb15cdf03", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772926474, "uuid": "6a10ea32-a150-41ec-bd1a-0661f874e8c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926474, "uuid": "ac823945-6815-4f05-9f81-dfabf9d81f4d", "value": "RobloxHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6effc9c-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842112, "uuid": "aeb3cc47-3335-4239-bdb2-ced2239b8971", "comment": "Malware payload (Mirai)", "value": "fbf2023b705954610d18e8ba06db4180", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842112, "uuid": "1c40dfa1-98ef-44bf-99fc-864065630893", "comment": "Malware payload (Mirai)", "value": "a440e99058ffc70197aa54fa7210b2be4fcb5d5362d93337c03a207ee74bb37b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842112, "uuid": "69b4816f-38cb-474c-827c-5ecac7c93708", "comment": "Malware payload (Mirai)", "value": "948e36bc1dc0be3ed8ad6fb970dce1ccb05ecf9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842112, "uuid": "c08f6fa7-4204-4898-bae3-c2ffb975ba77", "comment": "Malware payload (Mirai)", "value": "466e10d392a0121921cb4d517c095350d81afbbd3fd85dd3009a501fdbe50574a2483e1bebc87bf920da6557190c3712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842112, "uuid": "6aca16eb-a347-43ce-9d7d-8b97e696cab2", "value": "T139630205358A6E8050F06071293D12892F7E9DB483A97CAF2BD07ED40996F12EF7E2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842112, "uuid": "190d6216-df25-4712-8041-20341afa3d67", "value": "1536:EL4alwQipqopwTzz3y/b09RHeytPlvhUL9:EjyQipqopwTzzz9RHDZhUL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842112, "uuid": "6b7165e3-bd4d-4f08-8585-1efc6282c5c0", "value": 73148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842112, "uuid": "e2d9694c-cece-47e4-9070-5619e471e2ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842112, "uuid": "f6ab7b31-e530-4ebb-93d0-4d5fdfa7bf96", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f325ac-19f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772868194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868194, "uuid": "7ffd44eb-bd9f-4fc1-b46f-5b6177fcefa1", "comment": "Malware payload", "value": "a587d743e7391dda633e7e7fabb84a24", "object_relation": "md5", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868194, "uuid": "b1ccd0ee-0859-45b7-bde9-d3b47f5b06c7", "comment": "Malware payload", "value": "a48551015047792184589c132ec394b82cf4938642e50424369eb4a1fe9348f8", "object_relation": "sha256", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868194, "uuid": "52919639-cecd-4825-ac93-e5266d3b80f4", "comment": "Malware payload", "value": "d64fd401bf2a85fd09d3e3639bfdf0605ff38151", "object_relation": "sha1", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868194, "uuid": "f25a6080-86d0-46e5-ad81-bdd91e42941e", "comment": "Malware payload", "value": "cf7ad5aace656fc8ecf5619ea884e5aeaf4ffb46d1d68b34a128732d2dc9b2f9e61aef2a4f9fd3f07801eac7a493ecf4", "object_relation": "sha3-384", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868194, "uuid": "7e63b5ed-735a-405d-8ee4-43ac98b4244c", "value": "T13BD09724388808C5BAC0800E642B74D343BF0BCBF42878ECBC0C4E810108E723804068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868194, "uuid": "ee5600e2-51a8-4482-a4c5-0734f606a656", "value": "6:vEmx7ygtFE7tlklpECKrehuYaMJgvKCXdDtllObHv:vEJgtFE7tEECwSYMantlQjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772868194, "uuid": "588de114-78ee-42f9-b412-0bf47f4dadda", "value": 229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772868194, "uuid": "def34d14-41d9-47c1-8f3e-5b3de9e73d3a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868194, "uuid": "b131c3c9-7918-43ff-8119-d7d8dbb07fdf", "value": "a48551015047792184589c132ec394b82cf4938642e50424369eb4a1fe9348f8.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f74c30d-1a4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772906443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906443, "uuid": "5af39f58-bdd5-4f5f-add8-01afb8468834", "comment": "Malware payload", "value": "7bef3e6e3f7be3ad936259e7e9270cf0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906443, "uuid": "58f94999-249c-49c2-839c-e9a97fd117dd", "comment": "Malware payload", "value": "a4c2bd3a80ddf6a68710ae4a4c13b50f85a00508c5c59ebf69981575671813a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906443, "uuid": "4d487693-eab5-4e00-88cd-4178ab7c44c6", "comment": "Malware payload", "value": "ad6e8438bb5eb9b8000bed879e06e499e531b876", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906443, "uuid": "98d7b870-da69-4268-a31c-2ec74a487499", "comment": "Malware payload", "value": "1602fda555bdb42598504b768620a236176e19d9d65cddbaa74cfd4696772b2b67f2a595de10cf8aef7d0644d14e37e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906443, "uuid": "ec1d0b19-8795-4d14-8fa4-0db92bd80e0d", "value": "T1B306B0237EFF1B1AAC62752784E0A21E9342149719AA3C4C7F707F5EB97B841560B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906443, "uuid": "27057e2d-8ffa-43b2-b9be-8c1a03b7a2ee", "value": "49152:mJ1pxAKfA8Rx+GZAgkc9D7F0W06BFdDzsHX5c3okCTtTS6ElxUJ3ySgzYWcu2RkE:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906443, "uuid": "b7bce5cf-b273-4ba3-9fca-89f23b69825e", "value": 3958772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906443, "uuid": "f7600798-f4a9-4955-abfe-d5efde5b716e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906443, "uuid": "ea66e569-4c61-4b66-979e-1471d38b7e4d", "value": "7bef3e6e3f7be3ad936259e7e9270cf0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4009c967-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871091, "uuid": "78ad4839-9f45-4029-8d32-6d0bfb1e08ec", "comment": "Malware payload (Mirai)", "value": "a2c3a68b05dbb7bfa0c957f5abec03c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871091, "uuid": "c1068d14-f362-413e-af46-94985b76b320", "comment": "Malware payload (Mirai)", "value": "a5d884e2efe6e9657fc3e3edd1b2e9e625f5b66fd9096f6ec2bd66189c70e192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871091, "uuid": "6dbf0546-d0ed-428f-9dc8-dd24d80874b0", "comment": "Malware payload (Mirai)", "value": "6c6f68b44080ddd90bcc96a8c4774a9a066a1858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871091, "uuid": "5ceeccc9-dd6a-4884-8262-fc76fbb77f4a", "comment": "Malware payload (Mirai)", "value": "fb9a2188da721e343702e3e96220217ba6f013107c72c97ba091e358271c570414240c796d53208112d33620bec92b48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871091, "uuid": "2eec3808-2ad7-46bd-8047-dedd33d249c3", "value": "T19FE2E1A3D1BBC354D12E71348C9E3E4B4870EB3F0E958E6B2980542BC8B1B9D993525A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871091, "uuid": "7e3eee3c-4e09-4da8-bdcb-ea132ecc32d6", "value": "768:5uGR9mDx1bH52akW8KVxYEzRjYYn+zZYyzP6/GnbcuyD7URQRj4:5OsrfAp9jbn+zHz9nouy8RyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871091, "uuid": "65607831-3cf9-4d55-80f8-92b5d1ce0617", "value": 34036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871091, "uuid": "d25c12c2-5eea-449e-b890-ec1688dc7191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871091, "uuid": "3570d4dd-573c-4b10-ae28-454ae9639f01", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7be3bf7-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842167, "uuid": "e2eb8f32-6952-451a-ba4c-d50cd36c5927", "comment": "Malware payload (Mirai)", "value": "6ebb665845bd1741c81d04dbe9073111", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842167, "uuid": "72c50aac-4e5d-44ad-bcb0-7233a11fea0a", "comment": "Malware payload (Mirai)", "value": "a6373452bf6d8007e0356b5740a07b6f68a0723d6a88e137aadd0cfb87f088be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842167, "uuid": "d715727a-4b99-4900-aea4-f1761723ec4e", "comment": "Malware payload (Mirai)", "value": "362e57c178bd2ecfed847ea02755e6e79c7986ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842167, "uuid": "fd6b5fcd-f338-43c8-a2dd-51776d32a76d", "comment": "Malware payload (Mirai)", "value": "098738b224e75e22e5381b177f51258fbce9ceb1c967f0969eacb52c8a0b043a713e1fe2ad0638cb8214206a42a8e5c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842167, "uuid": "e902207e-290e-45c5-9ee8-16e83ac8d49a", "value": "T161D34AC1A643D0F9E95602752133F73B8B36B036152EED87C7A8DE23AC92951D61B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842167, "uuid": "a7898cbe-f152-457c-92d6-731e500be15e", "value": "3072:ksu87oN9RZPT4H2IKcLwMAVsk/IxWU+LcQ7n8DgXVEmj7Sxx:kZ8UzfPT4WDcLwMAVsk/IxW6gF/H4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842167, "uuid": "d7149657-da02-4efc-9d84-6901304ea3b0", "value": 141672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842167, "uuid": "17ae1315-342f-4471-b842-84a8abf5f70d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842167, "uuid": "b1ead081-e82d-496f-8577-5088b9cc2d2a", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79a95c0-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842113, "uuid": "99cb231d-dea6-4d88-97d0-05814faa2c10", "comment": "Malware payload (Mirai)", "value": "6153ee6d531b14948d41eb91c47776d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842113, "uuid": "86d2bcde-b5f7-408a-ad76-89116cea6c29", "comment": "Malware payload (Mirai)", "value": "a6d8c472a507c244e06a73fe1e8003615cb034f1cee6cc74cac7438ef3403ec8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842113, "uuid": "de771e03-4645-4131-b9ca-c15ff8b985ee", "comment": "Malware payload (Mirai)", "value": "6bdd426f633c714a45741c1a2293f52feef3031c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842113, "uuid": "da0b78c0-a052-4aa3-ad06-b36fbe68ee2e", "comment": "Malware payload (Mirai)", "value": "c8c669e61842db429ba02eecfad3aa7ca4b5ab4cdd002a0aadd4d8ea9652880650c742c6e149fa2b22a2105ba3c02601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842113, "uuid": "1aed384a-0ec8-4090-ab9f-aa661c67f2ce", "value": "T1FAF2F055EB4CBAA0DBB00030DD2881DA629A073CF1FBB52737A252949A1488F35DDB76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842113, "uuid": "f725bbeb-e566-49b0-8d8d-0f8b2e77c7c8", "value": "768:KmmSKZ3AZ1Pul6z4ZYjZHMuFzRD1uZOuvtiwEpoes3Uoz22:jduZEZHJdRD0Z91Pzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842113, "uuid": "755ff5b6-fe00-45a5-b1de-3e428389bfec", "value": 34752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842113, "uuid": "d5893267-093e-4244-9ea9-633fd88c725c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842113, "uuid": "54ec525f-e509-4ce7-8566-cdfed6cb73b8", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acc5041-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871082, "uuid": "6b6142cf-12d7-4e2a-afb5-8de769788bd6", "comment": "Malware payload (Mirai)", "value": "09f6bfa87fe3c441494babb44d554951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871082, "uuid": "cc1b878c-cd41-418d-86dd-13d22aa8fc9a", "comment": "Malware payload (Mirai)", "value": "a78cfdb0e92334df680191c8aedb712828434ac0c2e363abaab5363d8c5d080d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871082, "uuid": "b8563f30-130f-4671-9546-465c6cff5fb0", "comment": "Malware payload (Mirai)", "value": "e0dddef69c79a98f9d22b35f8e06424ce0c9e8c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871082, "uuid": "293a598b-e6f9-47a9-8167-fad2c8774cc7", "comment": "Malware payload (Mirai)", "value": "17d7111d235084ad2bf406497662bdc23dceda3f7a4cd84902070cb5241f99085e779be17c42cee3bf6bbceab37f1d81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871082, "uuid": "5a87cf30-30d2-409c-a66e-1a8d9ea551d8", "value": "T14663511E2E618FADFB6D873447B75E21F24873D212E2C640E15CE9015EA034E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871082, "uuid": "cdb84581-8658-41f7-b99d-f824e03f958a", "value": "1536:qZSWtG1Oyu8jDZA1vDMNYdDiwZwnUwbZnL:+G1OMlAKNYdDiwZoUwbZnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871082, "uuid": "64ccbb5e-4510-4911-923e-22b3382e47bd", "value": 68008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871082, "uuid": "847971a3-a3ca-46e1-b945-6faa28c8f973", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871082, "uuid": "60cd098f-bf3e-4676-ba8b-4e0c9512c872", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf0040f-19f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772868185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868185, "uuid": "84845e23-0d16-48a5-896d-c59c07da9fcc", "comment": "Malware payload", "value": "6f47141aae1f17fb3611445572813fc1", "object_relation": "md5", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868185, "uuid": "13d836c3-45e7-4fe7-87d6-4de112476bb0", "comment": "Malware payload", "value": "a808dec094542c2c20b8d35117eb1d9ccded52cf664c1cb7d8efe22f2dac2526", "object_relation": "sha256", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868185, "uuid": "7438ca09-0036-467c-8913-54ad7b916dc3", "comment": "Malware payload", "value": "5d138e523e267147b5dff0ad89dff0d2b3bf9799", "object_relation": "sha1", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868185, "uuid": "1bc0ec4d-d74e-456c-a40c-592097393c25", "comment": "Malware payload", "value": "6aec3c23253e31ba689b880f11a7fe01594b031a20688ce1d5ce6c8b7d3c6c95137678f1768dc1a229e008d9c0993873", "object_relation": "sha3-384", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868185, "uuid": "177afd91-3595-4c08-b12a-ce8c8a415f9f", "value": "T17FD097BC204E18A3104071862049E3008CC08AC238B0762CA15205034AA97DF005B223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868185, "uuid": "ebb17d33-ef04-4a41-a1ba-00ca9633b4d1", "value": "6:vxnBH/27ygtkEOMwqhueIj9sqpL5LnwRIHEfIZFec:vb/1gtQMwqhulsql5LiIbZcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772868185, "uuid": "c80262da-2bdd-45a5-a960-618146c5dd07", "value": 233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772868185, "uuid": "dc043160-edad-4075-beae-19211248a204", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868185, "uuid": "c65f1991-e054-4021-92ee-4feee91500ab", "value": "a808dec094542c2c20b8d35117eb1d9ccded52cf664c1cb7d8efe22f2dac2526.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81a88e3-19d3-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772853361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772853361, "uuid": "d9f3db3f-7f29-4126-b11c-13bc6a84cb70", "comment": "Malware payload (GoToResolve)", "value": "74d82b42b72924ce7fd8b9cb32fffa39", "object_relation": "md5", "Tag": [ { "name": "144-172-92-213", "colour": "#8B536B", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772853361, "uuid": "a915c988-82cd-4f52-85b0-fbf999eaf97f", "comment": "Malware payload (GoToResolve)", "value": "a87d9091e26c03a31bc7e6cff7502a8602d795c60f49466c4bd808acb42e905c", "object_relation": "sha256", "Tag": [ { "name": "144-172-92-213", "colour": "#8B536B", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772853361, "uuid": "f0e549e8-9418-4fc1-974e-bb6aa29a1303", "comment": "Malware payload (GoToResolve)", "value": "909d085e666cf5074d4e46917696c0f2f58dd857", "object_relation": "sha1", "Tag": [ { "name": "144-172-92-213", "colour": "#8B536B", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772853361, "uuid": "4ae91aaa-ce94-4dd1-88a9-5136cfb42429", "comment": "Malware payload (GoToResolve)", "value": "2ec2db809a9c6c531cb8fbfa86b9552e286514f34c45247a11b98652f23fbc08998561ff6f6ab50d4145539b0fc4bb1a", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-92-213", "colour": "#8B536B", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772853361, "uuid": "f93450d7-739c-4793-b326-48d7478e49fc", "value": "T1253733173988C571C6AE01B25468AB7E967C9D210F7105EBF7EC7E4D2B303D36A3264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772853361, "uuid": "6920452c-c332-4c64-89e0-4bf42ac0007c", "value": "393216:OuH6t/ADslrnxHHiACqwWFgvUX0TE5HkCshd2t1Q7tDjy1bpJs8zoajmG4cKhuEf:tH6ZGsBxFCQEUX35dsAtO7t419mz+6qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772853361, "uuid": "939cb1f6-28ad-4809-860d-72e4ed4d2a86", "value": 24526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772853361, "uuid": "632ca6b1-ffd0-490a-87bc-bf47e173b22d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772853361, "uuid": "84af8a7f-41c6-4e49-b39b-ba3e04ecdaf2", "value": "SSA_Statement.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b32a6e6-1a04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772874197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874197, "uuid": "5b5c57d8-72a7-4b0f-b3b6-c0be6f81b38d", "comment": "Malware payload", "value": "32a5dc3d82d381a63a383bf10dc3e337", "object_relation": "md5", "Tag": [ { "name": "Hefei-Qiangwei-Network-Technology", "colour": "#C11A2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874197, "uuid": "78def865-7d62-4520-bec8-f4d74f81226c", "comment": "Malware payload", "value": "a943f84de0b7ad30f4141cb55c02495e8933e4910a1e59c66524bbf172a8417f", "object_relation": "sha256", "Tag": [ { "name": "Hefei-Qiangwei-Network-Technology", "colour": "#C11A2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874197, "uuid": "47cd55f1-b808-40cd-aa0a-7b154f747a49", "comment": "Malware payload", "value": "f02c2fe2bd592875f293b3dee2a099862abbc2eb", "object_relation": "sha1", "Tag": [ { "name": "Hefei-Qiangwei-Network-Technology", "colour": "#C11A2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874197, "uuid": "e2f3f5b0-1094-4110-9618-7c7520eb614e", "comment": "Malware payload", "value": "243614d8b44a859492cfd0d137400d43c7d4341024442f4a46008ee354cb149a2bd41ef36d2cb70c168f41a356a98cee", "object_relation": "sha3-384", "Tag": [ { "name": "Hefei-Qiangwei-Network-Technology", "colour": "#C11A2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874197, "uuid": "8d67db96-ef87-4cf5-a391-03892ad43166", "value": "T1D9F73361F8844637E5E711B5687C6FB55A2EFC21032080FB6748B5EE0CB17D12E366EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874197, "uuid": "73cbf02c-f076-4dfc-bf6f-e1ca008c99c4", "value": "1572864:/5/RJI5YQGOJ4xZW/c5c3aDGCZvcYCcZCvE5n28H8:hZ6YOueOcKDGCZ0YCgCvEUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772874197, "uuid": "b82cfa24-c69a-44fb-a809-a024d1a26a9d", "value": 75720192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772874197, "uuid": "fed9ef86-bd20-4ee6-88da-eea5359f52d7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874197, "uuid": "9c403538-53c8-4887-b616-ba5c53d63938", "value": "a943f84de0b7ad30f4141cb55c02495e8933e4910a1e59c66524bbf172a8417f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c491bdb-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871085, "uuid": "99df7e73-93ad-4d5c-93fa-2d242aaf07d1", "comment": "Malware payload (Mirai)", "value": "1a73e59044ebba630ddddba0cf47bda0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871085, "uuid": "adfaa41b-0f2e-442c-af2c-81b9e16575a3", "comment": "Malware payload (Mirai)", "value": "a9e63343cdb467aaff30076d7b6ae90182a6ccfc476ca35a54974864beb4bd42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871085, "uuid": "ca738047-b716-453b-832c-96add768fbea", "comment": "Malware payload (Mirai)", "value": "51a1b63431c7403b678bd11fe1e49c6c1123c8aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871085, "uuid": "69898734-7dda-4b61-9699-27f6f308739d", "comment": "Malware payload (Mirai)", "value": "d407f8b7e1710e15d9eb3da98eec98054aab25a18a6db5b06ce3f0485924f55a47fad41a5aab8118c115cf99ba07d5b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871085, "uuid": "7bb85c76-1215-4cea-b4a8-147e73596bc9", "value": "T1A4F2E07821158186E827A1FB5FF50BE42FA403B39152FC8EEF05BA95990C0DCAC47EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871085, "uuid": "11ef8cf0-c39e-4b95-8c82-5f39493c3fba", "value": "768:9E88aVdoUANgdzUIdG0YLQeFJtsMmJ6Pv/sIJgGlzDpbuR1J2:9bRdouY6dmX3ZmJQ33VJuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871085, "uuid": "afc40ecd-8d23-403f-a028-55e27ad196eb", "value": 36804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871085, "uuid": "c9aa884f-ecba-4244-895b-49fefc36cebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871085, "uuid": "2bb3191b-3598-4072-99f2-9cc48065ae35", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b0a3da-1a60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772913809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772913809, "uuid": "ac956734-acdd-4559-bf9f-0151e6a87e4e", "comment": "Malware payload", "value": "6e9698e471f79ebc9da2f80d9184be2f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772913809, "uuid": "a910caff-03e1-4f48-8afa-c84412f7a378", "comment": "Malware payload", "value": "aa4cc936db87bc3eae126b606859bc1b9e8f22f8025afa01a1ef1ac8bc76e04b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772913809, "uuid": "2684277a-9a26-4479-baf5-1f98b87695a9", "comment": "Malware payload", "value": "27d285f73119cc7d029338a999db5b0a83e363f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772913809, "uuid": "0b04df0e-030f-4c3d-8057-f0f6492d3345", "comment": "Malware payload", "value": "3c1e6c9c313bc1066a8f9be8ff2a386df285b22675b80b7f3ac61d4c4373aeda757e97b2739ff5b62cdfe8e6a6f03ad0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772913809, "uuid": "1c9fe3e5-059c-431b-9877-118436b87eec", "value": "T1B646BE1014239BDCFB7279702F722433A71A2F174329995B67D6BFE03BAC6E0A4415B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772913809, "uuid": "9631869f-4370-4df3-8e29-34436363ffd3", "value": "903cdf1ef9d315fcd2c563c14b28e134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772913809, "uuid": "ead02290-9a69-47b1-ae27-1fefc13d87f9", "value": "98304:z76gPTtIaj9yHhLeJDPfGDmP6Pd8sB1O9O2uZQwTGX8v3x5:zNbUVgD3GDePO2uZQIGsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772913809, "uuid": "bf5c374d-9600-4dc6-bfb2-6ef730c9ffb3", "value": 5618498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772913809, "uuid": "9230b69c-6de9-4ce8-b4ff-12695c47220c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772913809, "uuid": "15d28439-c822-4ce9-ab28-4cc1a217fe82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02885ae7-1a2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772892463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892463, "uuid": "f2df94ad-81a3-4439-b748-8d6a6432b057", "comment": "Malware payload (Smoke Loader)", "value": "68bbde944d09ecad3133ec64a03e9376", "object_relation": "md5", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892463, "uuid": "6ffd2131-f5e3-4d5b-b525-b78c9fe60a37", "comment": "Malware payload (Smoke Loader)", "value": "aaf0109974d4570b530a19c85f2bd0eb15b7ba824bde98fc5ef453b40b81788c", "object_relation": "sha256", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892463, "uuid": "4b46bbbe-9156-4784-a5e0-e7c2e06f4ec5", "comment": "Malware payload (Smoke Loader)", "value": "db1fc5d7930b5adfa3708643a8903d600694f656", "object_relation": "sha1", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892463, "uuid": "9316f56e-26ee-4670-b044-b1a97c95b8ef", "comment": "Malware payload (Smoke Loader)", "value": "0fb9be9327fca838e8ec605040b40037de03efcf1c96b8736173452afb8df885b0fc2f4cfb29ca25f962b8ba49ebaf7a", "object_relation": "sha3-384", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892463, "uuid": "63036581-7ff3-40d7-8c62-dbc036e975f4", "value": "T19CE1E863975407AEB38808E90088712B55F2D56B3C2D21D9FBD256DBFC3EE856879730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892463, "uuid": "8836e40b-971e-41ac-84c9-263dacadacdd", "value": "96:N0bmymV0P8npuISEYCHfmNT8SNa653GmkrppRQrATUuU7YzuW:NsmGP8npulEYC/mNTC02mkrVqATe7Y6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772892463, "uuid": "495f36fd-5a31-409f-9e36-6212b6cfd298", "value": 6972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772892463, "uuid": "5c8fd917-61e9-4c01-ae84-84522ac2cddd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892463, "uuid": "2df4affa-76fa-4bbf-8e8d-50e9d6110d06", "value": "Host.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0fc67c-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772865343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865343, "uuid": "8056c266-e0c0-4116-9870-a37a362b8f6e", "comment": "Malware payload", "value": "d8035eb78a829e9e26a1931f4ef397c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865343, "uuid": "319468bd-bf31-422b-9f7d-e72f51613d7a", "comment": "Malware payload", "value": "ac10d635e1727978e617a7b4b83bad37bd1a799c5b15fac9369f3366fd469819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865343, "uuid": "7699e5fb-2723-42a8-964b-3b32196bca85", "comment": "Malware payload", "value": "1539eb85d00fbac9b5f0188c6593ccf27eb3bb3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865343, "uuid": "12801eeb-37ef-4f66-813c-5f68589cc93b", "comment": "Malware payload", "value": "d3ba4da0935ce0e38ae827d9e3f8041b61d2bf704b8a11d218af89bcf0c57c8648d1c6546268b6297884cdb2c5a48fa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865343, "uuid": "8d6b90fe-558d-40b0-9909-783e92665ae7", "value": "T17BE4EA7F5962912ADA8A80FC35454B6255B1B33B03B41FF701668130271BAB2EED73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865343, "uuid": "bcc73768-c142-4eb5-8866-710918436e4e", "value": "12288:Y7pcY5Zcq6iHJ8Zgh7syFnpyTM0BlHdNCspRlpVjO48xHFVHzpHECW:2cscieZ0syFn8LJpjB8lTvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865343, "uuid": "51b22577-b8fe-430e-962b-2868171270bb", "value": 713088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865343, "uuid": "1e77ab58-bf48-47ac-be6a-6c48f92c698a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865343, "uuid": "08944404-8a99-4be2-a4d9-d4c6673ceda1", "value": "ac10d635e1727978e617a7b4b83bad37bd1a799c5b15fac9369f3366fd469819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0ed719-1a47-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772902946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902946, "uuid": "e834adc7-e948-48d9-93ed-1875d801c434", "comment": "Malware payload (RemcosRAT)", "value": "838fc6f476d198f4d771d167a02f5a50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902946, "uuid": "cb18e448-44d7-4d80-8567-7efd82db9ae5", "comment": "Malware payload (RemcosRAT)", "value": "ae43c84b6303b2e60cdbd681ac8cf6eb4acf9b9a0155a37299d49bdabd7d0a52", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902946, "uuid": "fbaf9ea0-0a19-4bac-8cde-3a0af4b5b06d", "comment": "Malware payload (RemcosRAT)", "value": "62ceeb4a4aea39f8923b12628430eef34e2db709", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902946, "uuid": "cc3a8b45-9a96-4546-b7e6-cd372af95a66", "comment": "Malware payload (RemcosRAT)", "value": "958c7e27065274bbb6f2fd46849ade92981e9c05ca6782b3f96017d45a3fa349580b3567b4499f0795cafc87c1e3f95e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902946, "uuid": "4eefa72b-a880-4807-99a4-c8a523f5b818", "value": "T1BAE5328B0AE0DE76F6AB4822D744B1F48A264C7638E36FD734A55AD9C8047D73B42533", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902946, "uuid": "6cc1e468-56d3-4375-b406-ed1c98323568", "value": "192:Z+J00VTwEqi/uhIuxBiMPG01czxZWU3uhqyl3uhqyLikPWEUM5Y0Ec0c2w0uI2Pu:ZDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772902946, "uuid": "ddc7c056-d922-40ae-b89c-103105b91e44", "value": 3080645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772902946, "uuid": "dd4d88cc-aa11-4528-b27d-3f86720175c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902946, "uuid": "93b59911-4f73-4582-b2dc-aa867ece0e74", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f019e846-1a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772876970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772876970, "uuid": "e61e9cf3-8bd3-4780-980a-b6ee933a8399", "comment": "Malware payload (AgentTesla)", "value": "b02b168b2374df036241914316963aa6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wsoftwares-github-io", "colour": "#43A855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772876970, "uuid": "edccd80c-c353-4ff2-a22e-f45d644e4660", "comment": "Malware payload (AgentTesla)", "value": "b03048807034fcfed783723ee71c08aca2bb247b17c1963bf8dbcf5831efbb3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wsoftwares-github-io", "colour": "#43A855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772876970, "uuid": "4c857447-43a3-484e-928d-95b4d7e428df", "comment": "Malware payload (AgentTesla)", "value": "d616f3989680b040b7f7bbd620a755a1c8f29318", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wsoftwares-github-io", "colour": "#43A855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772876970, "uuid": "f3e95549-39a2-4e12-9ca8-2110ad1e92b2", "comment": "Malware payload (AgentTesla)", "value": "bc08e6218a1ccb700df2de7553f49f170d25a7ec5d47d0eb2a95a02f3457429fbccd761f42121ec88e330f884c06ef26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wsoftwares-github-io", "colour": "#43A855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772876970, "uuid": "fd7b2e3d-3f8f-4e47-993b-5910bd9867c1", "value": "T107469E197994D727C26BCE7694E20011E7F1A8522BB2E70D26D367AC1D53B853C833AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772876970, "uuid": "c8fd9adf-4377-496c-9787-2cc135c1b21b", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772876970, "uuid": "a0f2171e-0843-4db0-87d6-32bd08c0f074", "value": "49152:GJCixiqFane/NKNqA+K+qm14JftzGudDUBprtIiqNH1QmCNeAasVgHuArID5ggSA:vikqp/kkDH2Jft3dDStcceAxR20d1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772876970, "uuid": "42c6ce4b-23b6-4ea3-9c76-251e85de35f8", "value": 5513728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772876970, "uuid": "3a26c233-c40d-4515-ade8-6edffa14ec8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772876970, "uuid": "c5720753-8552-4de9-bc71-a01d2cd5c9c0", "value": "inject.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd06fad1-19c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772848564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772848564, "uuid": "41f5306b-275b-4bd2-a7ff-775a87f2baae", "comment": "Malware payload (Mirai)", "value": "481b05d81bf0db2fc0ab99de260b1caa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772848564, "uuid": "f8dc783c-fa38-42b5-a1d1-752397d44a07", "comment": "Malware payload (Mirai)", "value": "b0635a6f452c4ccb33d6672d623c5ca29da63dda5f8fa6f85b595fa0f3d0cc87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772848564, "uuid": "541b7018-9730-49c8-8a29-42452b65bf99", "comment": "Malware payload (Mirai)", "value": "50e45224afcd106b8db290f7c768e7ddc0df5568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772848564, "uuid": "85ca48dd-2628-4992-aade-87eb355367c2", "comment": "Malware payload (Mirai)", "value": "55801bfb9be044b40a83c808425895cc03090a1027c68bc9a6b47a9cdba0542bf83616e75d92d55930e9d6354a6e1a5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772848564, "uuid": "68c86395-6570-4b99-bb46-95a81b542a46", "value": "T1B9F38536B7618E77D80ECE7305A985121C8CD98B02D92B6FB2B4E558E76BD4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772848564, "uuid": "ac14dca7-6846-4900-84e6-1044112ea5a4", "value": "1536:LI2eTHyQUqTeVT/gCn7uasyN/ZikYN2MqCiClZaqq8phhmrTimPaL2lqvP7Nb:cjyQosC/NDCLux8FmrThPaL2IvP7Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772848564, "uuid": "c2326516-e0d2-46d2-931e-df4228951b41", "value": 159678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772848564, "uuid": "1fbf23a5-6c2a-4ab3-af59-3f7c30166195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772848564, "uuid": "8263d821-2268-4b24-bcb4-d5618f5c1f13", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b688734-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871164, "uuid": "58cc9871-7aa4-4a0b-bd1b-56f92b9d50e3", "comment": "Malware payload (Mirai)", "value": "d10f5bea1d2f16d7209282107495153f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871164, "uuid": "2b5e0bd4-b671-4998-b2e9-ce4c09c06db7", "comment": "Malware payload (Mirai)", "value": "b1af45f846711e6169ef869e1711ea933520a93ec75f222aab4b596201b33db7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871164, "uuid": "9919518f-42e4-469f-b77c-c74329080921", "comment": "Malware payload (Mirai)", "value": "a3db155190edc401eddadce232a5371956cff385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871164, "uuid": "1466b259-9367-4ac6-87dd-b27a32b9f5b5", "comment": "Malware payload (Mirai)", "value": "162915807ff280690222293e6e7283f6ec55edc27fcc566205235dda37655becec79b493a3a86dec4d2908c064fb8b07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871164, "uuid": "0a808c05-4862-4c52-93a5-9658bad63b5c", "value": "T176933A56FD819F01C9C4167AFA2E118E331317ACF2EEB2139D149B2867CB92B0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871164, "uuid": "16b93a34-5012-4622-ab04-0ba3ba6c1bdc", "value": "1536:wYnVZXls9I8c2WbC3zYY3xm4JVA70LLG4QEDOa8TycKIeiaNP+3iwNz15oYQgwh:G9IV2bjhhTVmoLG4JOaZNP+3iwNz1SR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871164, "uuid": "8d6eb1d4-38bb-422e-a4bc-233ea3195500", "value": 95588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871164, "uuid": "4f636e26-0589-48e6-9bde-c35434e7ac71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871164, "uuid": "94f7c0d0-d897-4d32-8f19-c0a476aa0b38", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c857d461-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842114, "uuid": "55e72e13-80c5-4709-8a02-4624dbd6aed4", "comment": "Malware payload (Mirai)", "value": "5d77199857bb2725ac38aaf61fbee408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842114, "uuid": "a88e026e-1e6d-480c-a14f-6a646f67f3a7", "comment": "Malware payload (Mirai)", "value": "b22a444bb34943a37174a987c86179ed58d51e961130b0e397735306eddfc638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842114, "uuid": "a345ccd9-7aa8-48f7-8776-b9a441b1e8c8", "comment": "Malware payload (Mirai)", "value": "67f1022511f45c85e332f5dd292f0de98651928f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842114, "uuid": "c6023b97-95f9-410a-ad83-0ca52d886155", "comment": "Malware payload (Mirai)", "value": "1aa61caeb832683fec9693f7f7954cf5d2966fc8765fb43f99ece59f0eeafe9cf39aba69ba0c5d2957771da32a47691e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842114, "uuid": "54308f69-d1ed-47b1-b4e1-920c4de20533", "value": "T1A273025DC3CDE39B44FAECB3403537369965B802B2A9070D53FBAC0CB65C969A40ADD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842114, "uuid": "06f1e637-3955-4f28-ac50-21b2a9604999", "value": "1536:d4Pe0BFJ46H4ilCoy7VrfzjYOvStMSux8UF42oJAsheCJY195k:6Pe094/bjgFuxl6JH4195k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842114, "uuid": "af262856-0e4a-4be3-8daa-f9b288913841", "value": 77340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842114, "uuid": "2194f530-a5b6-4e21-888b-2f1ac4a33611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842114, "uuid": "7dab7b30-9992-4e12-bc4c-652c95c1c933", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6fc43a-1a54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772908693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908693, "uuid": "46261ee7-2655-4427-af83-b41edcb199c4", "comment": "Malware payload", "value": "a4da3e747e24db06cd18573a9f703369", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908693, "uuid": "c99aeade-5caa-4b6c-9efc-c6def28f1bac", "comment": "Malware payload", "value": "b2c175da97468ff5cf77c004753b5be8c5d20bc8d9966d62b0c4551e7fd6599f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908693, "uuid": "16797832-717a-492d-9b6c-a0af855e9214", "comment": "Malware payload", "value": "3817240acce4475bdda9a7cd415ac39dc262f224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908693, "uuid": "aed33eb6-1513-4ee5-a890-c6df0c522fbb", "comment": "Malware payload", "value": "52e719f64e6abd944e27caa48c890b69008eda7a91e9a5b086c11cb8a759ee8904982f290cbe20f33e10996b85a9b0e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908693, "uuid": "4b4de9fd-d43e-4724-97e2-0b5261282926", "value": "T1BFB79D0773E901A5E5B3E1388AA74103E773B4675731CBDB329D03552FABAE09A7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908693, "uuid": "8932cf0a-bcdd-438f-9bae-539407a6c505", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908693, "uuid": "082d9412-2376-4c63-8135-f6c1b01ba2bc", "value": "393216:51Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfg:5Mguj8Q4VfvnqFTrYrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908693, "uuid": "33e95f7a-1440-46b1-b1ee-f0e10d4f1060", "value": 48609013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908693, "uuid": "08e0c8e6-2676-4ea6-894f-43bf15222031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908693, "uuid": "5740e171-1dfd-4f9b-8c9c-2566f119ff9d", "value": "xb2c175da97468ff5cf77c004753b5be8c5d20bc8d9966d62b0c4551e7fd6599f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1dc99e-1a16-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772882142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772882142, "uuid": "020c9fee-9e4f-42f0-a9bb-70e9a427d19f", "comment": "Malware payload (ValleyRAT)", "value": "4e9096008e772ff645d1ab7973d1dd78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772882142, "uuid": "f8e99e0c-ecd6-4dfa-9d8c-b556ae2b913f", "comment": "Malware payload (ValleyRAT)", "value": "b3d939afd740dbde97e84a6b110c95c40873f811045686649b2d3ba1290f654f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772882142, "uuid": "522f8653-ac1a-4e46-871f-56346459b467", "comment": "Malware payload (ValleyRAT)", "value": "6b1c710f066c5fe99cef0426407d870fbb581014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772882142, "uuid": "505dacc1-c807-4f73-b7b6-9acb2c9f5dc5", "comment": "Malware payload (ValleyRAT)", "value": "ccdf0bf702ed200af343c8306f4ca724f4e71106c24a8368ba865d7276ff9bea805719522c0fc14f33e783a3436ce160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772882142, "uuid": "3bdb064e-f626-4060-b868-57313679652e", "value": "T1A208333FB25B3179F4AA59397933A311593F7D60A9068D6296D8C89CCF111B01E3FAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772882142, "uuid": "7215311c-e730-4fe4-88ce-7dc19d61d942", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772882142, "uuid": "e9214221-4770-40ae-9f65-fa9b770e79c7", "value": "1572864:Hu82PuyXRXIMevTQaSTSBnV1QuG8juvK0YctOgqzyuOLHxjA5xRa4Bpn1:OFm0IMesTSnDG1v3YctORmu8HxAs4x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772882142, "uuid": "d8a67d7b-145b-4a67-8409-7f4d31fd6fb9", "value": 83287488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772882142, "uuid": "12928229-e019-4219-8815-c14505841da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772882142, "uuid": "199478d3-7e8a-43e8-a2d2-fd7d0b0f1224", "value": "Lets-2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed4780d-1a25-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1772888323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888323, "uuid": "c8e6ad96-a46e-45b4-ba8b-67ea6963827c", "comment": "Malware payload (SliverFox)", "value": "a5dac1a18bd42c6de311571a9e3d20d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888323, "uuid": "5b7fed29-3350-41ef-83cb-c7928292b5fc", "comment": "Malware payload (SliverFox)", "value": "b4491ff2f33eaa5dcd38dbf561717a4ef2c005096225d140f89fb7b4ff073f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888323, "uuid": "956c0353-8c2d-4fbd-b9a8-5581a318be0d", "comment": "Malware payload (SliverFox)", "value": "4798248ada584dfb9967a35391d26203d9858b1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888323, "uuid": "41630a9f-83fd-454e-b65f-f435b71fec32", "comment": "Malware payload (SliverFox)", "value": "d90a1d9de3b72c6eb261dc7c7b35e8e77d10a57602efe373d5f07cb19dec664dfeeb1e5f84bc035df285bfa93402a8eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888323, "uuid": "17a9bc5a-35f2-4c61-a44d-fc70478775c1", "value": "T15B6512A7D793C0E9D62D0339CE57430D56229EC60F0A0661778737689E3B572AB2E18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888323, "uuid": "1f8d162d-83dc-4b52-bbf3-efd41cbb6fcb", "value": "923b402ce0fe56023d103d6fee0bff99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888323, "uuid": "8aa85888-8a22-491e-94cc-c5f34fe03a79", "value": "24576:zjVChPo4ljExh+XUoK6aOnVAI9KFQ9I9rGnM7Y3TLgm9r4rwlRL/:8o4+xQEoK2CmN9QtEjLgmp4rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888323, "uuid": "db89a32f-c167-49ee-8b5a-99487cd72806", "value": 1443840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888323, "uuid": "adee628f-1855-4573-8fb1-e55e69b67960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888323, "uuid": "4e740503-d5e7-4217-a854-e37d63d118bf", "value": "2026\u7b2c\u4e00\u5b63\u5ea6\u4f01\u4e1a\u5185\u90e8\u8fdd\u89c4\u4eba\u5458\u540d\u5355\u901a\u62a5\u4fe1\u606f.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b067062-1a3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772899000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772899000, "uuid": "23811bd5-502d-4aec-93fb-4cb5f8ae9a49", "comment": "Malware payload", "value": "597cde9789028eb2f6e362a733a9081b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772899000, "uuid": "a5ac904d-fe06-43d2-b857-b9304db8700d", "comment": "Malware payload", "value": "b93fd9dfa9d03389fc29b4cbeff96b1ebf2da55fd90ef11e64a193bb98d66eb8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772899000, "uuid": "3131c7c0-8615-4432-87b8-ec78a06ee2b7", "comment": "Malware payload", "value": "d8a1def4461c1e6315e65ee4690babd6142ba60e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772899000, "uuid": "847a7a5f-29cd-4610-8309-9bbcb2b704f0", "comment": "Malware payload", "value": "9233def31bde0211f1723e54839719e382380ebf4b3f2229a755d431258f64a117ee5245ed0fb0d44ade75a6817c3741", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772899000, "uuid": "5ac41996-8a2f-4d5e-baf3-8be066ee6605", "value": "T13546CF02BC95CBCFE1478C318759E262E93E7FFA969D165882CBDB1334AA60014E577C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772899000, "uuid": "d900cc2a-0597-45b1-8eb1-e93334bb1337", "value": "903cdf1ef9d315fcd2c563c14b28e134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772899000, "uuid": "d4713cdc-03c2-43c3-ab60-b645808843a2", "value": "98304:huWhXxH57K7u/yHfRhqqyWpHOQlI4ln+T/dvG1mArYdItl0c8eJHBHoMhWc3mmUi:huWtxHF/yHfRhqq9d+T/dO1mArYdItlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772899000, "uuid": "b43d1aa1-d9cb-4e1b-89a5-8669899ce15e", "value": 5618498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772899000, "uuid": "8bb9c3e9-77b9-4799-a38d-bf2c505a304c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772899000, "uuid": "0efd3c6d-1602-436b-843a-09093e2fdfaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1830687-1a61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772914231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772914231, "uuid": "be60c537-84d8-49fb-ba5d-53964ff32073", "comment": "Malware payload", "value": "32ecfbb0febed7d29d20d98cbfeb8513", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772914231, "uuid": "a0cce042-5de5-46f9-9f35-cc03e497e032", "comment": "Malware payload", "value": "b963a90730a0ac04e07f18e1cdcf9289c9e0aed336e448d3cf670bc13d000f3e", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772914231, "uuid": "aca74843-e331-4ee2-bce3-4983d4d2e278", "comment": "Malware payload", "value": "00dee6ca53748f842a25089b5300d60b6d3a0ebc", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772914231, "uuid": "16785892-68af-4297-b836-fef0725c06d4", "comment": "Malware payload", "value": "699490552d3632e57ae6d8004f37a5f6d6993111a4a44edd805e644c579e8d265686b14c9034da926b80962c15d16dd6", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772914231, "uuid": "c92d5deb-eac9-478e-9832-bc54dc30c26c", "value": "T12644235016DA2F2B4D3315CE1A6891954E4721F2FEECFD9C06C93A62E87D427E90B90B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772914231, "uuid": "aa94c96e-ad9c-4aae-afa4-0e564e2c56f9", "value": "6144:8lAhSglYuLi89aTGQHbYwL+GbBkM/cUOmDbx/U:8+Dlfefb2GbqkcU7Dbx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772914231, "uuid": "f142257d-c034-45f0-a085-1f91ae14f5f6", "value": 272785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772914231, "uuid": "911ece76-d719-4bb0-b9bf-b443886a0f17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772914231, "uuid": "5cf2a191-9637-4f73-a627-09cbe99e7030", "value": "Smadav.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6656e10-1a2c-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772891557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891557, "uuid": "22dab38e-2b7d-4202-b2fa-e10660379127", "comment": "Malware payload (ACRStealer)", "value": "7442838e0814db450e2e15c486bf407f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891557, "uuid": "cf2bc653-190d-4782-ae5a-12b16591e4fd", "comment": "Malware payload (ACRStealer)", "value": "b98f9d03286b5221f643cf05b77158c051e5dfe62c02d030ee9b880c29c86dab", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891557, "uuid": "f1be6a54-41e1-40a7-bbda-06a884d5809a", "comment": "Malware payload (ACRStealer)", "value": "0ae8a40f501ba7df68e3983104b1951b7e59e5c9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891557, "uuid": "11ec27c5-e2ce-4570-9f87-8043c603cef2", "comment": "Malware payload (ACRStealer)", "value": "6c2cc39665b322b2c36c0886a2752e8806083eee531de7409bdb4c90df259146a44049a5b0bacadcec76b758d7c6b1f9", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891557, "uuid": "3019627c-1357-4bba-9ee6-69287c0c43da", "value": "T150852911BFD79D6301C897D28B9792D8ED21492EC396648CF1E9805836DDDA80F9CBEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891557, "uuid": "f743f449-bf87-42bf-bfdd-e921ff320381", "value": "12288:rlhWnm6Tkt6GVRrlXMrVO6feU7AGM7om2pwnep4rRwaF2CiAHuAHuj:rl4nmay6GflUe7Gp6XFdi14G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891557, "uuid": "cf85456a-cf1e-48a0-a77d-4367a1c72a9f", "value": 1735377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891557, "uuid": "f885e5b5-20a3-4e2f-a643-d7b140b08bc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891557, "uuid": "03abb87c-f276-4b05-b58e-7e6caef0b796", "value": "messagebus.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca870aa-19e5-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772860778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860778, "uuid": "043c7390-c3eb-43ae-8362-b6017ac16c4f", "comment": "Malware payload (QuasarRAT)", "value": "75c3b29dd351228bab20770474e8f93a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860778, "uuid": "f2105de0-bbee-4811-bef1-811c5b9b5f21", "comment": "Malware payload (QuasarRAT)", "value": "b9b51e29d004739a401a3628bd5b48cccb9bfa5bbc67dbacd3be197a5be32285", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860778, "uuid": "2d6dcbc0-a576-40db-aaa5-6e63067dd113", "comment": "Malware payload (QuasarRAT)", "value": "1be457e4917560cf3f028adaf759a315a8e40894", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860778, "uuid": "843af075-53e6-4d78-b850-e73bf2d4983d", "comment": "Malware payload (QuasarRAT)", "value": "49b2afefa087891ea3f45b7e7d3575a1e01f608bc85e577c4e40c22a259b51c6fff9c51b92b0fe16c3968206f74329fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860778, "uuid": "bb327e2e-97f4-4da5-908e-256add102785", "value": "T169D4122037FC8107F1BF6A7989F221016676FA63A623D74D1D9462BD4533742A9C33BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860778, "uuid": "c5e5f355-76b5-499e-98ac-7a059063c3f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860778, "uuid": "f6de15fa-71bb-43e1-8c8b-68bf1769f973", "value": "12288:cPRb9qoSjkqjVnl36ud0zR/6CtQ9PUHIG8Dl8gSD+37PWY1Y1+f7LfNLi03nI4:cJ9mjkqjVnlqud+/2P+AlUDcPt1aKFLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772860778, "uuid": "dd89d247-cd40-4100-8156-dbd689116530", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772860778, "uuid": "b846996f-2e93-4939-9306-755b55d16dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860778, "uuid": "607573c9-2b36-4d0a-b6f5-56a461b3fdbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bcfa77-1a26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772888608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888608, "uuid": "39f5d388-c966-496d-af34-9858b346ea65", "comment": "Malware payload", "value": "ba761774bcc91d6bb31a9980f6487a25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888608, "uuid": "ce790aa8-06da-480b-a1d6-7ca8385df9c0", "comment": "Malware payload", "value": "bd8312234ea3808101b17e5e7ef4d4b840e60269cda347d71279a00d843cb8bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888608, "uuid": "748d6c52-8935-4e5e-b0f4-3cca690a38e9", "comment": "Malware payload", "value": "7bd2ceb74305b99e8081e8a2ffac00baea809065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888608, "uuid": "ff50bdd9-3774-456b-90b2-76866af7a598", "comment": "Malware payload", "value": "a341a424161fd29e6f6b1c2f5cb5a7ae1e97e7fdc784b48068baef307cbc7198b056c8d5ac48d0614266759cd574cf89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888608, "uuid": "dd6e7a40-f5c3-4f05-8cea-3ead85afaa68", "value": "T1ED26332AF2FF6A78C2439136CEFBF0C659151C4964DB636135DCFB4572DA2E00928AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888608, "uuid": "11cb5606-2d03-46e2-935f-64ba8a07c27a", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888608, "uuid": "89954b4b-7347-4dcd-9713-e5245954b239", "value": "98304:ZRH5wYAGFm8pS6lOs960ijj4fkGwLZP9uA8KtG:ZRHvAGgWS6Is9cGwLZ1D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888608, "uuid": "77a75474-8159-462f-9aa3-4d84b26e8088", "value": 4544512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888608, "uuid": "167524b8-2eed-4a3c-a143-509837e9bf0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888608, "uuid": "a36f1b7c-66e8-4dc9-b880-70bad7e4be2e", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.4138.18150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4f7426-1a36-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772895618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895618, "uuid": "0fb880db-7437-4346-857f-4a310967d316", "comment": "Malware payload (ValleyRAT)", "value": "e8463de5a8ad78a8707dc40b0c644309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895618, "uuid": "f3e6bf4e-cadf-4040-8a0e-f1f749a62a59", "comment": "Malware payload (ValleyRAT)", "value": "bddd6923f088a7a6847237b420c118473ab418d4de2772a35991402d5b0ab0e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895618, "uuid": "c3adba9d-0168-4afe-ada9-c22282dc13d6", "comment": "Malware payload (ValleyRAT)", "value": "7f6f867bdd3e2ffce4ea5f2c1de702a436b7c7ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895618, "uuid": "036e4598-ddf4-4afc-9703-06cc56158d43", "comment": "Malware payload (ValleyRAT)", "value": "c68cca6489ff4d943df831953493bef4ce635ff9f83b73e659fe8da027df86f19af84f83c052fcebf4aec859677fc6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895618, "uuid": "46aa9bf6-79ca-4912-8cd8-1f26bcf5cfdb", "value": "T143F5F113E28E673EE06A5A3549729910583FBE60A51E8CA3D6EC3E4CCE391501D7EF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895618, "uuid": "f15d0951-25f1-41ee-a796-2a400277f199", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895618, "uuid": "6bff38de-9d21-4ac4-8267-7ff0cba3d2c0", "value": "98304:OnfhrIscJhzXTyEq9MF3H2qu9POjhPJ+yXMv:OnfhrGJBOtqLe8P9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772895618, "uuid": "1c3c323f-0b5f-4890-843b-52bf112a459c", "value": 3386856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772895618, "uuid": "6e795331-03e9-49a8-960a-c478acf1b7a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895618, "uuid": "d1d7097b-f105-4fad-80b3-611748426ff9", "value": "kwpswnsserver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06c7ceb-1a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772892352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892352, "uuid": "2c1a374e-2323-4138-9b14-08672931c65a", "comment": "Malware payload (ACRStealer)", "value": "8a7ba7d1faf3cb908bb14fef90b23341", "object_relation": "md5", "Tag": [ { "name": "46-149-72-66", "colour": "#5DA61B", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892352, "uuid": "8e95700b-d3b3-41db-b610-093d563b995a", "comment": "Malware payload (ACRStealer)", "value": "c2475b4b179267d3dd7f9c54d9e9f39b21109baa2c5d7e5acdc5e49d11bb1e95", "object_relation": "sha256", "Tag": [ { "name": "46-149-72-66", "colour": "#5DA61B", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892352, "uuid": "b1d2dd4f-4fb7-4be3-b7a2-ab86a9904e37", "comment": "Malware payload (ACRStealer)", "value": "39df90aef2afecc6ae9f6bdd031783d120960633", "object_relation": "sha1", "Tag": [ { "name": "46-149-72-66", "colour": "#5DA61B", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892352, "uuid": "d0ed11ac-4235-49e8-afe8-557001cc1a37", "comment": "Malware payload (ACRStealer)", "value": "1e2d3673749fa467ca0ea673c5b4384cb71c380b4b52413638691696d8070abb1a80deff7706c6f4c4228bf0e1d8bb14", "object_relation": "sha3-384", "Tag": [ { "name": "46-149-72-66", "colour": "#5DA61B", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892352, "uuid": "b325a5b9-b768-4aae-bce7-efdbfd8a81bc", "value": "T1BE955A00EEC744B6E8071B3259BB62AF273598090F36AB97DB447A7DF9B32D50D26305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892352, "uuid": "eb75e683-c8c7-4794-95c0-b79f4f77db68", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892352, "uuid": "c2e552cb-5738-4e18-9e5f-bfbfbcdd1ab0", "value": "24576:MO50X1LvyxPSiTewBXPxnJUH2zrG+bv3bSKD1yarVBk1REK:M1a0iBZOivLJ1R7k1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772892352, "uuid": "0cdf5584-15c9-4519-a87e-74a456524048", "value": 1897984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772892352, "uuid": "1c55b72e-871a-49b1-afa3-19c1b386b460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892352, "uuid": "6ad63b77-6f01-465b-b548-2462f7e484f3", "value": "acr-karimichikstrelyaet-639081475329349420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0769f2b5-1a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772892042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892042, "uuid": "4e670176-5698-4e32-b914-4fd2377032ad", "comment": "Malware payload (Vidar)", "value": "5fff2e55625742f84f44580177e9b229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892042, "uuid": "90d8bb69-9920-47c5-804f-723eba9e3096", "comment": "Malware payload (Vidar)", "value": "c24b15924c32babf89879019b3ab92f90dfa05fbcf2d6c02bc4f38ad9221c465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892042, "uuid": "b4cc1a1e-eadc-4c75-9131-5aec88d5bf75", "comment": "Malware payload (Vidar)", "value": "0f03311cf49ba0ee0db66be55bef21a141a08292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892042, "uuid": "4af07e2e-fa31-4fe9-bf25-76539f3899a0", "comment": "Malware payload (Vidar)", "value": "a335e6dffe6a9a78d942ed2c18a1eac836b61963b43f70ad63dcf95e0c6f672a2261e1903f3848fc848a582c0566e37b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892042, "uuid": "629da4a4-a1d6-4fde-8baf-8951e1ddd668", "value": "T1B4D42B7DAC50F326F70C90BBE286E3535E6178410636A99319BEE72001458B39B5B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892042, "uuid": "807ef0dd-5121-4980-b0b9-08ad60aa2adb", "value": "57594b14471500698dd38c5d2e664b86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892042, "uuid": "ceb19dea-7792-48e6-98a8-8bf1c78a9716", "value": "12288:jU2FJXk2WjWnLFTM5rdwhFmdV8Bew2/1gdu:Q2bXk2WjwBM5+XBew2/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772892042, "uuid": "ec63bde6-9037-4b25-b3f9-c676586023c5", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772892042, "uuid": "25ef916b-4d57-4702-b45c-04e17feb2217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892042, "uuid": "bfecc402-f6a7-4c0a-9424-3fe658bce703", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb080e7-1a4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772906521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906521, "uuid": "483ba030-b38d-4a52-926b-25c66eed0344", "comment": "Malware payload", "value": "aa98ef939e1c0745d379c209598aa2b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906521, "uuid": "070aa32f-eebc-456f-9576-0a03b2d83520", "comment": "Malware payload", "value": "c2ecef24d949afba2cc697f5eb6fa23f52b09ae2522cd3eaf7b3ede38fa926f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906521, "uuid": "6bf89dab-5569-411c-9ac7-b5e902654346", "comment": "Malware payload", "value": "e35a5b4f71021c72ed17a7a5833d7e9ccc3c5fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772906521, "uuid": "24e9fec8-8b12-4551-a39d-d22ade9be666", "comment": "Malware payload", "value": "601fce7b0566f5a93929a7cc0c49bd1d866afd992dafb6ce16707385c27defebeba5dac94f7dbdf3d883bc944a48ead9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906521, "uuid": "14decdc7-ae1b-4868-98be-c494ea3d4af3", "value": "T19BE45B167ABC10A5F0F7837DC862C64AD27AB8459361A3DF02980A9B1F329D5CE7D731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906521, "uuid": "f4c289f3-316f-47b2-9796-e0bbf356db38", "value": "8bdee6252ccf5f6e11722e188a7c5f9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906521, "uuid": "e68f72f0-25e3-46cf-9971-b5bdb71d9294", "value": "6144:h416oK2GTZPOnE7lsJVDZVfCj5YnjXDeFDBmWptnq62+wsTkq4X1HGsyJ5XVKKMb:h41oJ7aZRCjeXDeFDrfKlTyJnX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772906521, "uuid": "2cbd7eb5-63bb-48b9-b9e7-f8de37ce6bc3", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772906521, "uuid": "1b5a825c-3bc9-4ce9-81e9-8fea4ad5cd2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772906521, "uuid": "bd61a42e-2c79-4934-9cf4-c17f194cfd3d", "value": "Run_62172143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b013355-1a04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772874116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874116, "uuid": "99dbddc1-5d8c-4203-9991-8528a1fa67d9", "comment": "Malware payload", "value": "6e258deec1e176516d180d758044c019", "object_relation": "md5", "Tag": [ { "name": "Hefei-Qiangwei-Network-Technology", "colour": "#C11A2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874116, "uuid": "75725f33-4d95-409f-a4a2-bf62c313d1fe", "comment": "Malware payload", "value": "c31af2c52dde677c33f8bd9e2a35c21ffd585e7c7b8e9981aa8c5afc89fed006", "object_relation": "sha256", "Tag": [ { "name": "Hefei-Qiangwei-Network-Technology", "colour": "#C11A2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874116, "uuid": "358858bd-c8bb-4348-83e0-7df1e87a08f2", "comment": "Malware payload", "value": "08f7df06291ecb344b2981cd49703833dcfb9b51", "object_relation": "sha1", "Tag": [ { "name": "Hefei-Qiangwei-Network-Technology", "colour": "#C11A2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874116, "uuid": "9646813c-e85b-4bae-a772-c5638c59db58", "comment": "Malware payload", "value": "bb7e4aad44b8c1643f16e2fbc90ae0cb9c15fb9600d93765ccd655d4b8fc318ab28e4d932824ac1a605d0704e60b99a8", "object_relation": "sha3-384", "Tag": [ { "name": "Hefei-Qiangwei-Network-Technology", "colour": "#C11A2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874116, "uuid": "edb28ca2-49e5-482e-bc23-4ac8e0f4a54a", "value": "T1BDF73361F8C44637E5E71175687C6FB55A2EBC21032080FB6788B5EE0CB17D12E366EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874116, "uuid": "0e8e8491-efed-4248-8f8f-8fcb96032537", "value": "1572864:YV/RJI5YQGOJ4xZW/c5c3aDGCZvcYCcZCvE5n28H8:kZ6YOueOcKDGCZ0YCgCvEUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772874116, "uuid": "0a5e1880-4cf8-4a33-a41c-30dfefd47534", "value": 75720192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772874116, "uuid": "2a09c63a-a087-47e0-baad-58427bf10c92", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874116, "uuid": "fd8ddde5-4e6e-42ef-8814-5dac9e9190fc", "value": "c31af2c52dde677c33f8bd9e2a35c21ffd585e7c7b8e9981aa8c5afc89fed006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27d5f45-1a4d-11f1-a769-42010a9c0008", "comment": "Malware payload (Fuery)", "timestamp": 1772905616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905616, "uuid": "56c38789-f011-43b3-89d8-7694346b6667", "comment": "Malware payload (Fuery)", "value": "e21181cb7bd7735b7c2dce3fdd533098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905616, "uuid": "48967168-7eee-4562-bac1-ca0884a5b42e", "comment": "Malware payload (Fuery)", "value": "c32e3e9204f8a8f77376f5800785b95f3a6a5521b205b759376dc7eb4664dd64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905616, "uuid": "d8fa0c31-daed-4583-813e-0edc85a8e462", "comment": "Malware payload (Fuery)", "value": "a4ac3f1eef60c5247e545dbf8e0a2af59954a631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905616, "uuid": "e9e2c0ec-5bd9-46aa-85f4-264bd2604b93", "comment": "Malware payload (Fuery)", "value": "1b11413484f2bcf375922712c8b44a06419e5477b371fabb754b2c7a56ed6547e063db6fd7550c800006dca484cdbc49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905616, "uuid": "f3c04f63-5c1b-4b17-9892-c4ec0bf618dc", "value": "T1E0853905FEC744F6E8071A3259AB22AF2334AD092F369BC7DA447A79F9772D50C26305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905616, "uuid": "f64843e2-9909-4538-ba81-6cc91591da33", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905616, "uuid": "549ed93f-7e72-427d-98d6-119fe92abeda", "value": "24576:eleDr7Usw0eegUkfMvzeHKJO2ygRVEsSSjiYI+iNJT+Ek1bVL2fj/SzR:eleAP0oUGcdf9jdViNB+Ek1Yf7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772905616, "uuid": "d6f0d25c-44f5-4f42-85ba-5e411be0012e", "value": 1794560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772905616, "uuid": "2f1fad06-dd87-4578-9fa6-21a4f128f462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905616, "uuid": "46663b83-6178-468d-9df6-445b930ca6f6", "value": "b1JNsvy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842093aa-1a47-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772902988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902988, "uuid": "c5408bfd-7247-4dc5-bd1e-d92bbd0ab31f", "comment": "Malware payload", "value": "e0b4a1fedc6371871626c06723c0abaf", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902988, "uuid": "6ba6656e-93a8-4946-97cf-074fcd8eff82", "comment": "Malware payload", "value": "c3368541abec527ee19a522ec39dbbc3759a2569afd0c351b83e881658024dd4", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902988, "uuid": "ecd5e97b-25f8-4368-83a5-48c22006f5cb", "comment": "Malware payload", "value": "22405323d53eae4d2bbe5d8d766e82ca440e90f5", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772902988, "uuid": "f0606cbe-f2c2-421b-a5f2-49173c72d1ff", "comment": "Malware payload", "value": "dde3bb513acd6de72ed5e88b6e1263fcb71c0bec95005a37745aa8c569d46a49a6b54a3d985f134efae8ac7b0b502e80", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902988, "uuid": "9be6a830-ee6a-4679-aa54-b5da28c9a066", "value": "T1E1963361E16819CAD86EE87A71F12A8143D71317D292D03DC4922AD936F23CF9CCDB5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902988, "uuid": "01872322-2cc4-470e-a8ae-4edee8f36b2d", "value": "196608:+ZftX5dtaqrCa9T4g0dp4H2NL430uU+HB/OGUElH6XU8YYlbHXUk:+BVlXDUbdp4H2Nc3rU+h/PUEl0U8YYlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772902988, "uuid": "6d9f2048-8d13-4e22-8cd4-7846b4fd8205", "value": 8859300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772902988, "uuid": "668a7f9b-b66d-4658-834e-5f8a85aa3c3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772902988, "uuid": "6f3bf1ea-1dd6-4ea8-b590-f0fe44303ad2", "value": "bkmsiqop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bd55d5-1a6c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772919070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772919070, "uuid": "7f825334-2c44-42ba-b166-29fad12b49b5", "comment": "Malware payload", "value": "57c31bc90d9d92858b2b969dff3667d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772919070, "uuid": "11a3c093-d8e8-4f09-ad8b-d6aa4f7dac44", "comment": "Malware payload", "value": "c49b42122a4d12404ad17b9eff6c6631954a8812280fc6af70de15694f911c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772919070, "uuid": "d3b4d4e1-41b9-4e6b-89ba-5580f0e11c3c", "comment": "Malware payload", "value": "13ec1dab5587c07687d211fd916d2024ea5239b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772919070, "uuid": "1828c645-39ab-48e8-a0f8-9a8ca92f9e1a", "comment": "Malware payload", "value": "1cb521aed1fe86d7b282dd3978e001d9813352df6f4ff1ba4fd371de63390a1b48877c0cf33b079c284bf79e564fb4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772919070, "uuid": "93672264-680a-4de3-b37b-0f93c07228b4", "value": "T19556F0DE451F6626E1E2663A9553C2B37CBE3C0F8259EB9AE7520DF28B443805F50F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772919070, "uuid": "1d71d009-8762-4091-be91-341018ceca5b", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772919070, "uuid": "f7c512ef-ec04-439a-a265-3dad2ffd77ae", "value": "98304:ExJ33eSBXw1ijE7XkslnFfSt9ZdNCULioiIwUy7XADTJ:iZuSB8ijE7XXFfSt9Z/CWmvU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772919070, "uuid": "b3a0eecd-fb16-4fc3-b480-295b65a26769", "value": 6292480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772919070, "uuid": "987dccd1-d960-4f9b-ad60-a6a4054c8bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772919070, "uuid": "83316dc1-c2c7-4264-8a38-5df10ac77a37", "value": "SecuriteInfo.com.Win32.MalwareX-gen.79885452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574de2a8-19e5-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772860822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860822, "uuid": "67ce4fd0-0813-4eba-b946-cf375caf7dc3", "comment": "Malware payload (GoToResolve)", "value": "288d1f5710de93e1a7996d43f051f8c6", "object_relation": "md5", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860822, "uuid": "b7b42825-45ee-454f-9e50-0b5d26b9b188", "comment": "Malware payload (GoToResolve)", "value": "c6a09cbbd82ccf6a85d570f2f8606777984ae26e8394a2645bf195c4b60ad8dc", "object_relation": "sha256", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860822, "uuid": "2613540e-4ddd-4dd1-b774-b0a7186c280f", "comment": "Malware payload (GoToResolve)", "value": "735c1ebb6a2b9fc68ed580ace995a41edc1b11ea", "object_relation": "sha1", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772860822, "uuid": "ebabbdd9-6510-4e2c-8b2a-73b02fb00d4c", "comment": "Malware payload (GoToResolve)", "value": "cd7004f91c97f60c0aeee7a79e987ef023176eb1b88b1a67883651d92c3d7bb98d4dd00e78930603330acd3b5e08cb59", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860822, "uuid": "0ad9ff8c-8096-41f2-b576-282c4f5580ce", "value": "T11D37336231858031EAED0172DA58DABE816D8C314F6145DBF7ECBBB85B343D26B32617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860822, "uuid": "148bb811-7a6d-45ec-8600-910936b0e3f6", "value": "393216:zu2TfDZAmE5tCLWTK5O6xGtGBcu8Djj+HWabd1cHkHVNuZ3IjA+bn1yGDH82PPbL:qErOtUWTKFMtGBai2UrcHk1NrE+pq2Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772860822, "uuid": "8432737c-e23e-4d2b-99b6-1c1a1edfbf8c", "value": 24526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772860822, "uuid": "163b35cc-80ba-44e0-b1ae-92473637bb78", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772860822, "uuid": "47eb62c7-f3ff-48a2-a836-f0769d1aa788", "value": "ZoomWorkspace.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63e86ac-1a2c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772891583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891583, "uuid": "76ae2a34-514d-4ad1-8184-f951197f6538", "comment": "Malware payload", "value": "c8744ee36dcda16b0ae6f303e0886b3d", "object_relation": "md5", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891583, "uuid": "661bf51f-d0c9-4772-b332-18b613e515c6", "comment": "Malware payload", "value": "c710287c8fbfaeae5b293a8ed8179f324fc30a0cac2e8030843256281a081c27", "object_relation": "sha256", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891583, "uuid": "cabec889-f83c-4013-bf83-f565e40660d8", "comment": "Malware payload", "value": "fae8f737abe340e69ed04ad8a3f904c260652c9a", "object_relation": "sha1", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891583, "uuid": "66095c48-00f5-4f8f-95d1-eabe016b2099", "comment": "Malware payload", "value": "9d64d9b6174444483e83085eeaf2f550cfd2057c498d5c5b3d5d37e76849a0768cbc89db6d3c712f363a9d7004620567", "object_relation": "sha3-384", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891583, "uuid": "c315cf2c-fe71-4b28-bcf5-b65bcd84d4af", "value": "T1BA016818100D4A00D15ED6315CE931FB6659D77EB3314B9A073C54CB0FD3513198AF2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891583, "uuid": "3a99ddad-7f42-4ca5-b52b-83982faf86eb", "value": "12:5jRQFyaTmvIKiFRlzhd7GoFtuLsZD7cjmcIXwBASicmncFyaTmvEtaK:9RvaaIKiFjzhd7tbuOcjlDB7iPjaa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891583, "uuid": "60aa015b-4fbb-47ba-a202-8c1475df22fd", "value": 694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891583, "uuid": "b9a91855-990a-4861-a304-0abf701672f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891583, "uuid": "545b8d5f-4409-40ff-9312-2e12c3be5c81", "value": "c37b6635cf769abdcd72f70137c2dcb8321afc185358a7323f4db4efda791d33.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c380c4cb-19f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772869164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869164, "uuid": "7a3e2081-6bcf-4d1b-9e5c-34e74380c7ae", "comment": "Malware payload", "value": "a7b7729327563e5933badea37f434c5d", "object_relation": "md5", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869164, "uuid": "482d9a5d-86ba-4f1f-a690-812cf1f7c33d", "comment": "Malware payload", "value": "c720fb790c11048aa7d112a8c3020980f7eadc13886ed59a8df501ebd488e7cc", "object_relation": "sha256", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869164, "uuid": "658e05cc-8c99-4aa3-b710-1135d8b877ab", "comment": "Malware payload", "value": "52902bdc0598f392cf48773836f252e309be0b59", "object_relation": "sha1", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869164, "uuid": "885c983d-b6e2-40ef-b2d4-b55e25bfd35c", "comment": "Malware payload", "value": "022c9d4b34f34cb671fc5e00db8b5da16b6644dbfb88b80aadbe637fb01f5b888e2dbc69dd60778e4b259c921f456a36", "object_relation": "sha3-384", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869164, "uuid": "019e9f26-4a75-47eb-b510-985d245b340b", "value": "T1DE372934420312ACFDF9CD349A2BCF8DEC4D466BE5136548FE1B70742E8AE55663B42A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869164, "uuid": "999018e1-673c-4ecc-8495-febecbc99754", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869164, "uuid": "974289f9-95d9-4533-a58b-b8b9300278a2", "value": "768:Rhk1Xo1p7Lq+91/XhbJH9ktdD08c8UUS0uQx0hEAW43oaVR2Q5FPiA+x6ekCGhAp:M1Ae43Qx01oaVR2WPidJk7Aps8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772869164, "uuid": "39c0ad07-8579-413e-a77a-dffda97e8ae7", "value": 22994432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772869164, "uuid": "0301e3b3-f72d-4145-88f7-33c83224db77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869164, "uuid": "4ac320ba-95b1-410e-8785-3c95aacb1e04", "value": "c720fb790c11048aa7d112a8c3020980f7eadc13886ed59a8df501ebd488e7cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1ef9c7-1a4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772905664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905664, "uuid": "9e3ec7a7-bb3d-4fbf-92c6-9485f4807449", "comment": "Malware payload", "value": "793489c42cd6090a187ca7834ab79932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "Xploder", "colour": "#736C0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905664, "uuid": "ea46bec7-a7b7-46b9-8b90-e3ca6d2d4756", "comment": "Malware payload", "value": "c7f250f5b35a0d5865ca56ef4d03b9b608ab5e8695ee0bcd2f743818b0a37d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "Xploder", "colour": "#736C0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905664, "uuid": "f8c07b77-4272-449e-bc6b-83901bfec880", "comment": "Malware payload", "value": "3b0e58e158737997ea5ca512a9eb97f1b3f663f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "Xploder", "colour": "#736C0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772905664, "uuid": "3285ee8c-7870-40e1-b79a-ca07ad15b8fb", "comment": "Malware payload", "value": "c8e9a61c662294d55bee1c50f1cdb785815c21633163eaa7da9934d78050c9b1e038ab5447a67f69e7a5293f3e2fe0b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "Xploder", "colour": "#736C0B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905664, "uuid": "91f6281d-fd59-492e-801a-8e8ab845e3eb", "value": "T19D125C03FF950A62DB6C0B70237399F8C57A76A21B11B2D397F7D8584765698B0128CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905664, "uuid": "b18cfe76-d118-4df3-a8d9-ad1bc4cd5781", "value": "bb4b8a8ce6823d715017136d9139675b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905664, "uuid": "a612d391-a478-4be7-b2ae-da64cd0d6339", "value": "192:KP3dr1sjDV1yDWJrjjOQjINWPnjH77E5pz6SMTGLk5Hh:KP3dr1YDjyqJnjPjIonjb7/GA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772905664, "uuid": "57f4eb14-843f-45dd-88dd-1e6a7d37c837", "value": 9746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772905664, "uuid": "bc944640-679e-47da-b78f-10fdcffedb7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772905664, "uuid": "4f9b3cdb-e4f4-42d9-a1cc-cad03c8d6965", "value": "\u65b0\u5efa \u6587\u672c\u6587\u6863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7a73d8-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871089, "uuid": "1495b7b9-4829-4502-84a0-3f4bf29170b7", "comment": "Malware payload (Mirai)", "value": "1887e5afa306c4809b8bf23194dc9785", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871089, "uuid": "183d475b-68d8-4694-9ddb-79c001148db3", "comment": "Malware payload (Mirai)", "value": "cb41b6234a2255ce774d1f87ad4f5332eb30102b6ba0b96f682042ab13e56aa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871089, "uuid": "fc7dd9bb-3a8c-4251-88e2-2c54ff8e3ce6", "comment": "Malware payload (Mirai)", "value": "9becc22e7620fc28d470f03222740001fdac5cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871089, "uuid": "01c44648-07c6-4c3a-9490-8d47f2847625", "comment": "Malware payload (Mirai)", "value": "6bdc8d0baf49da56ab34b473db03ce60573b5b7d54a50320abe3d286f7a52ea9bf577557675fcc49ce7deecc8100e0f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871089, "uuid": "1ef25946-82d4-424a-a97d-5a69c1554c76", "value": "T1A0E2E01AD55B3EC0CBE17EF02FE3ECC28A348F0EB3A48A95514BAB452610D16785DDD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871089, "uuid": "4ddcb092-f73b-46a7-b9d0-9b9098726ab4", "value": "768:tN5xUJuXR7TrlHtvhBJfS6lZ1g7i7IEOQXNZJR3Tjdr4uVcqgw0zL:te4hf7V1o+7Jdn5dr4u+qgw0zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871089, "uuid": "5477890a-4d24-402a-b69b-490f07c2f95e", "value": 34028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871089, "uuid": "4495ca3c-a664-4df6-b81f-499e87f3c2d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871089, "uuid": "a723eb40-31ab-428d-8c21-37ace9dc811d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3534f287-19df-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772858188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772858188, "uuid": "a42365ff-9ffd-4f55-a916-1d5131259f63", "comment": "Malware payload (Vidar)", "value": "099a9d592a6b8eacd08f099f84dc3985", "object_relation": "md5", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "roblox", "colour": "#2C7474", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772858188, "uuid": "db16b0e6-042f-4bb5-82a4-891ffb550775", "comment": "Malware payload (Vidar)", "value": "cb4e2eb1535211460c39c9a6437c0f38bd3580c9550934567c8cbf690d4f9acf", "object_relation": "sha256", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "roblox", "colour": "#2C7474", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772858188, "uuid": "a00f2b54-4bce-484c-b0e9-1f408b13ae58", "comment": "Malware payload (Vidar)", "value": "982e41d1a0b20962c9f2dd2b57faea7036164f9d", "object_relation": "sha1", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "roblox", "colour": "#2C7474", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772858188, "uuid": "e2e6fa6d-c299-46b5-a161-9f59107774ac", "comment": "Malware payload (Vidar)", "value": "994cc3b71d81f5a866b2000812f14ec82b5527d884d914252d5100ad455598572755d8799e582c55f2f35085d89d837f", "object_relation": "sha3-384", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "roblox", "colour": "#2C7474", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772858188, "uuid": "270bc848-ddda-47a0-84da-6982c567926e", "value": "T15DC57B03FD9089B5D4AAE2359CB643A17731B8580736A3C32E2766B42FF27E45E38754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772858188, "uuid": "e0518513-e0d2-4117-8098-5efae065bc61", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772858188, "uuid": "dd283243-9462-4522-af50-779acc7878fb", "value": "49152:tn7PzaL+VHiyK1sP+nljNLxEUjf0McW0YgtwiOm4:tvHTPELx/jfNDiOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772858188, "uuid": "56219e71-80d1-4b64-b750-54ea8bbeca9c", "value": 2625602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772858188, "uuid": "4f3c288e-36ed-4d26-90f9-25b51aab094e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772858188, "uuid": "a0561d37-48f3-4526-9dd8-09e1c5b6c181", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74527a6-1a47-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772903101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903101, "uuid": "653e1b0a-9c0e-41d6-a003-f8ba1d45fb7f", "comment": "Malware payload (RemcosRAT)", "value": "f81e80a9b58d73e242092b842a919b4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903101, "uuid": "5eaea6aa-9c9d-4ed2-b4e1-1d0de35d4acb", "comment": "Malware payload (RemcosRAT)", "value": "cb9b4e58dee1d24d5ad6ef6f6503300edb95e2014a37b7eb407e654740200ac6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903101, "uuid": "9ce05774-6da6-49bf-b2b9-255666fb82c7", "comment": "Malware payload (RemcosRAT)", "value": "72f86d6ab274af8e76ad58b5f4ec47d3e49bebe8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772903101, "uuid": "89a44742-9379-4117-bcea-3727cc6c4c13", "comment": "Malware payload (RemcosRAT)", "value": "2beb0ea254db9146b641399ca2bbfd1c849a04eeead45add0a5e02d3c385bb8edc9fa6e470fe1f99a31c5672947b0bfe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903101, "uuid": "e13777e0-4318-4aa9-b7b0-fc11403facad", "value": "T181450F0A0FE1E0CAC7CF15910B55C7A98DC8D793728E416B3C9EDFC69680E6B64D9722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903101, "uuid": "76400e70-07bc-4c57-bddb-8d88e06b7a90", "value": "192:M44444444444444444444444444444444444444444444444444444444444444X:z2tbvlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772903101, "uuid": "409d884a-9ce2-42bf-adb9-8a319c19cc3f", "value": 1242145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772903101, "uuid": "a6f7e599-953d-45c3-87c6-10d441e6db8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772903101, "uuid": "6c28196e-025e-4e8e-bd1d-2c0e4848ecfe", "value": "f81e80a9b58d73e242092b842a919b4f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773d25ff-19f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772868177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868177, "uuid": "75cb5100-66bb-49f6-86f2-0a53004902d5", "comment": "Malware payload", "value": "2f4154c3ba2cce72320a540d3cbaa3f2", "object_relation": "md5", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868177, "uuid": "e33f40e5-3c6b-4a42-b7cf-e6b890c78558", "comment": "Malware payload", "value": "cc83b0beee26e35269700d4c50c472abf12e7ed46850698610c07bed0525fe83", "object_relation": "sha256", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868177, "uuid": "224f8597-9780-4fcf-a1ab-8e4b695ac94a", "comment": "Malware payload", "value": "747330b5e9da4dfaba2d62d58c2a1e62ee099bc4", "object_relation": "sha1", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772868177, "uuid": "7deb9460-950a-4a62-b7da-cc5ab79e98b6", "comment": "Malware payload", "value": "d6b5e8369e8d1c0e0779e0e51091e676434e504c7abcea2f2754d12dfbf75210a17752403ffb80ac38aeaff2f9dce86f", "object_relation": "sha3-384", "Tag": [ { "name": "contatoplus-com", "colour": "#7D4F54", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868177, "uuid": "78966c9a-1d54-46d1-9e9c-81f898308eea", "value": "T1B8D0971E00242C239FAC842E1A0DAAAB41C30FC3BC3AF88D560805429028A7A200C0F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868177, "uuid": "c0dbe84e-d064-46fa-9b52-cf96ff283642", "value": "6:vW727ygttE7pIwFuAeviLPn6l9vltSW5lnk:vKgttE76w0lcP29fSW5Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772868177, "uuid": "3416de4f-a11f-4bd8-aef4-893b899c81d5", "value": 237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772868177, "uuid": "65861c17-2d9c-4eac-b919-2e9344a27cad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772868177, "uuid": "801268ec-d570-4cbe-a74f-59293c1f460c", "value": "cc83b0beee26e35269700d4c50c472abf12e7ed46850698610c07bed0525fe83.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449e331c-19cd-11f1-a769-42010a9c0008", "comment": "Malware payload (VenomStealer)", "timestamp": 1772850483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850483, "uuid": "314b913d-6383-4046-872c-0834a0250d7a", "comment": "Malware payload (VenomStealer)", "value": "3640dc6e844cd3c3940c4c231e656bf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850483, "uuid": "28948c69-6e00-4d51-8c71-818362e3af16", "comment": "Malware payload (VenomStealer)", "value": "cd139883e7c08001becf7a9a864c91691bc243c3adb5c87ce94729f9b24a56ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850483, "uuid": "da191263-4c2c-4c9a-ab23-c2cc92de127f", "comment": "Malware payload (VenomStealer)", "value": "1e0766edeff6ae8c71754398e8bd73dbb188fdeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850483, "uuid": "63a68c4c-c2bc-4ee7-b5bb-a42cfc17d4f8", "comment": "Malware payload (VenomStealer)", "value": "2a5f1c97075e1bf992736c20ea3edb0c5df55cf8343ca04fa78adc216b9c63382ab19dfa308d8b13102f997712f4ed71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850483, "uuid": "50c8f08a-434e-447b-973c-7dc0d1aae1b7", "value": "T18F36332BF7025FB3C98C1330BADB4F1D7F6708B5636206815AA5063E7D9B3496EA9D40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850483, "uuid": "363329df-4702-4776-9c87-03dafe0ad7ce", "value": "06d50f86e105a9ae07bd076b70bc2181", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850483, "uuid": "3f3973ac-a735-4937-a785-f6eb277deaf7", "value": "98304:em89AGiS+nndq1VQ4wS7vzpeKZki6VR9uwtdGxnMgmMgF:zGiS+E1VZnTyIUdGqg5gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772850483, "uuid": "00ea302e-2a6d-451b-b0f1-c3de4abe41ff", "value": 5195264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772850483, "uuid": "902a894c-ae90-464e-ba54-41667800a678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850483, "uuid": "809597d1-33fe-4d49-a0ba-401c8f6e3620", "value": "SecuriteInfo.com.FileRepMalware.57442841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5937d16c-1a54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772908500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908500, "uuid": "b70fe703-3c86-487e-92b5-fec805fbd480", "comment": "Malware payload", "value": "9d119a5ac367be7dd43ed0ffff7d2167", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908500, "uuid": "6a309948-25c7-476e-9770-6c3ed4483c86", "comment": "Malware payload", "value": "ceffb43a1accb587a4d7dcff57320c74d60cdd7c73cdc287518fe2e269390258", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908500, "uuid": "d4379ecd-1bf3-44a5-a21e-98aea51a73ac", "comment": "Malware payload", "value": "c6fe8aff5653b0e51ec4d66be5388d9c0a04e096", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908500, "uuid": "00c40f95-e60b-4354-a075-e6cee6300a24", "comment": "Malware payload", "value": "44e660cdf66c856d2ab208084ede99c3debefafcb8def46ca27f443ee5fb4dd32a68a3b6de9cef24e31490c9f93054cb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908500, "uuid": "d5f07dac-280e-474f-b022-c1b6df2b7431", "value": "T18EF5AE123989C673E5BF93305969C73A92F97EA1377344CB63E49E2E0E319C14636B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908500, "uuid": "38f5a78a-c4b3-4e32-bc7a-6592de54dbcf", "value": "98304:XAfwrtyw4veHjPMNaHYpN0njSTBIMV39ZAs:wZeH9WGn0jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908500, "uuid": "37cff6e0-389d-4f54-97fb-73474cce0cfc", "value": 3479040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908500, "uuid": "39b2a715-ce1b-4185-be62-494ef713e80a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908500, "uuid": "baa412ea-c92f-4798-80c4-55c8b11acd18", "value": "Game.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f145fc-19f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772869136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869136, "uuid": "033b7bba-ec98-4981-80b0-63dfec5d8f07", "comment": "Malware payload", "value": "b31ceba17476828e6980703f79939f7f", "object_relation": "md5", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869136, "uuid": "db931424-a927-4294-8deb-9fdbbf485668", "comment": "Malware payload", "value": "d24d61daecd109dcf9e4a9569c6030234069246bc3f2a16d3bd2fca5c6bf664d", "object_relation": "sha256", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869136, "uuid": "b5501a63-88c1-423d-b9a8-68fade4cdf66", "comment": "Malware payload", "value": "6c7c5aba8aee2e44d95c9c88f15f68cf30277a7c", "object_relation": "sha1", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869136, "uuid": "4ce26aa3-efed-48d8-b6ed-88c00f09c6ba", "comment": "Malware payload", "value": "308b5100b174a17adbdff6e58319e79dab6f9bc607a73b963d5a2ad542088f92f4c7c9309cdf6206157e179cd8695c5e", "object_relation": "sha3-384", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869136, "uuid": "da7a9fc3-12d8-43a3-ac22-f88f59986f7d", "value": "T109372934420312ACFDF9CD349A2BCF8DEC4D466BE5136548FE1B70742E8AE55663B42A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869136, "uuid": "7c0c7e09-eb12-4cc9-abb9-9dd6baa30592", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869136, "uuid": "f59bdd6d-5d61-48dd-bed1-b7edfe11c810", "value": "768:Ee5tV8OJLpcGgHzi6MrgUS4W0Alke3oaVC2Q55PiA+xXKMhAps8:Ee5D8Cy1Mr24BAeOoaVC2kPidXlAps8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772869136, "uuid": "5a025286-6d49-4c19-800d-fd26fb9c4f1b", "value": 22994432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772869136, "uuid": "37e4520e-0af9-436d-bdf5-af635bb57950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869136, "uuid": "2847b6e3-ab0e-494a-8748-4f3b2c22c827", "value": "d24d61daecd109dcf9e4a9569c6030234069246bc3f2a16d3bd2fca5c6bf664d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456d2326-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871100, "uuid": "40094927-26ca-4c04-9266-802658611b69", "comment": "Malware payload (Mirai)", "value": "5ecbf8d74ea966ccdbebc6cc0d168157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871100, "uuid": "ad8d8ba8-35ef-4e42-85d4-2b90b0c48034", "comment": "Malware payload (Mirai)", "value": "d31c42e894e82fd56bffc9911156bfdfdcdd341493d2432ddf49ad4360dfcb08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871100, "uuid": "096a1672-40ee-41c1-acb4-98efdb8322fe", "comment": "Malware payload (Mirai)", "value": "e00babc2510d7ded64482b43202af3bf4398ca84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871100, "uuid": "39ec5554-c5b3-4c39-a6ff-60346ae1ff54", "comment": "Malware payload (Mirai)", "value": "c90ba489b4e72a82e423fc2480adbc937f6865a56ba411d4d4dd8e4496282df9d08070d21c5bc7a594b2427984b2013e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871100, "uuid": "2e99835e-3994-4c5c-86bb-1ac6c902cafe", "value": "T1E7A2C0316B42BEB0CA752A76CE3581C30F431B7C95BE70931925C5A87F92503CAE8783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871100, "uuid": "bb4a5a93-47d6-481f-a4be-4bea3e1ed0ad", "value": "384:jwBENYpq3OPdU93aDFewBGGGOOb5r23MFph7qmdGUEpiah0:jwBiYo3OlK3MFewoGGOOp/9q3UELS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871100, "uuid": "a33f5614-2fa5-4426-8f0c-50ad4e8c8234", "value": 22196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871100, "uuid": "88de7fcd-6062-46a5-82e8-0a413d140cbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871100, "uuid": "31f80062-e275-4345-a372-b7f4f05bb7be", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0033f0-1a54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772908474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908474, "uuid": "ab17ff4b-81dc-464a-bcfb-36eb2339666d", "comment": "Malware payload", "value": "9ff750418853474ab44075dde72d0992", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908474, "uuid": "a322df7a-ac18-442a-b536-1c5bd89b43fd", "comment": "Malware payload", "value": "d37362975822e819a528acd9339b880fd7de69d13a41d13e67dbbfc3d6ba80b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908474, "uuid": "60d49ac9-c7f1-447a-8ad4-7b9ccaeee3ed", "comment": "Malware payload", "value": "cc97486eabd9af5099e4629e2ca84a90f3201160", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908474, "uuid": "d7bf727a-3c3d-4604-924d-21b970cd18fb", "comment": "Malware payload", "value": "cb1e4dbe09ee1abd76e987d92724370fa7c08ed6dc174d5716422ca2e618c93157662bba67667f759a3d331ebc4db0b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908474, "uuid": "a48170e4-d685-47c7-a683-03dcd50aea95", "value": "T151947E37F6E08433D1732A7C9D5B969DA829BE403D38A85A7FE81D4C8F397817425293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908474, "uuid": "65e19017-a220-4e2e-a3fb-4293774c3e67", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908474, "uuid": "5ecfca08-b6c4-444c-ac04-5ebb7df5736d", "value": "6144:RYWpdzqVX1EOQxCkUPAr+Y7CKXTcIVHAS1qbY0MFnX+9aiCXJb8jTObmTl:fdzqVsxiPAjFdASTiKhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908474, "uuid": "1ed8cac6-3e1e-4928-9368-0e33b3e0094d", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908474, "uuid": "83ab0bfd-c736-4a7a-82c8-3712539ed6a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908474, "uuid": "7baf9a8e-4938-4504-a5a7-85528859fa66", "value": "SecuriteInfo.com.Variant.Tedy.901394.970.26726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3c6e7e-1a2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772892484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892484, "uuid": "f12099e9-1437-40de-9a19-8f67093e8369", "comment": "Malware payload", "value": "b3352f06bac8a83ffe09e81367847e6a", "object_relation": "md5", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892484, "uuid": "8107453d-afab-42a1-b0c0-57c3074fe0b6", "comment": "Malware payload", "value": "d3a6b3200f9016ce1afaf47cd35aa826ad84200c6ba9e60e4eba7d7063e11090", "object_relation": "sha256", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892484, "uuid": "db825953-4c5f-43c8-bf11-fe478109b68e", "comment": "Malware payload", "value": "2089a205bbe0843d863fef84b83e0772298b2ea3", "object_relation": "sha1", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892484, "uuid": "e80dcc78-e48b-4c04-b0f2-642b6f520e25", "comment": "Malware payload", "value": "7c3a2e7db2a48e9c0c43b054588fc0ba22d2ba73f0637906f8c221aca59e790a0e818bcd4d2f6f377d5a8aaed29a2f8d", "object_relation": "sha3-384", "Tag": [ { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892484, "uuid": "e5fe06a2-9dab-4d27-aca3-357ea06dbabc", "value": "T179114201480FD6C7904221D168E77068DE93C0B124FB7D766208C4EB6A34879BD480E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892484, "uuid": "48a3f100-cd24-4411-bf42-993644720468", "value": "24:kA+sgh+W7TTTTTTwjQD/BFiILkpkh8HnBzWpQ/ZhmH0ZpYb:kAbCTTTTTTgWqx/TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772892484, "uuid": "01ca0336-b469-4b99-b111-fb8e0f977a05", "value": 1089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772892484, "uuid": "9b1f2f94-2bb0-464f-b82e-8184e79c1edf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892484, "uuid": "6dd32e13-9c40-4725-86cb-2d916a098ac3", "value": "hOV.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c79e62c-19ce-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772850926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850926, "uuid": "400e0e61-7769-4cb5-a6a8-493a2c746a05", "comment": "Malware payload (CoinMiner)", "value": "9fd79604000d938d42a6df1ec67f2570", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850926, "uuid": "63711a0b-214e-48bb-820c-c6422a090cfc", "comment": "Malware payload (CoinMiner)", "value": "d3cdfedf6fc008456d947d9d9ae7d71a97efbd78faec4957272f19a5466d5ed2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850926, "uuid": "111ebb43-1560-498a-9a86-ba24d135e1bc", "comment": "Malware payload (CoinMiner)", "value": "f61cedbfd578e308331fb9e567f501f4e864a0e2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772850926, "uuid": "b0cf0d9b-7716-4d69-863c-eb90715a15cc", "comment": "Malware payload (CoinMiner)", "value": "f912371c5d88093e1122b3f29bd133fa470b0183f24aceafc7c80c1d0a7885e0cbe827dcead69b0a0e606615af9faba2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850926, "uuid": "e8d1dfa8-9ae8-4d57-aead-db8ea18a0161", "value": "T1DE065C17FCA114E9C0ABD2308AA69152BA71BC440B2027E72E90F7783F77FD06A79755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850926, "uuid": "05aea5f7-f0db-4059-b142-52ea3fa677d5", "value": "49152:UscL/PF2bp32azpb3JWBo3Tn4qy4kcy1mUU212+rwsvfSKuJs:UhNupa+L4LmUtYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772850926, "uuid": "0987cc8a-d6cd-4c99-a24f-749492dec1f9", "value": 3874792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772850926, "uuid": "99164923-896d-468f-9b65-8e9daf28eba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772850926, "uuid": "4ccd34da-e928-453c-823a-1f35bc619879", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4282c0fa-19f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772869377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869377, "uuid": "d0aa6447-df37-4d9d-8ede-fe7144679f8f", "comment": "Malware payload", "value": "7d0985c563ed0b895e2c551f658b7f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869377, "uuid": "2b9579a3-7780-49f0-9e84-1ff36b6a2a19", "comment": "Malware payload", "value": "d51df332558a7bd2908e81b2896d5dbdc100b33e849546dacdf54296ae4332e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869377, "uuid": "b673f00f-bc2e-4164-aa77-7bcd58b6e6ec", "comment": "Malware payload", "value": "f6f964f8e88b8f102cf5b2e19a3f50eba270a82a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869377, "uuid": "0d657182-2ff8-407b-b5b0-fa105c73e48f", "comment": "Malware payload", "value": "23c3cd255c932fa58842a1def891da2c192b9c91a795868ac17ed8e0526bc053b5d54fba9910ac17c3eccbf98fdc0db1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869377, "uuid": "e44aa15f-3c3a-4bd1-8060-08dd7e6241a6", "value": "T1B726339C40BAC364E74B617441F79AA5C30C3C225CC929992BC6E6A836B79F5071EF4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869377, "uuid": "014a82be-a3e4-4fda-9247-493a74b3f794", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869377, "uuid": "a8a0a452-b520-4296-b25c-19fe528c5edf", "value": "98304:CRswRNPw4TrxwLypDC0pqhV1Q/2dMr7douqnDoh:CRswRNVTgyhCo41Q/2dc7euqnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772869377, "uuid": "c0a5faee-8993-4a66-97c3-f778dff738ba", "value": 4637184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772869377, "uuid": "0596de1b-52a3-4f46-a980-c86572d14035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869377, "uuid": "df1da74f-7a8f-4c1e-9481-fe6ce233acfa", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.3471.23560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db72606-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871087, "uuid": "09102cfb-e080-4034-a4f7-c898c765218b", "comment": "Malware payload (Mirai)", "value": "15de28136a9268fa4e1dc929dc8c4f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871087, "uuid": "b669442f-cf49-4d95-a6a1-58efe965c227", "comment": "Malware payload (Mirai)", "value": "d708c1319fac539fef6e4ad61c2d9acf58427f00b63cdd00f9e1d3ee2a60e759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871087, "uuid": "b6352ef5-cb29-4ef4-86af-e4f136a51d7b", "comment": "Malware payload (Mirai)", "value": "2ee851cea26836e16bf9cb681c1d374bbe8c7c28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871087, "uuid": "931d90d2-3a27-4714-be33-7de18a746b7e", "comment": "Malware payload (Mirai)", "value": "b5efe1200e8f475a1f788ebf8150d740fdbcb37984c496433fde9c981ed8169f5e517e5008ffdbfd1f0f82b9757c6efd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871087, "uuid": "09939ba4-1d74-4bba-bf2e-9ad530b06f14", "value": "T194835B22BD7A2E27C4E4643A13F74366B1F6175F20E89A2D3D750F8EBF60580B51A1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871087, "uuid": "d75bb6aa-f80b-4081-9f73-86dd3fce4d45", "value": "1536:sv2MZXFZlvOpHRFdoEH+VFrHcGC9c755Rt2aA23:S2MZ3EeVFrHcl9cV5++3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871087, "uuid": "7a80bccf-396a-4b79-896d-dc9103163ac4", "value": 84872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871087, "uuid": "9cd8527d-d8e5-44d7-aaa6-4f429b937225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871087, "uuid": "b8cb902d-acfc-46d8-90a7-690a311f5ae8", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1b5ee0-1a7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772926547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926547, "uuid": "67754d2e-ed46-465c-bec7-7115ce558273", "comment": "Malware payload", "value": "42232c7da502961b605c506d6109fe00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926547, "uuid": "2eed6b28-2623-4183-8d5b-f72bdfab2ddd", "comment": "Malware payload", "value": "d7f045fa2b486cd10dd5ee9cdf348e92f5764989d91c9ec472d306e523477830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926547, "uuid": "fbd3bb02-76f8-4e31-b44b-e78ac829e209", "comment": "Malware payload", "value": "2372130858995f5f84ff936834deb7ae6449ccf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772926547, "uuid": "7b119a42-d8c4-4f86-a581-6b2012ad77d7", "comment": "Malware payload", "value": "3e68a4720e458ea67725aa0f49cdbda8bc955289eb3ea9e1707776b54769c450690fdb9455386377d67134d0a717b725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926547, "uuid": "cef54cb4-e9df-489c-9bbe-4a3060ca0a40", "value": "T11266F0CB9260912ADCE2177A985CE3505F650F8D68E8C4543EEA78CB4B23EF33574987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926547, "uuid": "deefcc19-dcdf-4e77-b705-238b67be72b3", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926547, "uuid": "a6993ef3-d83c-47b8-bf63-0445f0a01dea", "value": "98304:6xJJV6+SHSfCLt2ueeayJ6Bg+Kq2yCSNWag73/RN2ImAkO:456+21LtAmJ6Bgf7yCSNWtPt3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772926547, "uuid": "e2008183-5b8c-472a-a043-bf0cb7c465c1", "value": 7079936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772926547, "uuid": "6fa26ee9-7fb2-44ed-8d6d-f00f6ca7f135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772926547, "uuid": "e36eaed1-6e63-4a49-8094-7f2397a77dab", "value": "SecuriteInfo.com.Win32.MalwareX-gen.89352258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e5adb5-1a32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772894081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772894081, "uuid": "f1c373d6-04f1-400c-b5ba-d608e9ef4a10", "comment": "Malware payload", "value": "403493853263d14cec8a4e4755a5786e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772894081, "uuid": "f2c05de7-4b97-4838-8896-596efaaf1058", "comment": "Malware payload", "value": "d88197ac2959bd26e822afb85edc1a601e7e67a7497b816a22d6c74f782eb7b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772894081, "uuid": "a49813ef-e409-4c90-85c2-d7fec9dd1989", "comment": "Malware payload", "value": "47e2003a691d8690925d46a95a11bd0f79cb4944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772894081, "uuid": "2a118733-af75-4d86-b17a-c4d5212fb8a4", "comment": "Malware payload", "value": "ecc54fb97533b0678a670160f9ccb96d77cf8a2095a0b7608619b08f8e63f01e2cf583ef8a75f013608391ea8349a80f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772894081, "uuid": "f9da48a5-6ce6-419a-b9a9-4bec65223ba0", "value": "T11DC4335477759AB2D3B81DA805CDBCDCA53285C012131ED3E89006FE5ACAE135ACEEEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772894081, "uuid": "56cefd1f-3eb2-4faa-966f-c14b7d1abec6", "value": "12288:Cq3fzffTItBUXwVdDPOjS1tbozv/pRxKGAQeA+XZAlLl:hzfEtBkjj8t0D/p5fAZ6Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772894081, "uuid": "7146912d-0ba3-4b15-ae50-8c22f3a51ed8", "value": 589564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772894081, "uuid": "0bbbce55-1345-4b9f-85c1-5e61e046b330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772894081, "uuid": "ee993162-16a5-4ba6-b186-3752b38b67e1", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a36c4cb-1a67-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772916528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772916528, "uuid": "4dca4048-b2d6-499c-a167-7a878ad3a38a", "comment": "Malware payload (Smoke Loader)", "value": "c39f757fded242b3c69cb742e5b8adfb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772916528, "uuid": "fad34515-b7a4-4a59-ba1c-1f629bd9bda5", "comment": "Malware payload (Smoke Loader)", "value": "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772916528, "uuid": "4218b23e-e661-4c92-84bb-f7db999bde94", "comment": "Malware payload (Smoke Loader)", "value": "a08c39ed82828542d6989c0687f42171c9200b63", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772916528, "uuid": "60f6620a-d5a1-49e1-a334-89f7a140fcb1", "comment": "Malware payload (Smoke Loader)", "value": "73fe54194638c2cfe247d548ceb036a81173f9589ce7b8da36f5f43408f0f18172859a625d0ec0e1c06dcc183a3bc92e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772916528, "uuid": "d51f31ea-9718-4bc8-b807-fd62766d0167", "value": "T13E12190F7E498172D3940DF013B64B8D8A7D54A33792A2FBF773C5590F65240E492AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772916528, "uuid": "94dbcbc4-8ef2-4373-8004-5d3dd89adb18", "value": "0b2f31160a5382dbf07d030ba66e1330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772916528, "uuid": "5f7ccd87-fbc8-40b8-8cb3-43187f61ffb6", "value": "96:kDb5RgtomuBk+Bd1sOD1kMZ+t8pwkMPFJxGE9mK2FFhSC7tCEanGh:YHgDuBkwZ+mePFJxT4KmFhvak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772916528, "uuid": "8dd24b54-b014-41dd-ab65-c8fcbcc64558", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772916528, "uuid": "7184e38f-8136-4c84-b40c-abe2c7270361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772916528, "uuid": "5ff75367-f4a4-4886-971b-bdd40a501315", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56651bc-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842109, "uuid": "8252d010-7754-4fa4-af6f-58111a037007", "comment": "Malware payload (Mirai)", "value": "30f95d85b5c0af8dbf3f1a6daf858928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842109, "uuid": "d0bf04ba-ac83-4678-978e-b278c01c2c34", "comment": "Malware payload (Mirai)", "value": "da5c870b9d7d7d4ca4f65f5a32af71627add436fd70568c0c72bf0462da45225", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842109, "uuid": "cc5f644f-4833-4589-b26a-decbdab2f5cc", "comment": "Malware payload (Mirai)", "value": "719965e7e3fa1600da96980350f24ef0f976ddce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842109, "uuid": "624a31c6-af65-438c-866c-d7a4b0a959ec", "comment": "Malware payload (Mirai)", "value": "6ddfb0a9d4c6fe6a363f078f6be47b9d211e703d79b90619cb2a218a32a99ec4dddc2d3a8e97de9795ba04c4e49356e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842109, "uuid": "c5e833f2-1fcd-4b41-a112-b939dcb0548b", "value": "T17EF3AE33D4787ED8C5609074B0B19E781B93B1A441571FFB69EAC179408BE88FA097F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842109, "uuid": "8979d2ba-2549-401e-be19-17247f7b83bc", "value": "3072:7MfgNCxzXrNJDPfxtP7AGLLUqhL1tmOJIWsRmZE+U:7MftrvPkGLLUqhJ5RsWEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842109, "uuid": "8fb872bc-278f-4da9-9d9a-645bace45d6f", "value": 172488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842109, "uuid": "d3860a37-4b21-467a-ad73-2d1a12c324b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842109, "uuid": "f516b4ac-83c1-4348-8ee6-850e04ab4e9a", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd012e6e-1a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772892400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892400, "uuid": "3d240862-6d57-44e0-a9a7-5e4caf90bae3", "comment": "Malware payload (ACRStealer)", "value": "7b29612470245ec4d70dc70fdea59f14", "object_relation": "md5", "Tag": [ { "name": "46-149-72-66", "colour": "#5DA61B", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892400, "uuid": "02c7e2e9-08dd-4d47-8d5f-1fe661e0b284", "comment": "Malware payload (ACRStealer)", "value": "db38f261a5ffff12334d8e6ed9b4b23808e70518534800b140077b18ab867984", "object_relation": "sha256", "Tag": [ { "name": "46-149-72-66", "colour": "#5DA61B", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892400, "uuid": "9b77f10b-c9ef-4b5d-a34f-946e5b606a3f", "comment": "Malware payload (ACRStealer)", "value": "5ee167c92f74cfdb33d2cfefa716c147e1f2afb8", "object_relation": "sha1", "Tag": [ { "name": "46-149-72-66", "colour": "#5DA61B", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892400, "uuid": "ef41a2dc-7e00-4d69-8ce8-f5e2bbb06874", "comment": "Malware payload (ACRStealer)", "value": "9155ecf51a51d91f332574a0b23570ddc8a35c7da78425bf67999002e4d4028b51571e9eb3770f04c06679e343ccdbcc", "object_relation": "sha3-384", "Tag": [ { "name": "46-149-72-66", "colour": "#5DA61B", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892400, "uuid": "86ae53ae-b117-4615-9342-81e5c24a7d64", "value": "T11BF12E93438402AE92848DDA404D791725F7C52B3C2D219CBBC366EBF83DD51BAB9B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892400, "uuid": "143927b6-9657-4eab-afb1-abef383c29a4", "value": "192:Mgn6Vmsh7Jnd/gMNWL2MT8uLOC6f+HZ74+hSKJW:p+vh7DZE3TFKhfUXYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772892400, "uuid": "db99f1f9-6a9f-454b-a888-78126a4ac1d3", "value": 7468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772892400, "uuid": "741260a9-8507-4d3e-aa0c-e364b2ef67f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892400, "uuid": "277f3024-a896-4765-b1f8-47d135009423", "value": "Config.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d120a6-1a65-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772915849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915849, "uuid": "46edaf10-cd14-471b-889f-8e32b7a6666f", "comment": "Malware payload", "value": "8f50e61a6c8db316456bc6c341197c51", "object_relation": "md5", "Tag": [ { "name": "150-241-115-97", "colour": "#2FD9FE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915849, "uuid": "987abb80-c9db-4e9f-a256-1fcc08758928", "comment": "Malware payload", "value": "dd1d69fa221526d8827ded25c2802bb4bbf60e4aa7296977559e91b783a08ed7", "object_relation": "sha256", "Tag": [ { "name": "150-241-115-97", "colour": "#2FD9FE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915849, "uuid": "d4b4905f-7682-475a-9248-85cb22e42c95", "comment": "Malware payload", "value": "7ae4fda309ab016c686a8406f75167effe053961", "object_relation": "sha1", "Tag": [ { "name": "150-241-115-97", "colour": "#2FD9FE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772915849, "uuid": "3f603f5a-e10e-4a12-a4bd-653ec72e5d26", "comment": "Malware payload", "value": "8d29218572235eff400940dc38521ab3a5ffaf5164bbeac45da3c7aabeceafb1811c9f47ca8f3efe6ec47743d5014cb0", "object_relation": "sha3-384", "Tag": [ { "name": "150-241-115-97", "colour": "#2FD9FE", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915849, "uuid": "9959710b-4199-4185-9cea-17846a4a0ab1", "value": "T1B2A2CE2017F54309E7F28A3AACB6E3208277FC14E922DB9F128456496825115E87AF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915849, "uuid": "53e7f0cd-2c79-4265-aba8-d22002e6cff3", "value": "24:8ooJDNnSgKugP8W/fROAXWMrks2+/CWnvU7lEykHX44I0w4L4I0CWvfehCef2m1:8FRnPgxXThrjv4lP63I9Iyee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772915849, "uuid": "80dfcf34-f47f-4456-b593-d60a9ccbde8b", "value": 22666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772915849, "uuid": "b19a1e3c-4f24-4cd6-8e53-d0db4f0a7da2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772915849, "uuid": "5e4fa9ec-fa15-49f0-92c2-f255f69abada", "value": "8f50e61a6c8db316456bc6c341197c51.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4197949a-1a25-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1772888274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888274, "uuid": "b56a8d44-f21e-48a0-b280-3de3e07ca557", "comment": "Malware payload (SliverFox)", "value": "378f5ff0628edc30305a68d054840c59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888274, "uuid": "bf7ad28d-a087-4d83-9100-6245250b343a", "comment": "Malware payload (SliverFox)", "value": "de77a2ad240ad63b1fd22f81bd74a52dc7a82dbf454d02c93bb4cfb50dadc5e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888274, "uuid": "3395aebf-fb3b-447a-8f5f-c6492d64f5cc", "comment": "Malware payload (SliverFox)", "value": "01663c6b2cdd9c6bdf236f6ebc83bf343992d3fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772888274, "uuid": "3770572a-4cba-4f4d-9a44-b12ce1f5effb", "comment": "Malware payload (SliverFox)", "value": "e058974e05b9a6c9c153196b6d57afd97491e453e224f5453b18f3b061d0cbf2d6030eac297cd15cfcf95838d8ea0de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888274, "uuid": "0801be77-0b16-471e-a73a-516ac2af5185", "value": "T13665021DFEE2CB94CC1317BAC05697E8591E4EE31E804F5FDB10082CAF69769689B0B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888274, "uuid": "6a04e627-c73e-49bb-ab43-5c7b90fedd93", "value": "5282726ed791aafbb31d7182b585551c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888274, "uuid": "b80e7f01-6ebd-402e-ba22-3c0a52527b12", "value": "24576:HmQXhiJLb8ICLnddO3CeWE3VKal5Mmz8ZRu8SkrAwC88DMRr6Q3jQtzrBbCocPZE:HmQXhiJLb8vzPiCeWE3VKal5M08ZRuuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772888274, "uuid": "bbfc3c8f-192b-4cf8-882a-6442d49cc96f", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772888274, "uuid": "8bba672e-60f4-40e2-b148-f18740d8bb89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772888274, "uuid": "69d9bbb2-8a1d-44c8-884f-881b0e990799", "value": "2026-03_2026.03.05.....\u65b0+\u6587+\u4ef6+FF.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c39722-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871092, "uuid": "189d9b63-1585-473a-8acb-2806bccd7a9f", "comment": "Malware payload (Mirai)", "value": "815cbb2ca19c7a8295efa0092214d24c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871092, "uuid": "f41f1608-cecd-46dd-bb07-2463f7c15797", "comment": "Malware payload (Mirai)", "value": "df0d8deb96f3eaefeabe7f8589a51a4ab3fa75bee78da59d47a486ba91913e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871092, "uuid": "666e6c87-ca9a-4c5d-8e94-683663e62bfe", "comment": "Malware payload (Mirai)", "value": "8ca57888a121231044027a237aa48c4b81e8c404", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871092, "uuid": "f9158b85-c971-4ede-b3c5-5bb4068564de", "comment": "Malware payload (Mirai)", "value": "522f2a3c94c919a45a5ebf4a02db8f6dc397723e64ab5a6f07ceda7a47ba1572d931060b8ce24ba342428a1b51b96e80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871092, "uuid": "b7b6ea54-9fec-4dd8-b289-dce5848a761a", "value": "T1B80301259533E86ADF30183596F511836527EBFCF4AE31BFD66188EC28D239210D5EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871092, "uuid": "f29a8ca0-b74d-49e7-a88e-91acec83eb0b", "value": "768:CsC9CK1CKkuIGGvYIVRsFBpAv1M42F7qJHkmPUear1HiLf84Z9q3UELUc:S9CUCKkcUVRssP47qJHhDaViLf84MLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871092, "uuid": "9b2eb690-f57b-4064-b10e-a69882c9b1ee", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871092, "uuid": "335f96ca-b591-4b14-951f-896ce43bde95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871092, "uuid": "94ce6ab4-2cba-4eb0-b6ea-402ccf30d871", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b139227-19e0-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1772858547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772858547, "uuid": "15be2158-968b-4ae9-982d-59e696ab807b", "comment": "Malware payload (AteraAgent)", "value": "9bc14b6e064bd12c0029eb307eed1613", "object_relation": "md5", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772858547, "uuid": "7436153d-2d86-4afd-ab2c-6db233be91bd", "comment": "Malware payload (AteraAgent)", "value": "df2cf850efcfd15b50b7621ed2b2c841a927061b5cec6431f1cf0f47bf41d537", "object_relation": "sha256", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772858547, "uuid": "d29abac8-77a6-44f6-a2fc-7b92b0d7accd", "comment": "Malware payload (AteraAgent)", "value": "c043aeaa2b69890e8cb72273a7fd4f8af50c5627", "object_relation": "sha1", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772858547, "uuid": "dee9629d-ca24-4aa4-b6af-c339c33bf513", "comment": "Malware payload (AteraAgent)", "value": "90e25ff61c458ad89a2882f5516898c478c9998c775cd297084c5855a9e54ccec90820b9a2f5db935e4859305d4bc373", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-100-57", "colour": "#935A54", "exportable": true, "hide_tag": false }, { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772858547, "uuid": "9b1e834d-ee33-4cf9-b326-341c1dc77559", "value": "T1BA862318FBE009AEE5778276C56A8520EA327C8D3720C54F47A4B6295F3B7A075BF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772858547, "uuid": "9b169852-3533-4312-a824-869a39708381", "value": "196608:dW/FMmnGYLnWgziirlb4/ieF3GrAfedpvCs3md8r:EMqGYLpZreF3G82yc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772858547, "uuid": "40e2df29-a911-4835-8492-cb6a42963753", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772858547, "uuid": "509c2242-3554-4e93-9bc6-60a87acdb3bf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772858547, "uuid": "6241d052-6a87-439c-a527-22610561165b", "value": "SSASTATESMENT_E-FILE_PDF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdc79d8-1a2f-11f1-a769-42010a9c0008", "comment": "Malware payload (CHStealer)", "timestamp": 1772892532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892532, "uuid": "fbf60ee4-04db-4987-91b8-222d1ead3f0b", "comment": "Malware payload (CHStealer)", "value": "1073c20c06b4a9a1bedced0afff46058", "object_relation": "md5", "Tag": [ { "name": "208-64-33-110", "colour": "#02AFE5", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892532, "uuid": "d53e7fda-e4e6-4739-850f-0c7dacf21e9e", "comment": "Malware payload (CHStealer)", "value": "dfdd4cdf6dd89b4c50a2ad96be9f2aa4c6e1c08ae50eb1de8169827555b0ef89", "object_relation": "sha256", "Tag": [ { "name": "208-64-33-110", "colour": "#02AFE5", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892532, "uuid": "4d6587ef-9c94-44f1-b5f8-356bf77b4893", "comment": "Malware payload (CHStealer)", "value": "663b81e5d344d68c0d028193e947c3e1a1b81b5a", "object_relation": "sha1", "Tag": [ { "name": "208-64-33-110", "colour": "#02AFE5", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772892532, "uuid": "7a165270-e3c3-4da0-9732-0fb1e64c0bcb", "comment": "Malware payload (CHStealer)", "value": "58cc7a01f611f8a6cea43461d9230089e3d18b85795fd6afca3e4eff211cb3a0cc5c5135e125b2de6ff431b2a10dc8d3", "object_relation": "sha3-384", "Tag": [ { "name": "208-64-33-110", "colour": "#02AFE5", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892532, "uuid": "912cc4ac-3951-4993-90f4-f3477e805a93", "value": "T1C79439A29F5B6E18E5D1A3F8A2253AD4E896BE351BF5D1FCAC2074145B3D361F0CE011", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892532, "uuid": "6f3d978a-ca50-4855-b720-bf01148fbc55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892532, "uuid": "2828dcaf-2b12-4dd2-a91d-eab15065df46", "value": "6144:rR76amUMYsqooXDvngI9WzeGReGrWzLaW6gM/d:rRua+YnpTYI9WyzLv6g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772892532, "uuid": "a08a80c5-1eb6-40d9-ad5c-79f2a1da88f5", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772892532, "uuid": "05c68444-1ed5-4fc0-9de7-55e9dbe6d7f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772892532, "uuid": "44976d2f-b4ff-424e-a33f-57aff17c93c8", "value": "Ocher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a2a88b-1a02-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1772873439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873439, "uuid": "53dd05bb-59c4-4a59-a114-911dcc55dbee", "comment": "Malware payload (SheetRAT)", "value": "9db20f80b33ee2fac57db72eabadfb41", "object_relation": "md5", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873439, "uuid": "8f3bf5dc-5d25-4171-b065-38152b33b8df", "comment": "Malware payload (SheetRAT)", "value": "e0fa3304cb2f97fbf268d0858e8853146c429320eec233245ec2895a60ae4bae", "object_relation": "sha256", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873439, "uuid": "c25640f8-7d44-408c-a0d5-447b38e3cc10", "comment": "Malware payload (SheetRAT)", "value": "1fe26f64f062ccd8727231fa161476775769ad14", "object_relation": "sha1", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772873439, "uuid": "389fd776-b699-4280-9c54-e1c567b6d5c3", "comment": "Malware payload (SheetRAT)", "value": "6c99f47b40617d5142f0791e57e32ed60b0e57d1a936c46441872d51c44cfc855b9dd8b50d58344702ef0314d011b208", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-187-0", "colour": "#158E39", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873439, "uuid": "ffbae125-a372-49fb-a4cd-23217f751300", "value": "T100E533366E4B56B44C49F6DF0F4C2B0198EBB8BD5C5E5048D52CC09F6F9AB8184E60EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873439, "uuid": "167e2456-ccc8-4f80-9ac1-ef54af205e16", "value": "49152:5zcQmPwO04KOMiA299cWweYbCZdnAnvtfMWhTzCdXFy7+ogIdwyP4Q9aCXxaTmwj:5zcNYOjKOMFWXlKXhTvSoRdw61Ba5jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772873439, "uuid": "e9b27936-298d-4b01-b176-14dcd7e7124d", "value": 3269552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772873439, "uuid": "fe581278-e5f6-4b01-a3f1-325492bfc9d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772873439, "uuid": "ab6fe2cb-46fb-4596-8063-eedbe8bc7d16", "value": "e0fa3304cb2f97fbf268d0858e8853146c429320eec233245ec2895a60ae4bae.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4d7b13-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871090, "uuid": "a1bc4ce4-2b84-48f9-b3b5-f68b180d9d47", "comment": "Malware payload (Mirai)", "value": "1861b3d1d14e46fadc7147e0dd39b6fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871090, "uuid": "e460b0ff-56c3-4c01-b10e-6a78e5dff682", "comment": "Malware payload (Mirai)", "value": "e321c583cd63262d356c53737f2887b6b12d7dca59988df81e14a4b0ed3fa147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871090, "uuid": "62e13e31-8923-4f0f-a2c5-6117a02c5013", "comment": "Malware payload (Mirai)", "value": "da1635da0551e440e608fa549c90f083d9f5ca63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871090, "uuid": "d7b068ec-e7fa-4198-a0c5-d82bd68b10c9", "comment": "Malware payload (Mirai)", "value": "c48328212794ba8e04cdb090f21d641aad6be402c585f99b93c55d4c3d6764af9f1e035ffe4467b1c8b3ecd3dca20bff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871090, "uuid": "d6851843-720c-4101-ae26-50b5189d5852", "value": "T1D7F2F23AE21FEDB0C4B9AE35FD3187A3254AB2D24440307305621EB167ED9DCABF9125", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871090, "uuid": "f69e0cff-f3e6-4d7e-a908-465d0916b1a5", "value": "768:YfjuiSV3Owm3Uah0Pc779twTc1DHWB8w4z1SQnr2Ss3Uoz0k:YbuLV3YXhuc772ADVz1Sur2PzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871090, "uuid": "4723fd66-3d4f-45c0-abf8-27a3a15a440c", "value": 35436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871090, "uuid": "93ab2040-2117-4f8d-879b-c16d514d79bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871090, "uuid": "7b09e690-2590-4c44-bebb-a6624298817d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b00e94-1a04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772874221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874221, "uuid": "1f730dd2-f49b-425a-b847-795f7562c516", "comment": "Malware payload", "value": "648659cf38cd402d9a62a797dfae3f44", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874221, "uuid": "ff7e09e0-9432-487b-a41c-11aabb543229", "comment": "Malware payload", "value": "e357dd02c9d4b5769b40dc0bfa35ca561fc132b65720eb109d5b8817c285fb16", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874221, "uuid": "f0c4a13c-6685-4a45-bd86-5fe52f4a72c0", "comment": "Malware payload", "value": "0bc27546e03d546f6a59e0be1bd0d4501b7b1404", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874221, "uuid": "d735ce5d-c469-44ec-aa05-51f44e735a5a", "comment": "Malware payload", "value": "2d992edb8f531df672d046a05318fdbf0f9624f33e78eec8e2f47add8ce9b386974988950457650cc169529ca431c559", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874221, "uuid": "5d0c4553-bf0b-4b15-a625-b7fae832adf1", "value": "T14A0723203186C53AE5BE0570253DAB7A523EB9250B7048E7A3DC9A7D0E719C19F39F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874221, "uuid": "da8ee057-cd0d-46eb-8488-c5846e50727e", "value": "393216:kckhuULI3NtrmkiIK4BTt1DHt6mZ99swz1Pky9DkpZWNze:kcEgrY45thNTT9swBddNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772874221, "uuid": "b028bfa5-4e84-4e26-9aa9-d635bfced13a", "value": 18293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772874221, "uuid": "fa79bc31-a381-4546-9174-2b5d51bd69d0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874221, "uuid": "e103613c-8f8f-4e95-b330-9f2840aa78a5", "value": "e357dd02c9d4b5769b40dc0bfa35ca561fc132b65720eb109d5b8817c285fb16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae5f119-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772865392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865392, "uuid": "413fccdc-23d9-4e2c-b0ee-b4decbcc5dee", "comment": "Malware payload", "value": "378498627215547ef3f807aafe1fdaaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865392, "uuid": "0ddaff6b-3b22-481d-9df8-d5977db1cbcd", "comment": "Malware payload", "value": "e3985857e1041604a3236b8366201b3289fea7861291198d2efa7e4115b5656d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865392, "uuid": "7d0eab9b-8309-41e7-b03c-2b5a48c8c971", "comment": "Malware payload", "value": "0ed3d8f43318f65ec2e79645ab473cb249b1579b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865392, "uuid": "631041b3-28d9-4118-80b4-a2fcf1296c0f", "comment": "Malware payload", "value": "3c6f06070065b7d8b0262081917a4cf92d21fed47d794245a153fca3391ed1a32979561705259cd166bf63a16cf325ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865392, "uuid": "255e0083-7a3c-41bd-8a51-15d83dea4b7f", "value": "T110052C7E5963912ADA8A80FC35594B6245B1B33B03B41FF700A6913167079B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865392, "uuid": "d71f0d59-a877-4f39-bd26-d9bf85be222a", "value": "24576:vfYLjX/atV00GAbTzUcW0UVoq8hGHdo3CkXYjT0:vfAvQVKd8hcCUT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865392, "uuid": "111b0248-f655-420e-919d-258ad7a521ce", "value": 852864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865392, "uuid": "831d2aa7-f990-4fd6-9089-e908fc69ef1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865392, "uuid": "c14f2159-3263-4d76-9b52-7a133175e07a", "value": "e3985857e1041604a3236b8366201b3289fea7861291198d2efa7e4115b5656d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ff66f8-1a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772890888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890888, "uuid": "621032ae-020b-487d-b54c-ed898de33426", "comment": "Malware payload (Efimer)", "value": "91899824b4dfe97ad75af5364165ed66", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890888, "uuid": "5534db65-d827-441f-ae4d-a6b122d9f896", "comment": "Malware payload (Efimer)", "value": "e582006fe94e1ff7af71d30c7be897a1ed00c7dfe299003880d6a60eed734d41", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890888, "uuid": "c3f28b57-7e34-4563-9417-b23fa895baa4", "comment": "Malware payload (Efimer)", "value": "3ec3344bf620c6242bfccbad554569936b9cc725", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890888, "uuid": "c093efba-2881-457e-95c2-bdf31376e124", "comment": "Malware payload (Efimer)", "value": "c075ab52e0a8d4a168491d2fbd9704eb5779f9ddafce223b77d74ca661ba4164e207a19ae0734f9af12358f6cabaacb6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890888, "uuid": "5a0fcbcc-8a54-4191-b1e7-d894bbb7f42f", "value": "T111D6330DA9E262EEC2A3C0F4A6F1A2F1E03D796D427EC93BAB44D3B1DC2B151D854517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890888, "uuid": "03e0214f-b92e-4c29-aa20-8fe1a2495590", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890888, "uuid": "ec5b0045-b667-4baf-a339-ba661648a796", "value": "393216:jBq3tfEWvE/c9e8QiWxXMCHWUjXTcuI3/PGTAI:j49fx0P8QnXMb8XQH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890888, "uuid": "a8afc3ff-f0c9-49c2-af1c-5b19517ff79b", "value": 12612683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890888, "uuid": "fcd8260f-f9f3-4686-a4fd-ee25f95d72b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890888, "uuid": "8d3f8f6d-9304-43c2-9080-656439a4b8f3", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e3e371-1a68-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772917212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772917212, "uuid": "52edcb00-2594-4fe6-8442-6a3a40ba18d0", "comment": "Malware payload (Smoke Loader)", "value": "425a275baa84e1b01f02391470a64505", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772917212, "uuid": "5cd5c9e8-3379-41be-84af-35c7b9c416bb", "comment": "Malware payload (Smoke Loader)", "value": "e62a0100c482453f0cc26d4e4db542ae25764386fd966b799ead1c4e5e417392", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772917212, "uuid": "4eda99fc-f051-4ed6-8615-2c8ac0d6e34d", "comment": "Malware payload (Smoke Loader)", "value": "5c7a619ec9c958776c08c16a1fcad682afc477dd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772917212, "uuid": "62cc1fad-c9a0-46e9-9f12-71be72cedbde", "comment": "Malware payload (Smoke Loader)", "value": "2cbbb636f190429cafa7fa2ed31cec9b2bedceb3d0509431d5f5e91b8ae664aa3a97c54e1e75bce50e37bdd9d2d52cf8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772917212, "uuid": "89baef12-5daf-4e3d-a0ad-f6b65671dbbb", "value": "T12C243A2BC25330FCE553C07892A66232B772BA3D47358EE70293D3359D61AC05FBA965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772917212, "uuid": "b48eec76-10e8-4290-b976-7545bad9e283", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772917212, "uuid": "f0449005-360c-4f48-86c9-841ece915475", "value": "3072:Ry+NC+3FGCgIuXHbTZvQJoUaCSC0CwMQv7PfyeLZlwABcJwBr:dDPgIuXHnZQyUSC/5ubfhce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772917212, "uuid": "c9a308a8-4cd7-4d85-9530-63bdf17a0731", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772917212, "uuid": "1e29108d-9641-48bd-a8ec-8514562c7aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772917212, "uuid": "d98b4bdb-d1eb-42b6-8816-ba961dfa5c80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da781200-1a69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772917736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772917736, "uuid": "3ad018b8-c2b5-40b4-bf5f-efaa9be064a5", "comment": "Malware payload", "value": "2609380857766fa218a4f09b09c03ce1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772917736, "uuid": "d463076c-adb5-4469-8ded-dbec04f9d6e6", "comment": "Malware payload", "value": "e6df5232d1baefdc2cd20916815d4ee9c63dca7dc66a3b838735329877ea45a5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772917736, "uuid": "31cb22c2-17c7-40c5-a9bd-d5a75d77cbee", "comment": "Malware payload", "value": "5ca6ae352c5b7e35428dbc57f5fadae16926f577", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772917736, "uuid": "73b795a4-2f86-4836-ad03-a824d6629510", "comment": "Malware payload", "value": "a2f3f1972920958b2ab74e09f51658fc6adaa1d0adeb878434f622d8aea64a37409ce0c2d96b0513aeec0c1da0b85cf7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772917736, "uuid": "92a35ce8-a898-438a-b9bd-9de3ba8a7a23", "value": "T1BC924CB512896C79FBD0CE399F3C6F4CADE8C2C42124A3ACBA0F39205A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772917736, "uuid": "fd8e0891-5d32-4252-ae55-1743087673bb", "value": "384:bacuQpWx+BL0SWL0gLzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:ba8i+BL0SI0szsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772917736, "uuid": "d8ea0983-7068-4901-bbb0-d2506f76a5f0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772917736, "uuid": "b684c8d6-4b1a-4eb6-bad2-18049180788e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772917736, "uuid": "e109f158-b13d-4015-b5b0-99af7de9765b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77686285-19f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772869037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869037, "uuid": "e2e330c6-447a-41ac-b80a-62f7695d81e8", "comment": "Malware payload", "value": "271217fb7298d918bfbfbce831a4960a", "object_relation": "md5", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869037, "uuid": "a7a05e8f-ea0b-48c3-ac3d-1b2e51687ffb", "comment": "Malware payload", "value": "e7d2b3d450603a237ca5a01d5335acb0067a28de78de21bc4e37c24d81fd4a61", "object_relation": "sha256", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869037, "uuid": "4afcc10f-be69-4b5f-bdbc-185ad1d51d29", "comment": "Malware payload", "value": "93d1f3a7c2da7c347514b6d2423539c04a5b917a", "object_relation": "sha1", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772869037, "uuid": "906970c9-c329-489c-a1cf-42f8fca298ba", "comment": "Malware payload", "value": "7bba6f0506266d6556debd50cf9cac47dbb9b1385524707bcf893765a1d8a81958845e964536e5c1eaefe00df3eed0bf", "object_relation": "sha3-384", "Tag": [ { "name": "93-127-133-106", "colour": "#FFF257", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869037, "uuid": "5fcd3fed-747d-4746-a3a7-3b907a0f572a", "value": "T1D59312AC6CF08F9CA26CF7EF695FC57A13D2500D14A82B141A16CEF44634591BBB33A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869037, "uuid": "08112cba-a9fe-400f-9f0a-101bf9bfda03", "value": "1536:REHZ3h8FysYtbwREpjYoYGThoLUG2jjiOMeFqE9wrDQldIo6J+kZ3qrpsSRfaSDL:GHZ3F5oMMofu3JeoDZJBVqkSDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772869037, "uuid": "4a794f44-19db-4e65-9bc8-9b8969d12337", "value": 95848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772869037, "uuid": "81f6cc9f-401a-4a05-86a8-d69ce9e5a4ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772869037, "uuid": "e5362455-edae-41ef-91c9-ca75fcfaea6a", "value": "e7d2b3d450603a237ca5a01d5335acb0067a28de78de21bc4e37c24d81fd4a61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb7fdf0-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772841883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772841883, "uuid": "46916cc7-4165-49db-bb04-386650a23d2e", "comment": "Malware payload", "value": "a9018fd08c2d1b6b6cccbe5a7d1a2c8d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772841883, "uuid": "cfa47e63-7601-47d7-8cfe-7989a9c2269f", "comment": "Malware payload", "value": "e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772841883, "uuid": "b2163a27-0a2b-44cc-8d50-35d9ff627735", "comment": "Malware payload", "value": "e1cc4cef1f7d7794edce15d84db5ab8bc6461380", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772841883, "uuid": "0627f294-2029-4fad-94e1-fd3eef5b532d", "comment": "Malware payload", "value": "96c39c2bc4b24a5def3b9706468aa537a334279c5ce83631400bd2439627115d328bfa3b61a3fabc65990fdc45df47d8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772841883, "uuid": "2c3ebfa1-ecd0-441d-a929-7c50744f44f4", "value": "T1BC068C93A693E9E9C31BCCF9C551673EA7D3BC29231DB2530A69F34DAA33D246604704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772841883, "uuid": "213bd123-9323-4b99-a8fe-d0ab755a8d31", "value": "c05eafbf2c8c8448f56fb1998451e045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772841883, "uuid": "f986124f-2d28-4b59-8be4-69f627a0381a", "value": "49152:1oJesTo/llvt+4hzsifepH7ZBkwdO/yXgoGIAb9VFd5gI1hJYOfCo:HlVoWztmpH7ZBkwdoyTGIIb5LnJYOfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772841883, "uuid": "d0910625-7035-4fd3-b5be-a17f69084e95", "value": 3850240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772841883, "uuid": "fa8aed39-86f8-4aae-8645-c2b1b4229d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772841883, "uuid": "2d883bef-7bbe-4847-b294-1a40f6ad80b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25e8c2d-1a31-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772893590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893590, "uuid": "5c88bad3-3419-4131-b515-cb60b70e0eb1", "comment": "Malware payload", "value": "b300ced4550e23bf3712d825095ac4f5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893590, "uuid": "1b041655-251a-40f5-bc69-a00ba1e250e8", "comment": "Malware payload", "value": "ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893590, "uuid": "fbaa11ed-b9ff-4183-b8a0-8efe85ce671a", "comment": "Malware payload", "value": "e4cfe475742ee52dc1d3ba9b1cc106b0cad1ea80", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893590, "uuid": "dc15d82b-baf7-469e-ae78-27b6e8da9ff1", "comment": "Malware payload", "value": "391b8fb9872dfe39afd4c4952aeb709f7a240f2abe7b9ce42d6531a0d5062088d6ab797703f2a95bc78efa07ae0a045b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893590, "uuid": "c0a5150a-b1e6-482c-a629-d1e282630e7c", "value": "T16EA633E0F584AFC1D121D93153F880A5FADE18666093DC62BC132F9E65936F3B7AE448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893590, "uuid": "01e29084-0db6-4c72-ae7e-acd802e7a1f9", "value": "196608:y5+uWL63x+mb2ZYYLyIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9CPZ8K7//4:zL63Mmb21uhOnn7FUNyhGprLz0gh8OQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772893590, "uuid": "b2bbf4cc-aab6-47bf-a67d-d8b7452c24e9", "value": 9525729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772893590, "uuid": "78fe148e-0dbd-4c44-ae0b-b5e150a55acd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893590, "uuid": "a016cc70-2db2-42bd-aa96-83b91d682b04", "value": "kfhogts.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f226d319-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842184, "uuid": "9824ee86-205d-4663-9c24-4ac50e32c428", "comment": "Malware payload (Mirai)", "value": "313197ab6ece24f20a5dffedc0a3ef4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842184, "uuid": "d04a5348-6480-473b-8496-1e35dfe0b87d", "comment": "Malware payload (Mirai)", "value": "ed946e15160678e136b1698c20a54248e9dedb63bd4e48e3126a55a8346279bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842184, "uuid": "8fa8454f-79b5-4505-893b-29aaf8ccfc3a", "comment": "Malware payload (Mirai)", "value": "4e1e7d6e0781345e3470ef74ab1118fe7a8f999d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842184, "uuid": "8c8baf24-dc32-4b61-bf16-acebe081a1a5", "comment": "Malware payload (Mirai)", "value": "7d131caf8daca687196f6ec4ad5d475e6f28946075dadaa014dc5f9fcb5c71c90daee42c081f6d0871b0bc5c7dfe3ea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842184, "uuid": "d54f5e2b-0252-4fd5-a07d-0ed513337806", "value": "T1CD34D71E6F228F7DF369873447B78E25975D23D626E0D581E1ACC2105E2078E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842184, "uuid": "04f53cc9-f146-4547-8c11-7e6ab2d249d8", "value": "6144:47tEkIDZXy8PxUhbI5XCagS/CdbeUtYWg0FhMbm9azYQN3uJSAb+PtrTkXJkuVBQ:OfV/0O+iiyfaoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842184, "uuid": "6362c452-0b73-4269-a338-73429264940f", "value": 248020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842184, "uuid": "4581ec41-fb4d-4baa-bda5-50146ce45f84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842184, "uuid": "f34b582b-7959-4e7d-8942-f8a1719ae28d", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68034522-1a53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772908095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908095, "uuid": "6fdcf40d-94d1-4600-9c57-8172dd717985", "comment": "Malware payload", "value": "b722afd45b1f7a24eb991248f6197613", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908095, "uuid": "1e092607-d4bf-49da-a7a2-d06dafd46eab", "comment": "Malware payload", "value": "ee15d5c331416dc251b35cc7c738bb54de0608daeb4ccf31dee3694c2b6c58b7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908095, "uuid": "9fa6c58b-d0ff-419e-be6f-0b97ffa99f13", "comment": "Malware payload", "value": "f14a8f57ba4a24e4dac4946223ff2f803e59d333", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772908095, "uuid": "efa1effd-d189-46f3-a152-936f045033a9", "comment": "Malware payload", "value": "2af53fe6f77c23aaf61d50acb0cf3c858c128655af2a9552d814b6680daca3e7e023d917f91b7d25d0877d821377e4cb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908095, "uuid": "d3b744fe-d10c-4a89-a9d7-adbeba86d183", "value": "T114F63320BF697CBE063C433DA0AF5E5C17B00F65849DF0DB52E5A9C3159FBA0991B81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908095, "uuid": "bf4a2184-904e-4a9e-8aa4-974c3fedae2c", "value": "49152:torFHMTOiMNCDcs997c6RXyjVDEp5YnPdgATUcvSgXumtWT3soLwc/GWLmb78j/c:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772908095, "uuid": "637af330-55c1-4aab-b131-9708e20088dd", "value": 16248979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772908095, "uuid": "9c6208f0-05f5-43ea-8706-7d8f61c77e77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772908095, "uuid": "68ee7aef-cc8d-4875-98a9-567b55ae52f2", "value": "xfas.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9397f655-19dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772857487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772857487, "uuid": "76c8c325-39b1-4ceb-bdd4-13186dae5e89", "comment": "Malware payload", "value": "db1577cff3614af21760c1ae1133b46b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772857487, "uuid": "f6e808eb-f8b2-4153-b467-488c00b5aab5", "comment": "Malware payload", "value": "ee4235040dc6c9497f92c8d681dd8805a1a4ae6d41e4a514cc693f649185bd0b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772857487, "uuid": "5e17b018-b935-48e4-9203-daf6477cc94f", "comment": "Malware payload", "value": "c8c510d41ef6a0d7199225003cd5a95f727fc579", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772857487, "uuid": "a565df98-d111-41ae-943e-d678abd2833c", "comment": "Malware payload", "value": "54cf823c19b5810973ee0407e0aba188c9c63c500a7f7af39467ffca69a4571b41239083df6af9d0cad8b6dd65ae0245", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772857487, "uuid": "e78c3934-92eb-408d-8ee4-107eba794fa4", "value": "T15FF096F903B65D41E514A9533053445B6387BA983098BBCCB45B4E252ACCC60F815F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772857487, "uuid": "43cec354-3152-41c2-bd4c-0e56cb2f7738", "value": "12:Bpi1n73i28GiJewat+0Ti1nhzi8iJewat+f:7QmGiB6czfiBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772857487, "uuid": "9fe85739-a53d-4d87-bdf6-9c8003d2f431", "value": 526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772857487, "uuid": "41603d1f-75a3-49b2-bd44-3737208158ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772857487, "uuid": "5e948c8d-3186-49c6-b173-c0fb432ac2f6", "value": "teleport", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d14619e-19f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772865422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865422, "uuid": "af23afed-cdd0-4b4d-9b83-d9ab20cdbd2f", "comment": "Malware payload (Formbook)", "value": "cc24335a9f15d8f3c9b90cea0d279c10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865422, "uuid": "c38929e1-6328-4f68-88a5-a79880f44510", "comment": "Malware payload (Formbook)", "value": "ee61253c6a5f212eede4d9de08c9893a105f4aa3fd34c8ce8cc77f3138f46a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865422, "uuid": "26289459-0bba-44e0-9ea3-dda16d1aeb06", "comment": "Malware payload (Formbook)", "value": "79005246caf31df614b8de027b231b1c4da869a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865422, "uuid": "b624c8f7-3142-4e96-9546-9c50a4a8efcd", "comment": "Malware payload (Formbook)", "value": "3a30ae74436367470549bc1e92fd4b1695fcc83f6823cc232f142b1f40be171dc72769a13e3c25c200c414e7672cd65f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865422, "uuid": "c0486553-d45f-4940-8011-199200a4ca8e", "value": "T1B1F4FA7F99629126DA8A80FC35494B625971B33B03B41FF701669130271B9B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865422, "uuid": "f1366480-6cff-466b-a2ac-d29224c69201", "value": "12288:0qB38Spw/n4R8X5eHbdAeAZGq5YV5JMGkXYdtX0cBCshrtJiKwsAF:0u8Sp6n4RU5eHbaeyAb0cMshmKw5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865422, "uuid": "87066f6d-78bb-4251-908f-eedfa1c80799", "value": 730496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865422, "uuid": "6421ab95-dbf4-4159-aaa8-8615223caa67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865422, "uuid": "dac96a88-a991-482f-80bc-93386c7b13e9", "value": "ee61253c6a5f212eede4d9de08c9893a105f4aa3fd34c8ce8cc77f3138f46a46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e9d0ea-19b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772842182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842182, "uuid": "44f137ca-3ec3-4be2-b3d0-624a215f6bfd", "comment": "Malware payload (Mirai)", "value": "7628ee63c69b35ffe4056f679c925cd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842182, "uuid": "ef59ee0c-9111-40c7-b641-43f7fe01c897", "comment": "Malware payload (Mirai)", "value": "ee6d44c6b5f2411f4c4e77414efedc48d51f43c33de537bbce9b92b84b910444", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842182, "uuid": "f030c725-4660-4b5f-80fd-6d1637ad60d0", "comment": "Malware payload (Mirai)", "value": "5efe936336e7ca864a13c4d04ebdf4e08fd53ad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772842182, "uuid": "5251f693-1f04-4522-9d01-78ee0f4b0b58", "comment": "Malware payload (Mirai)", "value": "3a80ae6164c990f30cde2ff0b9e4b36749bc6f34d258889eeb279e5b86e868221644dced5191032b0fe95d37bc02117f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842182, "uuid": "07bfee28-f316-4d7c-902b-6ba8d762fc75", "value": "T170443A45EB404E13C4D627B9F6AF42463333E7A493EB730699246FB4378775A4E62602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842182, "uuid": "751e1fda-b4b1-4076-949d-c389d553c1ec", "value": "6144:eCS6uOVq0hwsaZkrI2O9VsE768tYvIZ7V/Ggc3:e36lXhwsaZkrI2O91uWn/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772842182, "uuid": "db86aa7f-69ca-4000-a727-ddb2504a60b2", "value": 261654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772842182, "uuid": "89879f99-046c-4463-b492-080a0f9638d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772842182, "uuid": "ddb5a118-f56b-460f-b57c-160dc4d2b02f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf06d0d-19fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772870844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870844, "uuid": "08898917-d38c-4eff-9a3a-41efa8341e2f", "comment": "Malware payload (Mirai)", "value": "80614756f295e6c17050e5f2ad68010f", "object_relation": "md5", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870844, "uuid": "d374391c-546d-4ab3-a2b9-65850cba0bb6", "comment": "Malware payload (Mirai)", "value": "ef8bdfe8f23bba8706978173343513700108d38203125153cb422d250aa9e499", "object_relation": "sha256", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870844, "uuid": "c3e55ac3-f22d-4074-a0f9-181bfcc9d69a", "comment": "Malware payload (Mirai)", "value": "77fb717f92c2f95ae6529b579bac8467fc4fa732", "object_relation": "sha1", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772870844, "uuid": "1e3af6dd-ddf9-4c8c-9a3a-4320798c617e", "comment": "Malware payload (Mirai)", "value": "25d7bc1eac37c696af0a8f20327cd2f035f77b054ba389749dbae499d169a2294b6de5c6ab52f793cebc26fba0e547f4", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-54-22", "colour": "#BB4B5C", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870844, "uuid": "352745f6-5ff0-42e9-af76-bd025abcf1a8", "value": "T1B0564B07EC9555E9C1AEE6308A629253BAB17C496B3127D32F50F7382F73BC06A79710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870844, "uuid": "6b587172-5430-44a2-886b-74963c692dd3", "value": "49152:15sAEIPDLd1lxGG9gM/IZr+8ZSddX9v/H/rsAylc8XzQbR9s0/AK3lhNbo5pcvrx:1hVtaZyr3X9HDsBKzR9Hjad6auEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772870844, "uuid": "4146a308-2823-469b-90db-cb9a2caad141", "value": 6435000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772870844, "uuid": "e0a38d98-6f9e-4fa3-8476-00acc3abe89a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772870844, "uuid": "27a902ca-4a53-4c4b-b338-e52190f07bc5", "value": "Defence_Planning_Committee_Meeting_13_Nov_2025.ELF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822b9262-1a30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772893106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893106, "uuid": "64e928fa-042b-4c69-a6c0-0ace6c066327", "comment": "Malware payload", "value": "50ee229d9e414e28c50693eb64e6f39f", "object_relation": "md5", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893106, "uuid": "65851ac5-a706-476e-9e0b-5fbc5bf96ef0", "comment": "Malware payload", "value": "f15f37f036b5f6871976c6152313b311d737ce3600e5307adcdbf3794828d113", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893106, "uuid": "bb1c60a2-45b9-40e0-9a73-ebc6e07ed096", "comment": "Malware payload", "value": "79f0ba521b20fe3bd19915f2a9ee1bc81f19b57c", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893106, "uuid": "bb79ae79-0f87-496a-bb62-cc21cbf1452d", "comment": "Malware payload", "value": "a8e80a28bf4a3da8e32cd2f918a247b5825d69e14efadf56e11b31e1423a95e997103113886fd2569e6408d614e36d50", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "acecareer-edu", "colour": "#A0104B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thekingofarms-com", "colour": "#E4621E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893106, "uuid": "52f336d2-3de5-4ec7-af88-6d860054459c", "value": "T186F49E1AB2A802FCD0BBD1B5C9534A17D7B1F84A1331AB9B43E05A962F376606F7D311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893106, "uuid": "7b5d9a4c-9b27-49e2-85e0-13de84e042c8", "value": "c5c7e4d2a8d755721878e9ee0a95d529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893106, "uuid": "f8ad1e93-ecef-4ef2-9f68-99131e804234", "value": "12288:/pca0g0UG2ZyJpKSq7AEr1+qeHGcpLubMRu2LCDAxF:/X82Zw0SEAEr1VwGgubMfPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772893106, "uuid": "58224d31-6232-40c1-84d1-fe170637e703", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772893106, "uuid": "97be3c11-1167-4c47-81f8-b9275a0eb0d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893106, "uuid": "a8cce432-020c-4c08-b37d-da17427733a4", "value": "sssrtq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06c84e5-1a2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772891976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891976, "uuid": "6425e13e-b23f-48c3-b3be-d34276ace5b5", "comment": "Malware payload (Vidar)", "value": "3544057ad6e754caddbdcf73d4b323ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891976, "uuid": "c9256e22-eb9e-42cf-9c92-38dc1adce42c", "comment": "Malware payload (Vidar)", "value": "f22b213447db1a67818bfe353b6c31cdeb9b2e5e9ceb0dae1908c42499fe9873", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891976, "uuid": "1d130f76-8349-4399-9370-722933d7395f", "comment": "Malware payload (Vidar)", "value": "046bf20688f3e6b2255e7581469f9f93179cc56c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891976, "uuid": "7b15e187-c5c2-4157-a07a-b044a89d9635", "comment": "Malware payload (Vidar)", "value": "bc7f1064c7daca11c5cfe2db0c5c14bf7275740504d06746b8bc7b8f770058fa5d6be4a7f0782b21bd6c23bd0f20eafa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891976, "uuid": "d4d5c4ae-4c21-46ce-878d-b99d92a159b4", "value": "T1022422D1A095ED6DFD14F133F2CCADB659B149300EB1E7D1683B1C69AABC231438A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891976, "uuid": "273e5e4d-58f2-4777-a4ea-a5c3af5692f5", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891976, "uuid": "a23e1b09-a3f6-4589-86a3-3920f895b30b", "value": "6144:EnXKZj6BpzfjQ8bNZoqcZy09xGWZ0bY+m:4KYp/Q8b/ovyZWib6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891976, "uuid": "78a0fb44-c3ee-46aa-8e2f-b9c72335e510", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891976, "uuid": "74f1ad8d-a12d-4670-b892-8be622fa0fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891976, "uuid": "a4507f0d-b74c-4d8a-a852-b1f82b636b31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d59107-1a3c-11f1-a769-42010a9c0008", "comment": "Malware payload (TernDoor)", "timestamp": 1772898426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898426, "uuid": "5148ae6a-4dd5-4577-b978-9045e0f57c67", "comment": "Malware payload (TernDoor)", "value": "64994512c3ae8b69f9f65a549c16081d", "object_relation": "md5", "Tag": [ { "name": "TernDoor", "colour": "#E286A7", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898426, "uuid": "4e66d570-09be-4d1c-b1d6-03b0de04e3bb", "comment": "Malware payload (TernDoor)", "value": "f36913607356a32ea106103387105c635fa923f8ed98ad0194b66ec79e379a02", "object_relation": "sha256", "Tag": [ { "name": "TernDoor", "colour": "#E286A7", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898426, "uuid": "7ab14735-aacb-463f-824f-4b3cd1e69ff8", "comment": "Malware payload (TernDoor)", "value": "e901acd568a19b4b08c40284f04a7a3ecfd1ad91", "object_relation": "sha1", "Tag": [ { "name": "TernDoor", "colour": "#E286A7", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772898426, "uuid": "f3945643-b582-4da8-a00a-7bea5b571ca7", "comment": "Malware payload (TernDoor)", "value": "086d09302f7b66e8daa8013a9e575af138dbc84f573b45eec9203269fe08149911c88e5760f4feb2f61818e82fa1b07e", "object_relation": "sha3-384", "Tag": [ { "name": "TernDoor", "colour": "#E286A7", "exportable": true, "hide_tag": false }, { "name": "UAT-9244", "colour": "#D83769", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898426, "uuid": "2de8081d-415d-46db-8a82-9ef1e5b8d077", "value": "T146153319FC929332CFC125F533E028EF6B158EDC6C76EFD90D752A2A62320724A9915C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898426, "uuid": "9d5b6810-28fc-4b34-a9b1-63d8f4c024f5", "value": "24576:DLkz+4j1vh3vN1TMO8nYZCXXRE+6OF7luTZbRdC:Ez+m1aO8nYZkV6OqT1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772898426, "uuid": "f7b24b5a-6a3d-42c2-86f1-64ebf44724e9", "value": 961402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772898426, "uuid": "e448f880-d9d2-4e68-a678-499ecd174ef6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772898426, "uuid": "6db523ab-9938-4a81-a0ef-d6b5d6e8707d", "value": "rar.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff295030-1a34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772895034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895034, "uuid": "8d464683-46c4-4ec7-91e8-976d10e7c456", "comment": "Malware payload", "value": "2f5ee20ead4ff723f1b017320610ccf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895034, "uuid": "63c10cd3-15ba-41f3-9150-0df6028fa816", "comment": "Malware payload", "value": "f505c7af4e9c3722014da23dfee71c8a46f0e3d521003d3525db4e1b553a6f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895034, "uuid": "eef3a73d-cc1b-4b67-8ded-80fa8512929d", "comment": "Malware payload", "value": "f2d7c2341ca355352bc4542dc9e270cdc2f26ef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772895034, "uuid": "9266b37e-69e1-4b91-ac11-628f0cc61e2f", "comment": "Malware payload", "value": "f955e3aad5e572b2dd18121b579232be3c73e8afb0d6a11c7ed11244db4400755d59eeec71a9464092f9d0fc711eb61d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895034, "uuid": "77c92383-89cf-4c95-8dcb-e6d6e22f4c7b", "value": "T10F26336E71EFAEB6D693D039DEFBF2E60C19280984C753A122DDEB0132C47D409699C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895034, "uuid": "96917c72-73dc-425b-9296-974c381208e2", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895034, "uuid": "cd50b6e6-3a84-427a-8944-d6842b7ab842", "value": "98304:Gt8KqtR23L8FOGnpOs960ijj4fkGwLZP9uA8KtIvl:Gt8zRnnEs9cGwLZ1D12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772895034, "uuid": "bb294c55-87ef-41fa-9514-fffe5e95a3b1", "value": 4545536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772895034, "uuid": "e214106e-c54e-4ba4-8ad6-04869d6e61d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772895034, "uuid": "4ab7d643-3ec1-4a7c-9bdf-163100ade410", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.12072.30769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c04b443-1a2c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772891405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891405, "uuid": "5e6708dc-416a-46ac-808a-4c249f89acb7", "comment": "Malware payload", "value": "a02a46893b9d79fef8e4488ec8d28a23", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891405, "uuid": "a32cc87d-1cd0-4e4a-9cd0-81a00c714ee2", "comment": "Malware payload", "value": "f56d4963698a9d8490a1b736089ca0e7694c3b17a5ee4357c2eb33fe4e623a7e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891405, "uuid": "9ce81cc3-34da-4bcc-9435-9c46201a9e85", "comment": "Malware payload", "value": "5eacd8b23777035f582d8078cda65355d707a9b3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891405, "uuid": "ad53366b-cfb8-420d-b0f6-d52830b93bb7", "comment": "Malware payload", "value": "1abf1d4f88a40036d36e1e52e7fa26ee08f24d70d26f40f0d0a9481c346bcf62a688997973a5cce0ba241cfe3e62abd2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891405, "uuid": "e5336286-9a3c-402e-a77b-b93f6e66e63f", "value": "T1D4C533E7BAF215FF8746DB6E1E44D50FCB08D9078EA5E24FB1F2D21D40E89418768468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891405, "uuid": "d6963609-6915-40e1-8042-a5bea435d9d1", "value": "49152:VtdIIC8BSbzEp70OyygKlWQ7UQaJxyZpNgAuQMPhZCvnC71axDood:vdIIzBSm700KQBZg3+u1alood", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891405, "uuid": "afa83455-2d0a-413c-9e19-e9dfe109a6e7", "value": 2560829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891405, "uuid": "de1bddae-feb9-4833-bc47-ecd34bd9b1d5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891405, "uuid": "e289ddf2-5663-4fa7-a9a5-6b03b3a891fd", "value": "java.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86952c94-1a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772890966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890966, "uuid": "fcd4a770-f1df-4e82-9408-1386b313d054", "comment": "Malware payload (Vidar)", "value": "1f7469c3fb29fe71e944d8a35e4e6d1f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890966, "uuid": "8d1f2482-f934-41ab-b973-118548d66c38", "comment": "Malware payload (Vidar)", "value": "f6801c00bde63f0297059a68eff299705fa6642138c1165eb4ede5c61c4898dd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890966, "uuid": "467b8a20-1cee-4c3b-9edd-70e6b9756bfb", "comment": "Malware payload (Vidar)", "value": "8d50d68c208c05b9ec997046f7a2a74b462b1e2b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890966, "uuid": "01947977-331a-4c0a-838d-51457339b076", "comment": "Malware payload (Vidar)", "value": "60f262f0a4adb2f941ad9df67f8f95ec5e4cf621d0228bde107259cd76967bc9604f59dae70b5c05df88497042e690d1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890966, "uuid": "d94801cf-ddbb-4204-ba0e-db535bf547e6", "value": "T18C958C07BCD424B5E5A9D2328AB112A27730F85A0B313BC72F55A7B82F763D41E39794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890966, "uuid": "69c17138-6b69-4854-86de-f77eb26668ab", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890966, "uuid": "8954da89-1e1a-4f43-bba0-07ad0ae25c68", "value": "24576:+zY9fV22i6sDcHccfPoO1BZQ8ygzP6Jt/aOcsYgtJffrK1UL:+EfV2zXvUsJNaMYgtZrK1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890966, "uuid": "a7146e11-06a9-42ee-8207-5163e74b7070", "value": 2004480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890966, "uuid": "2382ae49-308e-461e-8fda-ced92ec874e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890966, "uuid": "ef088de8-d3a2-4a76-b093-d9e6b038c260", "value": "WbhOF98odbzI16YdMnI3qgjE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6331c5e-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772865384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865384, "uuid": "552dcd4d-4b7d-4e1a-82d6-0023b05941b4", "comment": "Malware payload (Formbook)", "value": "50b2381feed836114cf11ec50b3e947d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865384, "uuid": "2550bb79-2e69-47d6-81b2-60bce6143b63", "comment": "Malware payload (Formbook)", "value": "f7ba63fe5b4afccc73038f16bc5e71d4fa9882150c1f0ac7a04dce0c4d2d17e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865384, "uuid": "f883a6f7-65b1-4cc2-8603-6a4678f90cde", "comment": "Malware payload (Formbook)", "value": "2782baa874ed6d0106cb9c7a8e00ccb5a32b1962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865384, "uuid": "9d5a6dd2-f284-4735-80a4-3ae23273f87c", "comment": "Malware payload (Formbook)", "value": "71eea3c54fbd0dfac520c7ec02c2cdf58e336e46f5cc3bbf9db62e5b259e8d7f34fa91bb29dfb9f63c194127219894ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865384, "uuid": "bc2366e3-df47-400f-9ecc-62db271e8125", "value": "T1DB052C7E5963912AD98A80FC35594B6259B1B33B03B41FF300A6913167079B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865384, "uuid": "3ea80e0c-4ab8-48cc-b625-370c2c758456", "value": "24576:hirLTwadtO0OmE8PZSqrWO0ux8wBwVS6a6jTVA:hiL/vO0HjtBATS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865384, "uuid": "6c0c00b7-18bc-4404-96e5-8cfa865f5013", "value": 852864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865384, "uuid": "617938bc-4702-417b-bd9d-501544d0c421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865384, "uuid": "bf4b0444-875b-47a2-98de-7310944257fa", "value": "f7ba63fe5b4afccc73038f16bc5e71d4fa9882150c1f0ac7a04dce0c4d2d17e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f52d1e4-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871171, "uuid": "ab9eed31-7c57-4743-9e1f-ac805e39fa42", "comment": "Malware payload (Mirai)", "value": "7091528cdaf670c6faf8b3729dac8cd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871171, "uuid": "ece83141-2b92-4cc9-bde0-9646a060a138", "comment": "Malware payload (Mirai)", "value": "f7fcaa0dddcaeafd08139e7e353e1e181cf67214ab478cfd83111cae7d9924bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871171, "uuid": "a5ae0c52-fa27-4539-bd08-c869987c9436", "comment": "Malware payload (Mirai)", "value": "807dcadf8b732e2708a9ea84ffdb244544abfc48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871171, "uuid": "0ca9f384-9aab-4fe4-854b-9761ff708169", "comment": "Malware payload (Mirai)", "value": "2d2e4aaa58e41e55880cf21b082b204669701dec24caa9950d006f81f967bc35f04de8d2698026d997f5173e30dabf9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871171, "uuid": "f8f628ba-3a40-45be-80cf-aef6a393b073", "value": "T1B873624CF968673EC7E173FEEB5852CE723A1B8873DA35259E32065A33C8B54A425134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871171, "uuid": "3dcbf40d-b70d-4f36-b024-fc2f035c5e22", "value": "1536:0XER2g7q8ix30hh3T3VOTtjVksBSv0b0yUNA9rjSyZd4tWgJy6:0XERQsVOTtjOsYv0b0yUMrjR+dy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871171, "uuid": "81066134-6e3e-4405-996d-cfc8d7139c18", "value": 77799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871171, "uuid": "bd7568b0-36bd-4253-a3fd-e58e137c2e95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871171, "uuid": "eecdc7a6-82f9-4030-8280-f83dcb1fe27c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a56459c-1a04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772874142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874142, "uuid": "8cb25d75-2cc3-4d10-b8e9-bee783edface", "comment": "Malware payload", "value": "38870d6bd7d2645a34f7d8e30a6db563", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874142, "uuid": "d1229b41-457c-4e00-a179-3c24a600ba1c", "comment": "Malware payload", "value": "f9c363b18d3d38757f4b45353c3576001af5e0a2cd5bd4e778dc524463f8dc3e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874142, "uuid": "f4ff26c9-8dfd-4ca3-a830-4c3385099997", "comment": "Malware payload", "value": "5beb7a554cf7f72ad1469dd365582751277dcd76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772874142, "uuid": "dfc594d0-1fab-479c-9746-aa949cf0d00b", "comment": "Malware payload", "value": "c7dc1d4967d69d4a8496aaf6d45b60a7cec508dcfbadb5c406022aecc28b9aa428c61e0303246a6b95eab9a02f32deae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Unbounded-Xiamen-Information-Technology", "colour": "#777F95", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874142, "uuid": "60cbeca4-7961-4e5c-848a-a861b47953d4", "value": "T190234AC6B53224F2E5680D345DDBBF37EF757A63A08EA4319178C344FE147542E88629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874142, "uuid": "1f59c670-dc3b-42f7-b282-a08edd86ed7d", "value": "fe37bbd2b0b7a6f0159e3e37fccffc2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874142, "uuid": "26ae8876-45ee-475b-aa4a-a85fe08cf877", "value": "384:uhKXW5OLK4jqpgAWW858ANR+h9B9thD+iipwK3WVwv4R/0gFpKzCKjd3gSGBkSf:gG058WkR+hDF+iTqv2pKzCKZik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772874142, "uuid": "079802fd-efca-4d43-b3de-06d5152388a4", "value": 49944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772874142, "uuid": "a8e14c4f-c96f-4848-9562-02f8516ccf5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772874142, "uuid": "cd10cb9d-066b-4bd3-abad-485e625993e2", "value": "f9c363b18d3d38757f4b45353c3576001af5e0a2cd5bd4e778dc524463f8dc3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479f2b04-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871104, "uuid": "b6e83f96-efac-46b4-9837-c5d135afc5b8", "comment": "Malware payload (Mirai)", "value": "4f19624e3b3315288eb2e10b20a63a4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871104, "uuid": "256068b9-a6d7-4740-81b6-1045f27547ae", "comment": "Malware payload (Mirai)", "value": "f9c8f3dc44c95dee83c9d8148ab62c0641869797097133102e5e36a437026813", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871104, "uuid": "16a32502-c1d9-435b-b6d0-8fce4289ba98", "comment": "Malware payload (Mirai)", "value": "e15b2d34c2d7002c5955f7e1fe41c51050250553", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871104, "uuid": "5b118243-9284-462c-b9c2-d6fb02a6e653", "comment": "Malware payload (Mirai)", "value": "bd5e7b93b5b652f063130db3c9977b8a7e7cdd9267bf47e46d33792cf2e30aea1806aa171be8ccfb14b8cca6ec8d9177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871104, "uuid": "d829c98a-0be4-4df6-b9d9-129b739ae062", "value": "T134F2F1838773F07DCD91E8F2481F8384EF79246EA717569F09DA946DE8B39022A71342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871104, "uuid": "0a02a56d-8d88-44e1-81c0-3c2b000737a1", "value": "768:f5Ua6AjXXqUUkmUxcrZn6VjbH6pP0/EfGI82pfx0i6:Ljjn/0cfHiAeGX25h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871104, "uuid": "1c3d364c-a259-42ba-9e59-fcd87909ecd5", "value": 36152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871104, "uuid": "2089923b-bfdb-40f0-8781-225987c871e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871104, "uuid": "770df887-eeb5-4711-ab3f-bc1467468436", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62b8fde-19ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772865357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865357, "uuid": "1b2c131e-3b0e-41e2-b6f6-4b7aae5e7c50", "comment": "Malware payload (Formbook)", "value": "dc3e81dc3f7596e099288dafe993dc3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865357, "uuid": "0fd76026-6dfb-4bb1-aa27-699f791e1f15", "comment": "Malware payload (Formbook)", "value": "fa0e32c5d508ed01948da56b930c4339019968b96fdc2c87ef9d5bc3a3e572fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865357, "uuid": "7efacaaa-4c82-4767-82ce-f394428c5bce", "comment": "Malware payload (Formbook)", "value": "52816b90921218ada20917da9c187bf0fe0c6ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772865357, "uuid": "23191be3-4956-47c2-a503-97f88108bca4", "comment": "Malware payload (Formbook)", "value": "b6393152da5a9297b6519f8464fafd84a8efef34e32143430f2587c97aa69fe7bc0bb7afbfddc9e7b756f110defbfaef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Nanjing-Zhixiao-Information-Technology", "colour": "#03E0CC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865357, "uuid": "d368b951-099f-4800-9dae-1b1febd4d8ab", "value": "T10A052C7E9D62916ADA8A80FC35494B625971B33B03B41FF31066913027079B2EED73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865357, "uuid": "edbee895-0c15-4d8c-b87f-e1f4377c293a", "value": "12288:iRErSnXM//XoPDJpPCNee8cVdBBCDtPK+GNvdo+AIIMgMkjOqu3ZP:HoXM//XoPVpPCNz8mEwFo+AINkSTZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772865357, "uuid": "5a493856-0e6b-42e0-b0db-2295cbe2ea85", "value": 857472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772865357, "uuid": "910a961e-b554-4795-b564-7b19f7049e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772865357, "uuid": "a46ae844-ab30-486f-973a-26fb76b53883", "value": "fa0e32c5d508ed01948da56b930c4339019968b96fdc2c87ef9d5bc3a3e572fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910ed0d9-1a2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772891843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891843, "uuid": "90377648-bc65-47d9-a67a-b637cbd0359e", "comment": "Malware payload", "value": "ffeb98c1de55e90f7d98cca8e79a30de", "object_relation": "md5", "Tag": [ { "name": "94-26-106-216", "colour": "#E0ECEC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891843, "uuid": "4e4f0dc4-6bc9-4863-9848-3def74b0a80f", "comment": "Malware payload", "value": "fbc71b214f4e8684b2caf24fef0ace848ac2331947900d516db917628724fb58", "object_relation": "sha256", "Tag": [ { "name": "94-26-106-216", "colour": "#E0ECEC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891843, "uuid": "69e8a34c-f2ce-4fa1-8c3c-25d24ea60fd1", "comment": "Malware payload", "value": "284fdcb3b7271672031b1d0589c89687e019be47", "object_relation": "sha1", "Tag": [ { "name": "94-26-106-216", "colour": "#E0ECEC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772891843, "uuid": "abd50677-36b5-4369-a697-4424228139ec", "comment": "Malware payload", "value": "959e70a2778679c8a677eaeb8e9d08ed3d20d733eada11fcb3a5386ceeb6f964c595bdb57d0fd6593855657158800ee9", "object_relation": "sha3-384", "Tag": [ { "name": "94-26-106-216", "colour": "#E0ECEC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891843, "uuid": "110cbef3-8658-47a4-b124-c626e14d6e89", "value": "T139A633E0F2886FC1D226D57253F48175E6CD2CB6A0B3DDA6BC021F8D5093AF2669F445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891843, "uuid": "b3cfa418-4ae9-4f8d-a7f4-97e0ecb00fc9", "value": "196608:X5+uWL63x+mb2ZYYLTIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9UPZ878EN8P:kL63Mmb21PhOnn7FUNyhGprLz06h8wlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772891843, "uuid": "67e2f8cd-ca00-4f4c-9d3b-7f74882b1d04", "value": 10280750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772891843, "uuid": "3885f2ed-f5d8-4cde-9e01-6b6ba9a11956", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772891843, "uuid": "0a4d73f2-9e3a-4a96-93f4-05db89ef558f", "value": "chrome_100_percent.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e12b3d-1a6b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772918471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918471, "uuid": "b1099a6b-2eb8-4154-81c2-f083b869c5e6", "comment": "Malware payload (AgentTesla)", "value": "df581ed262c0c7d2e86ccfc562d0fa82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918471, "uuid": "c71338f8-41e0-4aa2-be4e-1fc823a507f6", "comment": "Malware payload (AgentTesla)", "value": "fc640a2a31dce7882edbc7ef4c8ce69cc7673ed4a22332685a66b758225ddd64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918471, "uuid": "a8c28106-b85f-45b2-94a1-556f1d034c5b", "comment": "Malware payload (AgentTesla)", "value": "297a76f5f4c416339af68c0c99f774954b2e4510", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772918471, "uuid": "4f81fb23-b8fe-41e2-bfc5-89af9f6d9d34", "comment": "Malware payload (AgentTesla)", "value": "e2a57b8c23252dfedbd491ebfa0eed60f43fe9a7f5910d13730974ab12ffe51228d8109200d19a6edfbc9820552c0b95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918471, "uuid": "f9e7cd47-dbc1-4b86-ab95-3516c6732dd9", "value": "T1393400037F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918471, "uuid": "04f367d8-7402-43f0-b76f-c84300b70b8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918471, "uuid": "982ccd65-ed02-49fc-9a59-3421fb10938d", "value": "3072:FnFiq6Cy54dzb02fcJHTHo9rG8KaG5jnThYq4ufzz:Tiq6CyGRpYsq8KaWT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772918471, "uuid": "9ce435d6-bbbf-476f-8529-5c791f04c50c", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772918471, "uuid": "a8274e0d-bab6-434b-86f1-ecdba9216b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772918471, "uuid": "c39881d5-b78b-44bb-a69f-51933a6c24e0", "value": "f45b853c-c9d3-495e-9acb-d41a4a90029f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67541679-1a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772890484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890484, "uuid": "bed0bbdc-9b32-47ec-9509-bf160b14a598", "comment": "Malware payload (CountLoader)", "value": "f3da284a1864eccc357b12fc7720114e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ccleaner-gl", "colour": "#7F04B4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MIXNEW2", "colour": "#D1D6D3", "exportable": true, "hide_tag": false }, { "name": "pw-3155", "colour": "#FC30C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890484, "uuid": "e141a0ef-48e0-4e07-bc01-3e7f03b12867", "comment": "Malware payload (CountLoader)", "value": "fd68180192d09afea66bfb84855de0a349e545c95c701f3ecd81213cb72e8ba0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ccleaner-gl", "colour": "#7F04B4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MIXNEW2", "colour": "#D1D6D3", "exportable": true, "hide_tag": false }, { "name": "pw-3155", "colour": "#FC30C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890484, "uuid": "45b18e81-7be8-41c5-918d-5f40e0de165c", "comment": "Malware payload (CountLoader)", "value": "9bd9bf3440d7100c25b4116d100ca49a55c8ca84", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ccleaner-gl", "colour": "#7F04B4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MIXNEW2", "colour": "#D1D6D3", "exportable": true, "hide_tag": false }, { "name": "pw-3155", "colour": "#FC30C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772890484, "uuid": "dacd481e-33c0-496f-be34-41ec17fef623", "comment": "Malware payload (CountLoader)", "value": "9fef09ace04732ce299b6b6ca8c701fac758216e6f32a9308721f39adb97df4d25fae91fd73ab0cdc087e22a9df10ead", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ccleaner-gl", "colour": "#7F04B4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MIXNEW2", "colour": "#D1D6D3", "exportable": true, "hide_tag": false }, { "name": "pw-3155", "colour": "#FC30C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890484, "uuid": "b0c02214-b1ac-4d98-ab48-ee79026caa2b", "value": "T1CDE633A1033C75B2DF368319C1B67E42DB992B4D1F31FB6D45E0A09F873719A866B128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890484, "uuid": "c5f8d636-ba75-47ba-ae3f-8a5ac7092330", "value": "393216:6RJ9Vbx84hoAF/X2GgaZKuHHH8YQ+T0bICwhd:6m4hoGVDK2n8YQbI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772890484, "uuid": "0a6b095e-e66b-418b-82b5-69b751362785", "value": 14038515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772890484, "uuid": "95e43b41-c96b-4cc5-bb92-0684460c1f1c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772890484, "uuid": "0ed9fdec-7035-49aa-a6cf-58f266ae5a65", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46276f97-19fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772871101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871101, "uuid": "566d561b-de3a-4268-a4f5-37ca6080c64a", "comment": "Malware payload (Mirai)", "value": "3b21de7f912cd4826b99458e28649126", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871101, "uuid": "c9b35068-ead0-4d59-8538-533c34d54bff", "comment": "Malware payload (Mirai)", "value": "fd6e9f5e263af5b73dc576e9fb3dd6a930f2a3003527414c3d3b829135a12e5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871101, "uuid": "403644a5-5ee2-427f-9172-32178c1e02f2", "comment": "Malware payload (Mirai)", "value": "b70760ad40f692ab1f83ad976326b67ed3c1286b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772871101, "uuid": "457ccd8f-cfed-4829-aec8-94c5bd82f87b", "comment": "Malware payload (Mirai)", "value": "8348047ea2be08aa2c34f3d6943bc3f8835ef4931722707a9cbc1e01e99a15fe1313473d3c7999c229d40cc2432bfef7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871101, "uuid": "60fecdd2-34c8-4f38-96de-a727899253e4", "value": "T15D63410ABF611EF7F86FCD3706E52B49308C641A21A83F757974E918FA4A10B54E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871101, "uuid": "4db70547-a857-4193-8c76-b669070b6212", "value": "1536:nxo6M86eAtqVUlf2VNufYuI0Kck6n2MFiwbZn:K6MjeAt8U92hulKV6nkwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772871101, "uuid": "084cc8b7-4422-45be-bebf-35b5a6ae68d6", "value": 71480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772871101, "uuid": "7f50ca9f-4707-45f0-b75e-405482d4bfa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772871101, "uuid": "b638f672-a889-49a7-bd75-e27345672a3f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19009c9-19f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1772866638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866638, "uuid": "a79604b8-586b-419b-87ac-a6442ef16b66", "comment": "Malware payload (Heodo)", "value": "05e73a83b8a73e9c621add3dc6330aa9", "object_relation": "md5", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866638, "uuid": "804ae1fd-6f47-49f2-a024-397f1e46e3b7", "comment": "Malware payload (Heodo)", "value": "fde4a524f3eb6e7447ac00b7f12100370ab0e1e808cb61d9d70e1149ec00fcd7", "object_relation": "sha256", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866638, "uuid": "def2eaf7-e99e-4eea-8eb8-4a727145e0fd", "comment": "Malware payload (Heodo)", "value": "2934e179b90d2d387f828ce5b9c274f4d7a62362", "object_relation": "sha1", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772866638, "uuid": "2528a24e-d1b7-4cda-80fc-db70a22c4d59", "comment": "Malware payload (Heodo)", "value": "2e25225ffd90e2621e67a4b9c2ac5d82f27f51f5df23e8b7861efcbba39b98e92c6ca2981a1cfd4067832082b287b6c8", "object_relation": "sha3-384", "Tag": [ { "name": "MalwareMustDie", "colour": "#06CD1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866638, "uuid": "bbc59df3-9777-4cd6-bb3d-ebc697ef9ff4", "value": "T120A63322C36AF948D95372B979BBC717D82ED6883342A5CF17B828DDACC19D0571E309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866638, "uuid": "ebd24fae-5567-4431-9a19-e098c93c8028", "value": "196608:x6gGLdq/Q3Y0iNSrb1Gj0suSMMl0bu6Z7EfxrA+O7i:qI/Q3nJb1GjeSM+0buiIxrA+O7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772866638, "uuid": "51fd18ef-cc62-4837-a609-8be33657569a", "value": 9568290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772866638, "uuid": "0d7e09be-89da-446d-88e2-bccad54a4cf0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772866638, "uuid": "e34c1b7b-0f68-4b15-9ed7-bca1df77532d", "value": "fde4a524f3eb6e7447ac00b7f12100370ab0e1e808cb61d9d70e1149ec00fcd7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12fe2fc-1a30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772893239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893239, "uuid": "c691fda9-8899-4a8b-8647-f03aaf6cc9d4", "comment": "Malware payload (Mirai)", "value": "42fcedfdc2fa74022e390ff86e5807a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893239, "uuid": "dc6b4940-b731-4741-972c-5820213fc92d", "comment": "Malware payload (Mirai)", "value": "fe3ce9e4452ff33772b0f28e1ac4ac40fdea0398d7b5fbf1858509bdbab04f91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893239, "uuid": "5cc49fd9-07f8-4b9c-82d8-55d3347c5812", "comment": "Malware payload (Mirai)", "value": "2b5b55f5e893caaf3d74d7c9e6ffb450d4e7c72e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772893239, "uuid": "61c5cb31-25e7-4a1b-a9ed-885c9abfd6ad", "comment": "Malware payload (Mirai)", "value": "2a3c320624f999d9bdcce0fe878eac1475badd5293644f50443c54b38b0a6e81ebf4e4a6aa374d6f43f98fc283cceedd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893239, "uuid": "032d3b1d-d988-4611-972a-53b8b1831259", "value": "T1ACB33A4AF9819B12D5C922BEFA1E518D336357B8D3EE3202DD149F2437CA96B0E77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893239, "uuid": "0f91e47e-a010-4df9-aa5a-8bc840846edd", "value": "3072:KdflLA8MderOmX1JngaoOnHTLLqdkj4dwUtXFJEq:KzMdiOml1gaoOnHTLakQtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772893239, "uuid": "143ec495-8010-4e84-b3dd-62180092df7c", "value": 108044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772893239, "uuid": "04f3bff0-e817-47c9-a6a9-233c10fe0763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772893239, "uuid": "a651d54d-ff3f-4bad-9718-0dd6ba8b3fbb", "value": "tul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }