{ "Event": { "published": true, "date": "2025-10-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-10-21", "timestamp": 1761091381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a5630ef5-59a9-49bd-9641-0213cdd1879a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a008a75-ae22-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761012327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761012327, "uuid": "c60b3e3a-896e-4e9c-9dbe-1733c0d08e57", "comment": "Malware payload (Mirai)", "value": "ca5d8636465241dd821becdb4142410f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761012327, "uuid": "e0f4d952-aac0-43e2-b8da-925c5f70362f", "comment": "Malware payload (Mirai)", "value": "002b721da2bc498543d53ab4bcc641e976a15c696684a65d1366110df21e047a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761012327, "uuid": "4d36493e-d729-43b5-a829-23002e960f8f", "comment": "Malware payload (Mirai)", "value": "6ba9569ffdb09076e6aa5663462e3f352439bb19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761012327, "uuid": "50a3ca60-0c7e-4a58-89fe-5e31923a88dc", "comment": "Malware payload (Mirai)", "value": "af835461c704f2b1f119347e9b3b2e9b89ee823f69e3ad9f350a8e470ecd0e8b8c1481d77fed5b29c95a0570f5922872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761012327, "uuid": "5c0dc0db-3816-4730-97ed-d6bf2057cfb7", "value": "T11413E1CB4B27D7B8C438C571ACB94180E4752C8F53831B6B84DBA0DE8D59A54F379BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761012327, "uuid": "8f851a06-56b5-466b-b058-a0d31c37cce6", "value": "768:+LAnBgdfe6mJECFi6Fk9xuiajxGNSCNBvIQj4e8zdx02X:+sBefetEYW0lINTODX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761012327, "uuid": "35f6c9d0-2990-452a-85f7-e9229563b08c", "value": 41448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761012327, "uuid": "81f3595a-5449-4cf9-94ed-a94e26f96922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761012327, "uuid": "c88b9a80-aeba-49b8-924b-5c731f09e5d0", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4dce6f2-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063993, "uuid": "e185616c-2e67-48b0-a7e9-e7a8fbc36ac1", "comment": "Malware payload", "value": "b831b8596309383ca20d7f8f57ef31a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063993, "uuid": "243c9fe4-b1bd-42b0-9a57-9bd46774c36f", "comment": "Malware payload", "value": "0073913cba073ab21a3aa3722aaad1a455aa65d801c1f17a30ccb422185b3101", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063993, "uuid": "6c2642e3-6d63-46f1-921b-7e1018817bdf", "comment": "Malware payload", "value": "22baeb95498e5fc4b18c927cc146072fee25f615", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063993, "uuid": "06e10907-b7fc-4306-a4a9-ee4e628ba887", "comment": "Malware payload", "value": "e00c1d2e828db5939e39091569ce1e0030a01cd46bacd44adf0716ff39eb67bc1f6abce74bb21c1eb28096d569a0b3c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063993, "uuid": "77c19d2d-2917-4b28-8ae6-1d5eb7f077ea", "value": "T1CDA3D6024D23DA25105011E05FB4ADAD92F51A161F887FEDB94FFA682E8DF0AD5CF18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063993, "uuid": "488023ac-0d45-491a-9e41-8c59be648567", "value": "768:GDhd0i7J4sYKgY/CMNfWdplUrXJFrK42pHlguxhhAYmFN/SLAuAAroQW+FF+Ec+p:GDB7eKg20YrfrK42PZAYEN6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063993, "uuid": "bd2a67b6-7cf9-4b9c-a58c-98974ddc84a4", "value": 105395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063993, "uuid": "49c4cf21-a6a0-44d6-87d7-4180ff529060", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063993, "uuid": "51c312af-d553-45c5-8de7-abb3ba40369e", "value": "invoice-1637482117.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f56f8ae-ae3b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761023154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023154, "uuid": "6380da94-679b-4893-a725-1a92aab9e9f9", "comment": "Malware payload (Rhadamanthys)", "value": "67ccfcaa4aae00439d64abd82fd6d18f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023154, "uuid": "cb151188-3b18-4ddd-ab1c-29f3415e10e1", "comment": "Malware payload (Rhadamanthys)", "value": "00b3f5f8986aef1607cd808027c79d68804f8118d4e653ce5facd2cc02b77d8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023154, "uuid": "e6198263-2a83-472a-b52b-20318a3c6a72", "comment": "Malware payload (Rhadamanthys)", "value": "d4a87bb4fe61a9a9c1071f5e556303d46931ed4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023154, "uuid": "cb1984c5-1746-4983-88dc-fad877464772", "comment": "Malware payload (Rhadamanthys)", "value": "233387acea59374dd182af5038047b17e4533fcec46a75a8ed1c479e2e0ec3b7674a8ef6791c414eebcb32f15e29ddf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023154, "uuid": "410585f3-1d73-4649-bcc6-bc802a8fd548", "value": "T12D663A578CD04184E0D9E5389BA2B292BA343C424B3537C76B51FA761F773E8AA3D718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023154, "uuid": "d006b86d-1a54-4cff-8fec-bba923b22ddd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023154, "uuid": "d4d1850f-aee6-4803-a949-a9f13617d3df", "value": "49152:G5CjhElF4OmhbXeFgCq8znynW47KbeBxLvk2rQIXjDBVZu+4SHLeODSJdLW1OKmq:GDHmR6yTaXcxXzr6SQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023154, "uuid": "22670956-3971-4a09-90df-a49882e7a19a", "value": 6648760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023154, "uuid": "9c785b53-da75-488b-8898-70767c05d63a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023154, "uuid": "7fbc7d50-e935-4c71-b048-ded396250a3c", "value": "67ccfcaa4aae00439d64abd82fd6d18f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8d565f-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761026153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026153, "uuid": "83294c84-c39d-495a-94eb-0f294fbef2fd", "comment": "Malware payload (AgentTesla)", "value": "068fcb6c83d373f8c7b7c1d1de7827e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026153, "uuid": "e1478db1-1da1-455c-9b4c-229b08c8e8b0", "comment": "Malware payload (AgentTesla)", "value": "00c04908561ee745953e61d436d6ee640e3b31a6f5a90616181552d82e737adc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026153, "uuid": "7a11cfb6-b42e-4e44-b41b-d1d5c4e46412", "comment": "Malware payload (AgentTesla)", "value": "2c8a04402c877245ba9ca3e2790b83fe5aa6222a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026153, "uuid": "a912a99c-1ce9-4534-a813-a6e7ccf3e3a5", "comment": "Malware payload (AgentTesla)", "value": "8e6156ab301720143a966e1772157437c7055344416f75ddc564d8ad26595828814d711c86174a19be85672ad0a4a924", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026153, "uuid": "0d1b44c6-c42f-4339-98c7-0aa0316eec75", "value": "T17D2533123522527BDBE1D9705F995C4A8EF9BEC2382134370B89FEB4EB35E219D0D512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026153, "uuid": "f8cb958b-7d35-4d92-9d7d-6197f00cff6a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026153, "uuid": "b09f865e-3eba-4f75-9a3d-4447bf7a4707", "value": "24576:5eDCwocumwpUor08ZM+YIwo1ik1eQxRc9rD/c71S:+ufpPQ+P1LeqRcx/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026153, "uuid": "0bcd733a-6142-4ec5-8773-ce812ede8f7e", "value": 1006128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026153, "uuid": "e9acba8e-21eb-4c38-9997-bce414c04b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026153, "uuid": "d93c7108-2543-47b2-af25-f5ab4a28e1b0", "value": "DHL GUIA 1Z4815906897663406 Confirmaci\u00f3n de env\u00edo 1Z4815454566663406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2485f544-ae3e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761024237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024237, "uuid": "af95278c-60c3-4754-8f7b-5e3342869c2c", "comment": "Malware payload (Mirai)", "value": "f57aab5744f249e17c3fa9edade9d37f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024237, "uuid": "c14cb238-3148-42bc-8011-4bea2510efd4", "comment": "Malware payload (Mirai)", "value": "00dc2c99f3ad18d5218a32bfe86a03ef0243b83f30e92b652eb4cc5bfbf5ae71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024237, "uuid": "4f52cf62-dc9d-46c3-abca-85bf7006cd97", "comment": "Malware payload (Mirai)", "value": "2783e4d29212b5a3fe5c4768aa47332934aade5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024237, "uuid": "2480d152-5bfc-4c67-af17-1b258f371640", "comment": "Malware payload (Mirai)", "value": "964bc28c93bdba188fbefcdf0677a34e0650703dd007dd7afe55802db69008d7ecb300136a6b2554f5ecdb1ae17c84b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024237, "uuid": "ea4ea47e-a597-486d-a558-9bf5aa3f6dfd", "value": "T10AF38C63D8B56F98D225C4B8B074AF792B53995082871FBE19ABC3724043DDCF6097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024237, "uuid": "a4255871-f765-40f0-9347-fc9dc4e40da3", "value": "3072:bpRLMT0lUQEl4Xj3LU4tj176TCG+TgGWAuIL4lJG:bphNpLU4J1q+MTAB4l0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024237, "uuid": "e25aeb23-6113-49f7-9214-301e14d60a5c", "value": 163364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024237, "uuid": "d98a4953-bb0f-40aa-8bba-f8592c8686a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024237, "uuid": "1da02907-3107-4a3a-816f-993d511b8ed9", "value": "Orbt.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12518118-ae6b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761043534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043534, "uuid": "d6c856f4-6961-49d5-8928-747b804cf263", "comment": "Malware payload", "value": "2c3fd80b586d763f4fa2eeb793e8b178", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043534, "uuid": "09757a65-871d-4e83-8146-82dde255fa24", "comment": "Malware payload", "value": "0114d91e52cea389063e2ce29db69d695c71a985f466a19d16083ed8a7b394dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043534, "uuid": "a38d547c-44de-402f-be6c-3209e03c982c", "comment": "Malware payload", "value": "1734d2ce99970f0ba62acf9fd4971518425bd699", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043534, "uuid": "7c76015d-4af3-467f-8ffa-55b57f61e9e9", "comment": "Malware payload", "value": "6cbc27a0a7a00aac362f22151574b07b4e42fb7e05bcaac8bd9b05c678d64299273ab1a5f236eb39be42b55f59dcf1d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043534, "uuid": "dac26e9d-1390-456f-a524-b7159e5ecf2a", "value": "T154A5ADB28DB79EC52F7824CAC5CE7AC43F1C17538528A6946A4FB27F21585017FD88AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043534, "uuid": "52b509b0-e1ed-4f76-a0d2-83ba4f80359e", "value": "24576:f9iUFS/f/m5PoR/XufqsKRjxZqiOJReeRIXfmg14K+Ogi8oKU+6btP8HFuNmpD+6:1Se5PoR/ewnHSRv4baKM/oSMdsp4a+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761043534, "uuid": "3a22eb14-4215-41f9-a202-fb7fc9c9422c", "value": 2188984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761043534, "uuid": "9ea7d889-bcfc-41e8-978b-be15025e4724", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043534, "uuid": "97ae3924-d3b2-42f2-864b-97bf9ce0ce9d", "value": "SG Purchase Order No. 4501888076.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63139a0a-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761024771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024771, "uuid": "9c4a52d7-ff08-4aa7-bd6d-5425b7e6e60e", "comment": "Malware payload (Formbook)", "value": "d168214ba23ab78226bc09f8d4e05b82", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024771, "uuid": "9ce5f912-5505-4fdc-93e8-18e18d8f708b", "comment": "Malware payload (Formbook)", "value": "012e87fce2e7bce4103069f2ce15979ad19283a15af47bbf4d7c9f6b33b857ff", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024771, "uuid": "a464fe7c-5506-4aa6-8ab4-cab922cbfe7f", "comment": "Malware payload (Formbook)", "value": "830467f7168efa0f6072ed944c1aac8a124bc928", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024771, "uuid": "42757fb6-3956-4f75-8d61-6892cd9e35eb", "comment": "Malware payload (Formbook)", "value": "da75e74e290a3af186927eb6d43bd6be4e347dbd4ff046f30ece9fbe98ec7727a020ac4173d7cc9333f58a3518920355", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024771, "uuid": "6aa95a77-a461-4c6a-b612-eacaf5cc9704", "value": "T1D88163897EC4B0948B85D1232B5E2803E506CC81684E4556FA30F7E879A6B207B6FBF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024771, "uuid": "f1970582-e7c1-42da-b95d-2a1372e26281", "value": "96:RHRIGuqj79wK82enJ6XrR4aZSujRoQucZkSQSLQaF:snJ6XGerRoQue7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024771, "uuid": "bd46ec38-51c8-46e8-9cb1-388c0d08d2c2", "value": 4194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024771, "uuid": "a71ae8d0-1da0-4693-837c-21eae7d437ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024771, "uuid": "c82fc761-cd0a-451a-bab1-9c15af9b9131", "value": "PRIMO SOLLECITO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35dc7a50-aeaf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761072799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761072799, "uuid": "9822c567-1969-47a4-8ef0-eab05383d579", "comment": "Malware payload", "value": "6af0bdcf1b67492afdb63106b2c3242b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761072799, "uuid": "77706a95-66de-4b21-9a2f-3db600aecc50", "comment": "Malware payload", "value": "018aa6b24be2123ecae2075f4c58fcb95b6dd6b5462f6098f1e53dd33f9ad33c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761072799, "uuid": "42197674-e213-4eed-95ce-f4d809f8b95c", "comment": "Malware payload", "value": "4a81269825eb5fe7050976fb30a9a5a3163e4935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761072799, "uuid": "a70bdd73-35f6-4c3f-b1d6-1f39e2b2ad54", "comment": "Malware payload", "value": "973cf386fb1c91c98212d8c1092aa4ee8df059e103bdaa2f216fb230bc76d557361510bdf841f8a54c2f12414ac9df71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761072799, "uuid": "98d92b60-d6eb-40a5-b398-236177770287", "value": "T1D367239696E6A3D4CBC11D48658912DE32C0A8BEC4FD99283FC71C02B434DFB4599EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761072799, "uuid": "f6177126-1e4e-4f7b-9d88-cadb2fddd962", "value": "75b61e6ac8c2bba8a92b824fb7ebe073", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761072799, "uuid": "0c12e6cd-3712-42fa-adf7-b7bb85f1f330", "value": "786432:/3GD78wMT+Sb96shh4U7x4J/jebfDJKe7sQ:vG78wMz5zhhi/CDV7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761072799, "uuid": "3ce576d9-719b-4eaa-aa73-5a4ff8013948", "value": 30446080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761072799, "uuid": "43eb98ab-5afe-45cc-9e03-1b05ffa9448f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761072799, "uuid": "33ec4f23-75e6-4a93-8626-30db73681060", "value": "launcher.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153e8b01-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761024641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024641, "uuid": "19d1ff56-0a47-4407-adfc-c0ea06399b86", "comment": "Malware payload (AsyncRAT)", "value": "3827a5185fabfc68dcba7881af4d554c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024641, "uuid": "2c76aed4-285f-4953-be39-3ac2972b55c1", "comment": "Malware payload (AsyncRAT)", "value": "01ee90a2b1295348dc4495943a09cdaa2941a30476c5f7a3054f905f106068a0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024641, "uuid": "92f346a4-816d-4696-9197-86c8add442f2", "comment": "Malware payload (AsyncRAT)", "value": "daafb39a610ddc4c3e85099dfd325233f3a211d5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024641, "uuid": "17c59bf7-74b8-4d3e-b7b8-f87c24bc9c53", "comment": "Malware payload (AsyncRAT)", "value": "c06d7f32719eb81bd27c80eb60efa38d8854e25de7232d5af20a51a67cc660116a49ca7c912c012585cc4e9e4c6e302b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024641, "uuid": "bc028538-7fb4-4842-87e7-f668b203d9df", "value": "T1951613F887498C0842AB86974F758D40BBEC8B97504718EB34614DED6B7AC7805F2EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024641, "uuid": "2897626a-581a-47b7-acb7-b24d9cf7f8fc", "value": "1536:a9a0hcpM+9DqizBfErn15dJMWEuUxErWpidbvyKTmc:OantDqizBfErn15dJMWEuU6rqidbYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024641, "uuid": "b7776da2-1d8f-4764-afb1-529f6b744437", "value": 4391763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024641, "uuid": "e7049878-d56a-41c1-8e48-085d5ffcf403", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024641, "uuid": "658e1107-ad02-434f-af85-692e4d1548f1", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1f5baa-ae33-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761019851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019851, "uuid": "c4450990-068c-46ad-afe7-77e135654221", "comment": "Malware payload (Mirai)", "value": "3bcf1dc06a290279a166780733c6e1bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019851, "uuid": "61a363e6-5658-470a-960c-4f3b50a30a7f", "comment": "Malware payload (Mirai)", "value": "02f75834327203d2de636916cc829afb034913ea7e872e523654ba0bccdb66e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019851, "uuid": "be31a11e-9f1d-4a45-8ad6-210ec60fd961", "comment": "Malware payload (Mirai)", "value": "a3cbe25971d4d3ed75111d51490aab06364daa32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019851, "uuid": "5ec27b7d-846f-4a5c-8bb6-59ffd08bb4c0", "comment": "Malware payload (Mirai)", "value": "6acb91dd842d0afbae08708dfec9b7e5d6a93ad44bb5a4a6b73061a047893816037877f8b2648d3995f1357b31354fb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019851, "uuid": "4185d3a0-5d62-48a3-b77a-0507007b6ff9", "value": "T1C2734A22A27C5727D5F0AA7511B3632376EA2B840464D78FFD690E0FAE633D0191B7B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019851, "uuid": "49133983-6355-4d21-975c-19ae3da4ad80", "value": "1536:M/g2yyZSfpvZ54Vd5EN5/dFtviyzmUnkNfAVDfLD5I1BMmW:MY2jIfdZ5ia/HLJVndFmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019851, "uuid": "6b43d2f3-4023-470a-a893-bc84a2f4207b", "value": 77452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019851, "uuid": "46592b8a-2075-4446-9e54-26be69315600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019851, "uuid": "75189d70-3894-41ff-afcf-d0fddbbeb077", "value": "Orbt.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f1e6ff-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076794, "uuid": "7538bcde-a3b3-4132-983f-de3921c190c0", "comment": "Malware payload (Mirai)", "value": "c61ec4073ab55e56c258472c2ae0b35e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076794, "uuid": "7e267d77-eea0-485b-acc3-a28ef647697b", "comment": "Malware payload (Mirai)", "value": "033b13bacbd44edc3d309059e88f71e72f8a18eea48cd90a657462226652c86f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076794, "uuid": "b69392fa-d38b-4741-b9ef-4dacaf7f4f57", "comment": "Malware payload (Mirai)", "value": "6f854460ae6b4c820fe999f7293767b43f6d6284", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076794, "uuid": "f9b22416-7b52-42ca-9fd9-9aa60c64c335", "comment": "Malware payload (Mirai)", "value": "32c664f99cbb4c85eb4657b04779d20ad3895dd67e40b637a14ef5a52020c17f418ee8829f533311e14f39f570d84128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076794, "uuid": "ab060c20-4bca-4556-bc9b-0fea1595d985", "value": "T110936CC5F643D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA2511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076794, "uuid": "9e5e35a1-5b0b-400c-8be1-fca88cf60c61", "value": "1536:xpmWc2AcighsZ82fJxfcjHD1mSsM8meUigBQ9TnkISGtAd/0xZ:xpmX2riED2frfYHhmLVUBQ9kVT/0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076794, "uuid": "d8acebd1-2de4-4be7-9a79-9a941eb8fb80", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076794, "uuid": "d7563a52-3933-48d4-9793-91d23766bcad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076794, "uuid": "fe0595be-75ba-458b-8658-13832d723232", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a65770-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761024636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024636, "uuid": "031c7e08-6274-4739-b89d-9b64aa875d51", "comment": "Malware payload (XWorm)", "value": "0cb5775e5ac5c495c937b416e9f0f4cb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024636, "uuid": "12bce220-be0d-4954-9e56-fde056f82d8c", "comment": "Malware payload (XWorm)", "value": "035c1848b2e8d2678aa8e141eae0542f7944a32e00a55226165e67dc94cf28d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024636, "uuid": "70258109-0538-49f6-8ee6-5f5be4bd1212", "comment": "Malware payload (XWorm)", "value": "eae89f3625b157f56114180a550e4e1495533456", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024636, "uuid": "27a674fe-a188-4381-b820-ad2828bcb61f", "comment": "Malware payload (XWorm)", "value": "f9e826699e72c451c494f11c884b3f91f9afdbaa89d978a923a9d90ee7f6fa7253bf71dcacdd160b6a869a20bd550b42", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024636, "uuid": "ecd46b68-3fb2-4311-9419-681cb0ecc79a", "value": "T157066209FAE29D48F7A1DE994A03BF85C5140BE735080DA274BCADDC6FFA1B0619417E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024636, "uuid": "f207002c-fdfe-4a28-b6d3-b320567d7347", "value": "24576:RrgHCaLALbnrgHCaLALbKmc/QMYqp60Y296r9TBEDErgHCaLALbrrgHCaLALb5:T164Fqp60Y296r9TKQh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024636, "uuid": "bcb02fef-68ae-4957-b447-29f5062df1be", "value": 3715037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024636, "uuid": "754dfe3b-939d-4109-b794-afe356cca7c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024636, "uuid": "d554c75b-c4c4-4473-92ea-ae7556fd77da", "value": "Catalogue and price list.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07904ef4-ae40-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761025047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025047, "uuid": "a0292eaf-1529-4835-bbe1-e33e79ddb037", "comment": "Malware payload (PhantomStealer)", "value": "ccbffdf02eaa3e00203ce6c4a143a1cd", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025047, "uuid": "004820a7-3814-4eab-9482-3e65651f00e8", "comment": "Malware payload (PhantomStealer)", "value": "0462d2a890595de741f9a29fb99102e43ce72cfe000aff7afbc749771c8bd819", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025047, "uuid": "4de282b6-a399-4cfe-9c79-9a12bf28ae06", "comment": "Malware payload (PhantomStealer)", "value": "a73904317176cb6c4f8ad054a925d53b3099ffa6", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025047, "uuid": "4ad69eba-3874-4f33-9017-24114ff84119", "comment": "Malware payload (PhantomStealer)", "value": "4780164ea66181ddf3d2d613624d2a12ef7d42e7c3bdd56361f29eba1e1b97a98a57691fe54ee7075e69c843dc272658", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025047, "uuid": "cfc63670-1659-488a-8285-68fe271339f9", "value": "T13A05DF2BFE3BF8C8C629A7BF74D41A3E00FD0B42B627CA6C9D9D4C61641B64547520E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025047, "uuid": "b3b309b7-e993-4312-b242-62b0f173e07d", "value": "24576:p5xD3eu0jkWh6WT3CEC5VD9ltJuRSrp7LAt:pbTX0qW7p4JLMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025047, "uuid": "84c9ce3d-6e3a-454d-aefe-fb58ab252058", "value": 862440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025047, "uuid": "08b610c0-6469-4990-8494-ed64172432c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025047, "uuid": "c61a54af-fc10-4821-8800-37a17d5e97ec", "value": "SWIFT Ref No TT 00189330982.zip.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de67546-ae96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761062182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761062182, "uuid": "e4b5aac6-1fce-4e0e-852d-997cbca67f6b", "comment": "Malware payload", "value": "3014864c047a51a35c8095b8072b3cac", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761062182, "uuid": "eaa01d35-dfcd-4b72-ab32-b9c18f5a6f09", "comment": "Malware payload", "value": "04c235057ccb53c25e65bf1fec0bfff1f9ae2e70f1019055b9b8eb28359c205f", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761062182, "uuid": "fc6debae-dcb7-4f21-ac05-175038482221", "comment": "Malware payload", "value": "a32070ec751d5cf766c9e9c9147952ca52bd2333", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761062182, "uuid": "ca7d2962-dbea-4c7c-8aa3-6c311074a353", "comment": "Malware payload", "value": "a6afa2a7ac2ec39f44334b581ccbe71f80149976a5b4df8c26b2f6e9b8623f11bf3a890e0cd016a9e80abb4730801de9", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761062182, "uuid": "313d94a5-bf2f-462a-907f-0eac92295b58", "value": "T1051833A9A24378B6E476537D5B6881FB53171CD3A53025BBBC73B8DFE2707200199A2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761062182, "uuid": "cfa9f7af-945e-4dd1-9c49-108c9f0f95aa", "value": "1572864:yqIDxfodpG6sLf9SGAzX0rvrHjh7XJXQ5zaOvHNE67UKRSySwHq9t2TV:NIDyPG6QlSGAj0rvr5XRvItpUKRSaY2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761062182, "uuid": "8c2a3fb1-98ed-4e23-97d0-8b474d634bc4", "value": 91725824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761062182, "uuid": "11e98567-21f6-4eba-aaf2-c894b39f6a3a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761062182, "uuid": "340d0f61-f3c2-422e-ad9a-b705487bdc92", "value": "EnderForge 2.1.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadedfbf-ae36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761021026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761021026, "uuid": "1e4a480c-d54e-4673-9e27-b96c4295ecb3", "comment": "Malware payload (Mirai)", "value": "ffebedcf888d45905036b71ed1faffb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761021026, "uuid": "cb87bab1-3bf5-4106-b6d5-d0b62f27f5db", "comment": "Malware payload (Mirai)", "value": "05950e9d453965f9e24a51234ea10ebf45b3245cbef7a1e222c0ec2d0e50d9a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761021026, "uuid": "5b5abb77-0ce5-40c7-9a50-40c562e458e5", "comment": "Malware payload (Mirai)", "value": "6f626ab2b1eb92caf64d968c07105fa657e3e953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761021026, "uuid": "3efc021b-98f5-4357-8b06-a5d76b159de8", "comment": "Malware payload (Mirai)", "value": "1c9476f8ac7d40403d3e435639b8c9162a308542d436099e36f7a36277e7634c00a8935cbb7a36e8aea613d0446dcb0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761021026, "uuid": "9c1f75f3-bdbf-4c18-82e5-99178725be64", "value": "T1D56302A0D29A375ADBFE6D319DC8C6C4233C8BBA56ED8B9150C62F2B098317663465C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761021026, "uuid": "f0a4c246-9813-4f18-88a1-5464f44fc855", "value": "1536:TrVps0RuEVfNIVUvNQKJnF7wNtN9/qetWrZ4u+qgw09t:TJps0JotN9/KZ4u+qgwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761021026, "uuid": "262da3e9-e283-473c-82ce-722b68c52ec6", "value": 69804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761021026, "uuid": "67f03c72-ca1e-4882-a54d-987c31d2b620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761021026, "uuid": "bb7bc45d-5765-4f9d-95b6-ca654c9585b6", "value": "Orbt.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ff05bc-aea0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761066456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066456, "uuid": "99d1885e-f48c-489c-b724-b619e24febc0", "comment": "Malware payload (Mirai)", "value": "f79441b72a602d72363f7614e767c4e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066456, "uuid": "83807b26-3b5b-4889-8e40-7f2ea91fae5a", "comment": "Malware payload (Mirai)", "value": "0751f471b81330448b578cb0c5d0a8ec1ce7539f114aa1fe5be63099fdc407d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066456, "uuid": "0b747b4b-f7e5-44ac-b8a8-30b7c03774c4", "comment": "Malware payload (Mirai)", "value": "27c8eb61da3aaf79d5bc55e167063bd3fc67b6e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066456, "uuid": "f79c6c60-ade4-4d81-bdfb-c0848b6c5de9", "comment": "Malware payload (Mirai)", "value": "c87bc17d8b41e454756a28ff719964460ef8746b0ea1018f7ff0caa295885d867c0f7da848bc090afa33327162f3fbef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066456, "uuid": "20535246-7b3f-4470-a79d-f179a899d187", "value": "T1F9D3A60E3E218F7EF368C63487F74E31975923D622E1C685D2ACE5150E6438E685FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066456, "uuid": "ef4e2922-9f7c-4081-a927-045ff937637e", "value": "3072:9te0cxx/MTf+9gwKqgefWDX8z6hdD171zlybjnDf:9cxx/Z95PkD4ipzIvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761066456, "uuid": "ae28bb22-28fd-497a-a965-029920750331", "value": 142528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761066456, "uuid": "0cba2c8b-6504-4c6b-90b9-6c5f55021982", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066456, "uuid": "94e720b0-62f3-4e52-bd22-9e6bef20b6d4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443e158f-ae2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761016559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761016559, "uuid": "3579b754-ba7a-476f-b3d2-2f6c17dd667a", "comment": "Malware payload (Mirai)", "value": "1fe70fad2af3a89be849083f122ec718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761016559, "uuid": "1605bcde-3982-4978-8b66-0d432a52a5bf", "comment": "Malware payload (Mirai)", "value": "07b1adb027946202303d522c62c3efb2254bb498f343f49957aacf51e55a6d8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761016559, "uuid": "5e06730e-c344-46a9-b979-8d30499bb6a6", "comment": "Malware payload (Mirai)", "value": "7c624032f7a4868950d6c56318298bcf0939e682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761016559, "uuid": "6a76c622-bac7-42b9-9ae3-1d36e0bee641", "comment": "Malware payload (Mirai)", "value": "316b6d507684489de3a9298bebf2cf10712b913b144f4afa65d519ea6ce98a76f3531cb7dcc22b3accd750dac3e3e8d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761016559, "uuid": "f5c7e4d8-d50c-413e-a1f3-8153de8d0ea3", "value": "T105739D63C8255D54D55841BAB4708E3B5723E94066872FF216ABCB77E00BEECF80A3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761016559, "uuid": "f86d69e6-1c1f-4592-aa3d-2ecece9c40c3", "value": "1536:I/RdUfO49POmwRfTadReLK1iE57GOAG5vCozT6DX8P9E:IZdU2uPFwRfTadReu1llAG5vDTKi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761016559, "uuid": "50795289-f91d-4e93-b7c7-69cc15d9b5aa", "value": 79408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761016559, "uuid": "634bb63b-2f29-4ac4-a83d-5c5164a9c96b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761016559, "uuid": "423de9ad-8142-4c74-923a-442c556d7759", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9afbeb-ae9d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761065160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065160, "uuid": "65ba90b1-0554-4e7a-835a-20aa3ef55b4a", "comment": "Malware payload (Mirai)", "value": "07618235aaab4f3c813b36572b85389c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065160, "uuid": "45f158c5-1bbc-47f6-b9f8-7afd0d76163e", "comment": "Malware payload (Mirai)", "value": "089c0265fe505a1bcb043536edea7517211632f208467fa52491697f36b02c0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065160, "uuid": "0c28fd02-2b26-475c-b9f2-b2b8375995a2", "comment": "Malware payload (Mirai)", "value": "d915b146e6a4c375ab64404c4409b8cf2997a10e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065160, "uuid": "324ba3b6-648e-4339-aaed-1b5a01942b81", "comment": "Malware payload (Mirai)", "value": "912d0230c53df7076919c7038313e7b6495e0be02fc29c896028ad2d1022bfe5347fc9d7c6446487866e570bfceb7104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065160, "uuid": "4497252c-82c9-4b0d-918d-c24895e5d4ad", "value": "T1FD632B8AFD91CA16C5D952BBFA1E42DD372513A8D2DE3303DE14AF64378A82B0D2B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065160, "uuid": "3e84898b-4b6a-4f49-b97b-cafc1d255410", "value": "1536:HD0YNY7Hbln9foWm2RFpooP6o8ByKfrnNm0sT:HD0N7pJoWm2RFKyornN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761065160, "uuid": "97289336-a9cd-4f1b-aa78-0f05258c7af3", "value": 67720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761065160, "uuid": "53f0a85d-55e2-4602-b4e5-4ac7a18ecdfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065160, "uuid": "d6a49098-3194-4a74-adc4-725cffa9a8e9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a29dd3e-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761025669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025669, "uuid": "df3b1d46-025c-4a90-be4b-05314e66ac79", "comment": "Malware payload", "value": "c14a3d6dacb723bef57db3909c653106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025669, "uuid": "5cb7a07c-698a-4f5c-b8ab-8ffeeed9ae4e", "comment": "Malware payload", "value": "0a1cfaed9bd5ccf06cf99892fbcff185afd1ea0a485828aed3a98fa1a85ea843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025669, "uuid": "a650e0e1-90b9-4d71-b194-1d32da7acb88", "comment": "Malware payload", "value": "9dd8f630969d5d29e64f5c8b1bd287288a2a7be5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025669, "uuid": "a435720c-1ee0-42be-b4cd-99b0d02cff2b", "comment": "Malware payload", "value": "64716d0f3b408592673070f6ed904ac707100fd84afd7703764b4412118b624815eaa6e218e78a5049eee395cb44d578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025669, "uuid": "b59b8a3b-2a1d-4e08-918b-792bc63c522b", "value": "T16C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025669, "uuid": "ef2cb99e-dd95-4133-b69c-9aa5bc6b5c82", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025669, "uuid": "d9eca395-4357-4239-b8da-5aca2e59e1fe", "value": "98304:aYT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:n2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025669, "uuid": "bb8540b1-8565-4d7f-ae83-43ab66102b1f", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025669, "uuid": "cdbaa5f9-248e-4b6f-9e65-5c6b30487df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025669, "uuid": "14595f0c-2dde-4379-8a28-e0b78c95089f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84bfe3e-ae71-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761046496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046496, "uuid": "da7c4620-42d2-402d-8e8a-5d3e294c3b9a", "comment": "Malware payload", "value": "be6e2feb5fc79e3322fce7edb44351e7", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046496, "uuid": "9026e735-4d77-4ea6-b293-764364b8da05", "comment": "Malware payload", "value": "0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046496, "uuid": "1193a6a7-6103-4b34-b18b-c547e26c872e", "comment": "Malware payload", "value": "6c5f445cb8a9bd4f612c61cbbb0cca79c4253826", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046496, "uuid": "f096e02a-56a6-47a4-95f6-f53df27b38ae", "comment": "Malware payload", "value": "92003441453cae2e2f3f4a5951af03a907e25e79cb1ddadd14580bbe659f5bd056ba9e05fd8fd40cf1f09813670f3c50", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046496, "uuid": "7ad3ca90-bfa1-490d-a068-6b4d286f8c5c", "value": "T1BCB35B103A96C53BEE572934AE3261799ABBEE200DD7531773527F4C1FB3A499E0A103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046496, "uuid": "a2864932-af60-460c-a6f3-f5d74d9cdab1", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046496, "uuid": "cc50ecae-fed3-4ec8-954e-6cffe6587efb", "value": "768:xtFX46WhQH9mfcnUjrwLPp6Zvzx2eMoWrotE4j9icGsuBqWLAT+waxqz7PO0DXOT:xrX4tpfcUjrwLxZYE8ksuBzdoZSRTj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761046496, "uuid": "a693eab0-7f25-43d6-8e71-65e45a469e6b", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761046496, "uuid": "7ed6953f-0867-4ffb-af5d-253f97734f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046496, "uuid": "16484697-30eb-4d9b-aadb-ea41aa613103", "value": "Orden de compra-65678768.pdf9875679876798766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef8d24a-ae58-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761035770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761035770, "uuid": "7fc53625-16bc-4bc0-8ea1-17a015b0bf14", "comment": "Malware payload (Mirai)", "value": "deedf84acf3d2a7f05b9739c8f1394ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761035770, "uuid": "fcb9d789-de2e-4b84-9239-7b10d57e0551", "comment": "Malware payload (Mirai)", "value": "0b8274263dbd40a94a62d89eac37447c892c666e68c5b74850cb44800d585d31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761035770, "uuid": "e2ac0ebb-34b9-465c-bb57-24c1e2b4f60b", "comment": "Malware payload (Mirai)", "value": "d2bc88cc454cf3c35bde7e822957f52897172049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761035770, "uuid": "99552f04-4636-4be0-9117-5e782c6df50b", "comment": "Malware payload (Mirai)", "value": "294f18fa9b0bd7c414069760bd5d4a576ceb301648eec0d6bcdec777a7d3e048b6cb93c110cfcd0f94327fca9a103970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761035770, "uuid": "fa98da6d-ed50-43c1-998b-012727890921", "value": "T15C042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761035770, "uuid": "af83690f-1ea1-47a4-b04e-928883c6c1ae", "value": "3072:O8/WsEhjlvbAmfkIaboVSyckpj/HS0BpCi/hJjogM/REC/HV6:O8/slvlcIaboVS7kVdBMi/XMgM/REC/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761035770, "uuid": "017ad8ef-7d1c-4a6b-8701-76d909e14338", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761035770, "uuid": "508a6e55-7d46-47d9-983a-0a8092a56343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761035770, "uuid": "66bac37d-7176-435d-a468-64fb1d016a2d", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809d3ed8-aec3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761081514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761081514, "uuid": "5660dcfc-4466-4dd7-be3e-4d23d9c4f065", "comment": "Malware payload", "value": "0c32f0e77cb2556e703f9a5866e2946e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761081514, "uuid": "d329ff4b-b0f1-4245-a783-6af3271f5826", "comment": "Malware payload", "value": "0c27b817cb613ba8ebebe3f3216f53a56e502bcd3fa5ecea6169be88410f5a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761081514, "uuid": "f185e22a-06f7-470a-b44e-4cc3f5e1bbad", "comment": "Malware payload", "value": "12884a219c3bf6139b7a7841b9f00cb537921a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761081514, "uuid": "59b90606-7056-47d8-9048-7d7cd6cedd40", "comment": "Malware payload", "value": "c6ae3cfa8dd231cb8a55381ee6afbf2d76d8a153882edd9e45f53349ddad03b0f34d96281cfd97adf93203e0f31406fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761081514, "uuid": "1fd7aca8-9e45-44fe-9843-cef043934203", "value": "T1FC08337AF928CF2BC05BB1354FFE26E124467B933AE55B27592FC84C10D97217824B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761081514, "uuid": "333a858b-8da7-499e-a8fd-76067de848d3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761081514, "uuid": "77f5f5d9-ab4f-4c17-8313-32da33866fe7", "value": "1572864:NM+BWMFDe45kYF6hDRVOYpqE2nVIDwrn+EYr1wm07FV:NdBFle45+hDRVr12eDUwrk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761081514, "uuid": "d3caab21-9e65-4722-b2d3-1e87210f4460", "value": 80670108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761081514, "uuid": "5d4478a3-b88e-4721-8305-3079c3516007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761081514, "uuid": "7d57b85e-63c2-405a-863c-7aabf65c7cf8", "value": "VapeV4 Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7e6b00-aed3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761088539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761088539, "uuid": "9b10053a-11af-4afd-8ab8-d0a14dcf6af4", "comment": "Malware payload (Mirai)", "value": "dbe476f3fe66a7b4060dd5c68b61f059", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761088539, "uuid": "5fedfb8a-9d0d-4c43-99bb-267898f27989", "comment": "Malware payload (Mirai)", "value": "0ce4070ca0ecc461a4f78165ca88dc1d420ab87b9f70e8a92864986f5f613566", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761088539, "uuid": "1b759ac9-064c-4866-a6b4-99b6c62df9ef", "comment": "Malware payload (Mirai)", "value": "432fcd7f758302b08a6311e4e758861df7c05dcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761088539, "uuid": "0966573e-aeaf-4aff-8658-8b67106ca922", "comment": "Malware payload (Mirai)", "value": "6519e622fd50714068dbe3581c94f68bd28c2ca906263e60433a7125749c949dee6d1b11ddaba7f69afe4f174926e015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761088539, "uuid": "8dfaaaa0-270a-4702-849a-fac87930e944", "value": "T16404BF63B74F1091C86147F41BCBAB5D263321029D6B86E76C6F763A6B370DE58123E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761088539, "uuid": "86d21e54-3923-482a-a172-719600380a14", "value": "3072:McQE7qMjL7L+zXXgTjBhFCARHvYD9yiyOG+PpkKEjgdCspsiq+twCNLqA:MdM31pCMvs95PpHE0Cspk+j9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761088539, "uuid": "8e1896d3-9715-4cac-a6d7-f2880814fa20", "value": 173708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761088539, "uuid": "bc53a69f-9c87-41c7-b433-beaa0acfcab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761088539, "uuid": "2aa98b05-e129-482f-b7c1-4ac5ee6a49e0", "value": "Orbt.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a78489c-ae58-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761035387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761035387, "uuid": "4dc69997-6e8b-4241-b127-6dfce05db135", "comment": "Malware payload", "value": "0093df05c6b1a6c92041fcd5e95dbb56", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761035387, "uuid": "8241299d-da88-47b6-be80-16db76085806", "comment": "Malware payload", "value": "0d395e1b5680b9e1530bb3a1071bb1ebe54349174c8059ba8f6dea65fd282e63", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761035387, "uuid": "a8dd0e50-4b93-4e49-8cdc-a1b4419f9fc9", "comment": "Malware payload", "value": "c8fa92a95aa7ec45008c44d01a96cd700bf72a3f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761035387, "uuid": "4142f36f-f39f-49f9-9eb5-6c4a17f845aa", "comment": "Malware payload", "value": "99b888a05be936f5034bdc8411af4b80c8f6beea6e6005e77f8f49d75ba54139ef0dca15a00b707f7bcb043f71bc4b78", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761035387, "uuid": "dff7c0fa-1d44-44de-8e8a-b4205bdeee44", "value": "T18F65E01183F5E480E9B17EB18BF9028C762B6868E738CD3C545F854663CFB39E596B21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761035387, "uuid": "aaaf6a33-9181-482e-8ea6-bc0e1706860e", "value": "3072:XtYKZfJa3O3dxZpSTy3nk92v71RkYHmlSTy3nk92v7CZGkYoQsH+nTEaBX76PDtN:d3nkKvy3nkK5cQsqrX7YDthhtSZWiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761035387, "uuid": "44fa3334-f7e2-40c3-a8f9-dbcad567d808", "value": 1515319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761035387, "uuid": "6ffa757a-fc14-4fee-81f6-117b40f5bf56", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761035387, "uuid": "6557e1c1-04be-4b08-9e1d-09884ccf1cd7", "value": "\ud574\uc678\uae08\uc735\uacc4\uc88c\u00a0\uc2e0\uace0\uc11c.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a7fa4b-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063907, "uuid": "f2fa10b7-3fca-4599-add6-7f07ea977a7d", "comment": "Malware payload", "value": "a0c5180ce1ac5bd44c92f9d2a1a2cfdd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063907, "uuid": "f9ce6b03-ec87-475b-b4a2-1f2b2950017b", "comment": "Malware payload", "value": "0d59963519c7d92687653576e7a72b87bd0d4c98b2b989279169907d1ff3ea03", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063907, "uuid": "d5d10d91-b2ae-4607-977f-8c5526c408a8", "comment": "Malware payload", "value": "dbfa8d47d6b45b4fd410056cf09947ce257b1c52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063907, "uuid": "c3fc9f11-c93a-4765-9335-4d57d6fb1b4a", "comment": "Malware payload", "value": "73eb87812a541c9180693ad84d56b82ddc4b681ddb651104b09901d52f810cc310b760a4bd1ef6bd92ae10b1c1115f7d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063907, "uuid": "4c36697a-b462-4207-bc7a-1d4b58cfa643", "value": "T161A3E70E0527BCAD901CB2D9EFE491762136468695289066173FA3C372D9B77CC2DCEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063907, "uuid": "945252c3-92e3-4439-a325-d931c75768e9", "value": "768:GDhd0i7J4sYKgY/CMNfWdsCjPxH9RrX8drnxBl9+HNCSW6ApTqBeSDSLAuAAroQD:GDB7eKg20JrIrnxXeVAG/D6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063907, "uuid": "98d8a42e-c0ce-44e8-83ba-c28024e45f10", "value": 102140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063907, "uuid": "955d5b4a-e169-4ffa-8747-b066de3e8edc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063907, "uuid": "71e835e9-0ea3-488d-a8fd-59c59fbe3b30", "value": "invoice-1637482117.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b16ee99-aebe-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761079223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079223, "uuid": "95b15b91-6f33-45d1-9d6c-688cdc6fa5a0", "comment": "Malware payload", "value": "1cfedff152cf757721db1e3a5af4e5e9", "object_relation": "md5", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079223, "uuid": "b1913a1c-4193-4028-9200-4d84f8a919d2", "comment": "Malware payload", "value": "0d68ae0d5c1895e915c86c2dd532626a7fde7a55a098f088a4016774c3571547", "object_relation": "sha256", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079223, "uuid": "7b904f59-6348-4664-a576-942bcb4ba57b", "comment": "Malware payload", "value": "0739308b831a3ca99e32b4f7369f6b3502f36123", "object_relation": "sha1", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079223, "uuid": "c9a55356-b11e-4f74-a73d-b18415b9121f", "comment": "Malware payload", "value": "f06b8d93c26a0761a0331db1dacf4d61bb48f3507f9f4dcad4be1c2876e9ae68f1e5f7287e58af34b83c47277480b37d", "object_relation": "sha3-384", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079223, "uuid": "f21a5ded-e800-4600-ad9c-3fe60d7e7bcf", "value": "T129B4BF017580B331E1AB1B38093796644ABE7D604F71CB4AE778B61D0E706DF9721AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079223, "uuid": "10d73164-fade-4e91-a166-fdcf7bd25959", "value": "6144:OArptraBqLlAGXNZXxWaAb8s8K1aVo4uJ+6sai0jR4kQJJOHURV:NFBaimCHxWbJeSJFsaFR4QHyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761079223, "uuid": "42c72463-632c-4da5-8367-9373c11a324a", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761079223, "uuid": "015f6dfb-fdbc-4e75-8c4a-9c301b21dd24", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079223, "uuid": "a0de65bd-92d6-486e-aec5-0a2e01602588", "value": "Ssa_Document.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a83c5fb-ae51-11f0-91c6-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1761032434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032434, "uuid": "0dd30180-90f7-4f49-a5b3-fd5e9bc68032", "comment": "Malware payload (VenomRAT)", "value": "203dcd6044676dcaff965f21c15f86ff", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032434, "uuid": "e4d42a39-137b-46b2-8db1-39ebe85a3e1a", "comment": "Malware payload (VenomRAT)", "value": "0d8a454a6453b81d115b586e09371429fc17b2fa64453381661640aadfe1a565", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032434, "uuid": "c1a510f4-3535-4a90-8c49-27222edfba3f", "comment": "Malware payload (VenomRAT)", "value": "d818632fd9cb07f66f469f9ceac7db3b9a5bf419", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032434, "uuid": "c97c0057-f592-4a1e-b997-bb85d1da278a", "comment": "Malware payload (VenomRAT)", "value": "323ff08e9bb55fb0483a9b435124a0626fdf9f1201cdb0193613acb9e0f7c9614964f7047f3dd12e26bb253865c99341", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032434, "uuid": "fa38de49-a805-4b83-8e66-e4949f4902de", "value": "T1F875CF11E2C2853BD3121539CD6BEBD618197B212A14BB5E7ADDDB487FFD2C22C26093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032434, "uuid": "15a8423c-03e0-4c99-ad8e-433bde103896", "value": "24576:y10SC1dUc8CJjLTIwC9QdvHU3+dL31/o+0B+byhAkb52k/Nb0/eFD:y1x0qkC2d/e+p1ddbyhAkb4+Nb0/eFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761032434, "uuid": "e2596485-0dac-4136-bcaa-9528f02dbdd3", "value": 1603603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761032434, "uuid": "f8ebb084-505c-4040-8266-3d29a5e21434", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032434, "uuid": "605798ec-76da-4df0-b086-05a94aabb392", "value": "OUR REF RET-402-1438.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0486f11d-ae3a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761022465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022465, "uuid": "b1bdedb4-1bab-4a00-b769-2ff6c0b78c80", "comment": "Malware payload (Mirai)", "value": "3eb67670b7f8abc15fe4dbf42745e703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022465, "uuid": "71020001-ecb2-4849-974b-f6b1e5b2b412", "comment": "Malware payload (Mirai)", "value": "0d8c79a42954c491d90b49dc10af15238c1074393e38ba89f7608e41fc7c17e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022465, "uuid": "bef6be27-f41c-48df-93a9-b6d0e529ea34", "comment": "Malware payload (Mirai)", "value": "dcbb299ddebdf1068513e5be99945ab0e98a8dfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022465, "uuid": "a00c2203-8b6c-4628-ac45-80fe13a285d0", "comment": "Malware payload (Mirai)", "value": "1f45244544c3b0176acd28c2a04e984eaa24150d1c2bfaf0cb524e0d360d8d7556ba4568d888a45352eac55ce63706e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022465, "uuid": "4ce7b95f-e2a9-49b3-8dcd-caa76c174c5d", "value": "T16E13F14C51E58CB0EB5DC971AE6CC6C52E3B1918D3EA73A734280379CA3664354E63AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022465, "uuid": "652ffea7-5aa8-4fcc-a1a9-a71e5b9e4e55", "value": "768:wio5f3JwBxjqrApTcDfQopc9KTbuvlxnfPt+SECu73Ol9jVufs3UozN:gYqrAtcDftpX+vXP8CGOXnzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761022465, "uuid": "29a771df-8a17-446c-942f-7f1638548974", "value": 41448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761022465, "uuid": "b2f56128-be25-45a0-baae-e29c99f493f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022465, "uuid": "0320f88a-d4a6-4468-b35c-c6d231c8c481", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad0cecb-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076780, "uuid": "9c375992-06f6-403d-9e1c-e96826e2f9e9", "comment": "Malware payload (Mirai)", "value": "5eb99ca3fa669de1465322e4e07283f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076780, "uuid": "45ec8dc0-6809-4f6e-9389-4199af55c746", "comment": "Malware payload (Mirai)", "value": "0e09913b7b191f252777edde67570350baed659732569d255648dd890039eb39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076780, "uuid": "79b241cd-02da-4794-9c6d-0843cb348d40", "comment": "Malware payload (Mirai)", "value": "a640dbf7ad2f3425e791b13500015ca7e95f9de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076780, "uuid": "84ef43d5-a092-47b8-9642-fb9457b97f2a", "comment": "Malware payload (Mirai)", "value": "d53358cdf9b306dd92f0be8a4a5418f59c034bd28cdb9b2e9c6ff2f23a07161a19e1404f9fbc0c958c1fc775b96f3f36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076780, "uuid": "73c90064-4b27-4402-8853-0667ee383180", "value": "T134D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076780, "uuid": "8147648b-f598-45e6-8d90-e2bb1b5664ae", "value": "1536:wKdzElm18uZJNb4A4Fa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TGC:wKp50XU8e947LPHh+zS6thBZ6xKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076780, "uuid": "ed0f7d5b-5076-4130-a74a-92fa8d6b6153", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076780, "uuid": "a0ce83f9-c1e3-413e-8821-b27caf3ee635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076780, "uuid": "4f1cc779-bbe4-4c19-b361-876447fec9a5", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf1c008-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761025026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025026, "uuid": "c8fad19c-0cee-4be0-a3da-1108be09ff01", "comment": "Malware payload (RemcosRAT)", "value": "a1ec1b45ffb17a81c73fa1e2c022f23d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025026, "uuid": "19461746-8121-420a-8d28-3cac6afa9365", "comment": "Malware payload (RemcosRAT)", "value": "0e2bb880cad9298daae95a54a19ff52056c9d4d1309ae1846773fbce95667437", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025026, "uuid": "2dd86f03-bd64-419f-a14b-6d44e50cf794", "comment": "Malware payload (RemcosRAT)", "value": "bb18cc738a76c87a6226dec389a75b95b1d44354", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025026, "uuid": "63ba7da3-8f8f-4ac3-90d2-d50b7b90a5c4", "comment": "Malware payload (RemcosRAT)", "value": "6f16699cd2e59edc15cc7634e39bf61e7b98af09b0509f3508cdc38609126053273e14df98bb9623d6d8731bb4069968", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025026, "uuid": "294ac5a9-bd4a-42cd-b82c-f2b99428d741", "value": "T1001382DEBA0238245C2224A20C1A04FAEE53C1DF656C55E47A7CFCB5DB35658AFE6307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025026, "uuid": "58188b5a-6a60-4a39-8d95-04763b387e99", "value": "768:bmc7XFvYFJtbg0P/8v37ZOEAgw+YUGq06Qq0eQ9hkYO5NWIhvYNsCvALNO2wEC:T6PfP/8v37ZOEAgw+YUGq0UONhoxO23C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025026, "uuid": "5905d4c3-d862-4d42-9e62-d9ccc73797fb", "value": 43747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025026, "uuid": "b66953cd-2784-4ef2-8323-54e98589b192", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025026, "uuid": "e5d8551e-5a40-497d-bd7a-80921dcf2a73", "value": "Spec_IVMWKOctober2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a228d634-ae70-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761045922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045922, "uuid": "ad02d409-83b2-42fe-a040-a30d8fed52fe", "comment": "Malware payload (Mirai)", "value": "346e5938386ace927e0d968f04455b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045922, "uuid": "dc147434-fc90-4de8-8df5-9918272c749f", "comment": "Malware payload (Mirai)", "value": "0e48d7877b237fd1aef14d78c29c0a725e607ba16f007ba6f1032109d4b0f5ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045922, "uuid": "81bfd373-471a-49b2-98b0-7a66ec1ae7dc", "comment": "Malware payload (Mirai)", "value": "0e1cb7f8936bca2a228a4ac8788f292edf231fa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045922, "uuid": "5ae9d2de-d27d-4531-a583-19811c2ccd2c", "comment": "Malware payload (Mirai)", "value": "f542bbe8dd282cb6f2b6d760e2606e6b66bfbc64233778d6c7dc9128892de45f97d9ad41bf836b667235f75c5a211e0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761045922, "uuid": "5e8039ec-8555-4def-b993-2e76123015d4", "value": "T1A3533A217AB92E17C5C8643A22F74378B2F21B4E35A8C65E7E721E8EFF1465021179F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761045922, "uuid": "6d6effee-ecb1-48d6-a49f-565292741f06", "value": "1536:jo35SszJ7IllnunXoZeb9A6Y2IVJP3+/tfLnHJMuh8W:juArLUQy/Y3PuR7HJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761045922, "uuid": "5ea504c4-331a-4e4e-88a8-511cc006ebf6", "value": 66424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761045922, "uuid": "2ed78bc9-02d9-45ec-9d1a-3b7182ffd6d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761045922, "uuid": "ceb5e7c0-238c-4c0d-ac58-75def0a0ce02", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0619d02b-ae4f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761031487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031487, "uuid": "d9bd6784-c84b-4014-9658-45215dc3437f", "comment": "Malware payload", "value": "5392be1824b5881aad42f39c83dea4ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031487, "uuid": "50464c16-98c5-434e-85b8-96420e5e0aba", "comment": "Malware payload", "value": "0ec3ff5367203922940eb8172cca87f1cdb6cb3e3c74c21c83168a185aa03e7f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031487, "uuid": "16813942-e023-4834-bcd2-80c41fe5a8ac", "comment": "Malware payload", "value": "e0caaec206a60f8398338c1d4ec10c307e2ef3ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031487, "uuid": "b60c86f2-3224-4609-895e-1de28a10af2a", "comment": "Malware payload", "value": "dd773d53e4f6e7d42791e27b445732a04d66e81e31cd59dc0096742ff927e3e60c844900b0fd60d63cd7f2a0597c86be", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031487, "uuid": "5623351e-3295-432b-b33f-ae3d0ced08aa", "value": "T1C1772D443C6A40A7CF698A73D592E71EA4233E06201548FE369FF7FE4B7AEAD1161047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031487, "uuid": "6d2a5fd7-6925-4f0e-b0b3-61575a50c4de", "value": "4f96ad730bf94bad8e3b5396e2409c32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031487, "uuid": "8993e62c-7f7d-4388-af54-dd1a7f560e72", "value": "196608:lNxNkhAkOculTEL6TJeulTEL6TJulTEL6T7mBsCvBsCexmLzyBsCUEzU4E38gOcL:5Nk0zvrOMjTsgSoq2tT3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761031487, "uuid": "bfc9fa60-1d82-44d5-a6e6-95c2444f5eb8", "value": 35902976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761031487, "uuid": "e834115b-980f-4456-83fd-16348569c922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031487, "uuid": "0d4c57fa-8e1e-4932-80ab-c84dce6322d0", "value": "SecuriteInfo.com.Win32.Agent-BCYT.98445366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8705234-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761026203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026203, "uuid": "59ceaef4-72f3-4d9e-9edb-c5b9409be57f", "comment": "Malware payload (Mirai)", "value": "ebc406b4c5f11a564ab87e61bef30278", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026203, "uuid": "07edbee4-8011-440c-8f0e-e43c7cf03c81", "comment": "Malware payload (Mirai)", "value": "0f6cdabd86ac5f61d8f8b462fcffb221a53ccf974f5cd633be1027d33a662262", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026203, "uuid": "6f877d16-aab9-4519-a909-034cf0cf5436", "comment": "Malware payload (Mirai)", "value": "eb9e5734eaf4269816f6a02c8a1bf0f1ca310fde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026203, "uuid": "ffd0c63c-bc00-4e33-b52e-544ef7e95854", "comment": "Malware payload (Mirai)", "value": "e2d7a9ab4ee6c9941cc1ac58d1b28d8147988ed2f7ccf53e63e1b4c31b9eb7aa1fec8a35e54fbffbf111f6f14a1c2d05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026203, "uuid": "e3b5bd46-13ad-4189-bc10-b7433481d977", "value": "T193042A45FC818E63CAC612BBFB5D42CD372617A8D2EE72039D255F25378B55B0E3A242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026203, "uuid": "5dc28e6c-271b-469f-88aa-35382acf91d4", "value": "3072:nSY0lKb715CvlKAXxLY4640lli4RYI/V4vrm5Zl7Hm:nSBlKb7qvswxLyDDi43/VirYZl7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026203, "uuid": "99b2a562-c7c8-4443-9083-a9e43169de2a", "value": 183136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026203, "uuid": "bc4537fe-219a-441e-83ae-d76d840e4c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026203, "uuid": "290a47a3-6c07-43ef-b967-0be41b443362", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c45762f-ae9b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064354, "uuid": "3564b367-7a5d-4a60-8bcf-ce8af6f526d5", "comment": "Malware payload", "value": "b97d8214f7b145b199e823ca86bf46cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064354, "uuid": "7884a4b0-3717-444e-b98f-81f4286e60d6", "comment": "Malware payload", "value": "0f78a20c46cece8cdc8c1c387a20a13c6276ce4d20f5fd7bcde8df8d17868b4f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064354, "uuid": "affc7cda-349c-4e47-ab1b-f69bdc8611ea", "comment": "Malware payload", "value": "c6f02196f88e5591d22cc48b0c6f05ecf327084e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064354, "uuid": "9c893549-893f-412a-8df7-ae712f6934ca", "comment": "Malware payload", "value": "4eb1978b6e762abd15240ec21f6c9449e47667ec2dffe290cc74a417d6975566e50182d0eb4ad1253df7e1fcf76ba346", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064354, "uuid": "3c70a885-a4bd-43b7-902d-44c311383149", "value": "T17A13A3C667968DBED8B43E71E8B277148734D9162113432B3789B4FC68EFB8B0593690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064354, "uuid": "8a8d6ac0-aba9-4ad4-8ee5-2398b339512d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064354, "uuid": "5375d0a4-d0bd-46ec-bb58-e32e7cba11f3", "value": "768:sVETU9DWW2XhMnf3mnfF9mMf/au5EQW0inLmi8seFebM0fZcyf7:mWJXhMn+/qfxnvVee4IcyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064354, "uuid": "d05ab0c8-9034-4e6b-ad31-07d7d775cc2e", "value": 42198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064354, "uuid": "4074a267-7831-4518-9219-1963631546b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064354, "uuid": "355e1b9e-9686-4238-a8c7-c5f26730ccde", "value": "SecuriteInfo.com.Variant.MSILHeracles.140927.15653.18006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856f0ef6-aeb0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761073362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073362, "uuid": "faa332a2-08eb-4be3-86cd-b521ffe09ad5", "comment": "Malware payload (Mirai)", "value": "e07e7fd35b1b2cc4c5e560c260d3dd5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073362, "uuid": "9792c20a-d16c-4b7c-948e-b83ad069ea51", "comment": "Malware payload (Mirai)", "value": "1063b8498116369739012184500ba1ba84e4804cf66ec84786c86fc929951d15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073362, "uuid": "5ef1d297-bc8c-4dda-a0ff-071825c9e8ee", "comment": "Malware payload (Mirai)", "value": "aa3ad188048b84649b86ecfdcef357223638818e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073362, "uuid": "44ef192d-04aa-45b5-9ac7-3dd19b2f0a6d", "comment": "Malware payload (Mirai)", "value": "487cb8439ca9d1c3df9ecd8d323d767157434b3242525dc3323c9d0ffa2b520bb6726f1eab59a2dcc289b656b0587dbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073362, "uuid": "b1489ac5-9f12-4b24-830a-f96f1cb3b1ab", "value": "T191042A45FC918A67C6C612BBFB5E428D372627A8D2DE32039D256F2137CB55B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073362, "uuid": "82d8c398-5f1d-489e-a472-f185b2837819", "value": "3072:kM+OqM8ril6sjsmwv3YlO7OrOW4C33u2tizarhM4m:kMRqM8rWgZv3/SaW4Wu2cz6hMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761073362, "uuid": "98b81546-f487-4ee2-afa2-2c9213845b83", "value": 179904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761073362, "uuid": "d453b1e7-4c47-40d4-9d63-938d25a2cf5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073362, "uuid": "c32a95f7-4ae6-4ab2-a568-b4614af2b03f", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45b8a59-aecf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761086862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086862, "uuid": "c80aadc1-2d7f-4a57-89ad-588b1ac31ae4", "comment": "Malware payload", "value": "4aeae7a15d4d29bcf0be544f0fe43c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086862, "uuid": "6c511c25-7222-4636-85fe-e9d4ffc63204", "comment": "Malware payload", "value": "10d422297361b751f57aa6441f3cf45a1479a6201997af7137de6991fbbe4c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086862, "uuid": "310e3737-63f1-4b35-ae55-1bc1e3d8afc1", "comment": "Malware payload", "value": "c7fb79608ab3f5247bbc1ddffc82520b6b2e6e99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086862, "uuid": "6d4c3a55-619e-438f-af32-b2231c1d8828", "comment": "Malware payload", "value": "9db1ee4643cb30bec4305e6dcaf60f5de3b35d43b18c0ec3ce40edf362b1a77eed34c5823cb65011e16a640af5e728c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086862, "uuid": "1669498d-1659-4e9b-af5f-d6ed42dfd2f9", "value": "T13273AE82D8C05475D2A6127D17B63BB56970E6BA6705C2CA358CCDE8EFD0CB092763CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086862, "uuid": "4e43ab4c-0c0c-4a65-bbf5-9c79e430b2e8", "value": "fb6bd8ebf4e6421b53c55dfe7d3c43af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086862, "uuid": "b06df7fb-2abc-48a0-8b2a-eb44a7c3ba18", "value": "1536:II+o6PKmv+/kNA1ypA2Y5x4JOMb+KR0Nc8QsJq39:FbFmW/2Uyp0je0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761086862, "uuid": "d8de07b5-4a18-4f5d-8db6-37dd4b07dd5f", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761086862, "uuid": "6400a4fe-1c9e-4b0d-9c9c-3fd399b54633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086862, "uuid": "acb6b1ed-f6e4-4f5c-b001-65719e39d643", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ee7898-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063921, "uuid": "5ddddc0e-da7c-48d9-a286-4f356b3fd3dc", "comment": "Malware payload", "value": "2376ee7bcee5f847fd576811d263b563", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063921, "uuid": "308670da-0120-4924-94d3-b8519532488d", "comment": "Malware payload", "value": "11e17b0052aaa3acc0d4777c09dcd5354b23f336067bdc25be8809c7ecd282cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063921, "uuid": "b9a7f5d7-03a4-420c-a9cb-2b7d086c1bc8", "comment": "Malware payload", "value": "84d6aeeea0343b2290f0380ee7834947e0eb1fa0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063921, "uuid": "4ea969c9-dfd9-49ae-8f48-522e8526de81", "comment": "Malware payload", "value": "b46b3555f08b2edf6d1203f6ba45481eaacbdfc15259cb2a615d229d2d36a28439a74f9218140ab259abf6926af89f27", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063921, "uuid": "0618dee7-97bf-44fa-981c-fdec5f903cef", "value": "T150A31B459CB37CE112B2BF183ADACC7ECA15A70A0D02E250977BBF92414DF4ACA56747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063921, "uuid": "e1a0ea53-6001-47f3-b027-be23d84ae577", "value": "1536:GDB7eKg20JYxrxr44RprMnEVRAp0HH+e6BkQWJ+aY:GDB7b0JYBtNRBMnEVa0HH+e6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063921, "uuid": "7414789f-844f-4f64-a2f7-78a33ea102d4", "value": 102065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063921, "uuid": "09c2a84d-eb78-4694-aa68-3b28d8c4744e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063921, "uuid": "ede50277-372f-48f0-b9db-994006a21fd1", "value": "invoice-1637482117.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb4deb3-ae69-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761042932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042932, "uuid": "212bab06-f164-4a3f-8522-87717f7e6c2d", "comment": "Malware payload (Mirai)", "value": "e082ea841a38de4399f1eee1b22c2997", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042932, "uuid": "7efca62d-68c5-4ce9-bccc-2ab13f4bbf05", "comment": "Malware payload (Mirai)", "value": "1256e0395961d0f20f2a13f143e14885bcaaf4cf72072204bb03eb60f6ebba50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042932, "uuid": "480158ea-c22b-4840-9d42-e0fa94c22d14", "comment": "Malware payload (Mirai)", "value": "29f47aa64afdbd968237f81e352d964f18f7a050", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042932, "uuid": "80c692ba-afe5-45d3-bc30-b60e96f135be", "comment": "Malware payload (Mirai)", "value": "272bef825ae7559a693b0c711758e4dc6f38ed712e902d14c1f31b04fffdfbb9528727cadc5849b74bbca6a2e1756a56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042932, "uuid": "2e9e0529-d7f8-4258-ac7a-d3cb733beb0a", "value": "T19F83C5497B614FF7DC6FCC374ABA5B0528CC550B21A83B756930E808F65B25F2AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042932, "uuid": "81030f5c-26c4-4ec5-ac45-66e6a3c92bf2", "value": "1536:01djd6qVqkwO3a+7vJaFaEBQGRhYkFZEnJ8VR:0PZ6qV1wOJyREnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042932, "uuid": "e6fc8296-0e79-4bbc-85eb-c657b9ab8693", "value": 84248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042932, "uuid": "1e94dcc0-cffd-41b2-8347-d7ec7447bb03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042932, "uuid": "132ae9c9-53dd-410c-ac08-809fa0dad08c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3bcb8c-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076786, "uuid": "865157a1-adee-4bca-85df-8fa6eb654173", "comment": "Malware payload (Mirai)", "value": "648013014d947108e0ef3807f13651fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076786, "uuid": "593a3f4c-b004-48fe-9012-3e1cc0078c2e", "comment": "Malware payload (Mirai)", "value": "1331801e04e1939b1db1f7777f4bf20b6bb27ab0908416b752035f9aaf756e73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076786, "uuid": "c40936c9-b80e-4c45-960a-dfc4031a189d", "comment": "Malware payload (Mirai)", "value": "d96becead7a811a798c0f96ca32b90ed756a3b1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076786, "uuid": "83950044-d4c5-46b0-bb0a-a9d5858cc018", "comment": "Malware payload (Mirai)", "value": "8d31d5e13443193ebffea8e6e259eec85fe753d73df201e9f3f27fcec4a5d5776e162277fb8c86a3836f2b1e69427c2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076786, "uuid": "8f3c5e6d-563f-481f-8006-82cb8df51165", "value": "T1D6B35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076786, "uuid": "68176b79-bc6b-4449-9f6a-99c902cc8131", "value": "1536:WTW/VCxsHZusS2Li62C8vqKTR5/PPVGAto2WszrW+TNe70:WytCxsSx62NFT7VG92Wcrbwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076786, "uuid": "bb1f7483-a7c7-4e9a-a4f4-155401028386", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076786, "uuid": "2d4069ad-d2b0-4f5a-b659-52e78c6f3596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076786, "uuid": "f7ffe76b-6fb0-4943-b60e-ab1b59d4adee", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c82734-ae6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761043516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043516, "uuid": "caf777cf-7958-495f-8b03-28c0f4a6ca37", "comment": "Malware payload (XWorm)", "value": "61854283073cc9f5f27a66044801f704", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043516, "uuid": "62705085-932c-4108-98ac-80284a1de29e", "comment": "Malware payload (XWorm)", "value": "1527821411b39f5636a3756baa364a3ff3c25d733bff28fb0c68860fed09c8d0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043516, "uuid": "d3848e5b-db9b-414c-85bd-57f495c1cc70", "comment": "Malware payload (XWorm)", "value": "323c6a2b6f69687f297699b43215e7993d6af7f7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043516, "uuid": "64858adb-69c8-4ae7-b3a6-2b0afbc8fcc8", "comment": "Malware payload (XWorm)", "value": "46605d5f24e964a025daf67f08a6062c396ad6273e5d59b9e630761b6172cd0c3607623e93df19b2f300e3bb4904c9db", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043516, "uuid": "970846fe-a859-4bfc-a543-d9dd66c7c809", "value": "T157E382398DA2AED9C2EDA4805C542D5B107DCD036F611E2CA7B28976DB176C0B7F334A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043516, "uuid": "91649d81-7bd3-49ca-b093-3fb6781ec546", "value": "3072:jhNfJXYmq05k9lBbLFmtTP/SK4gDL/48punopDUvH9AtvqfhvO:vBXYmqkswtTXSW482vWtvqfhvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761043516, "uuid": "98cffce1-8d2e-4354-bbeb-0e0512fa4982", "value": 148271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761043516, "uuid": "892f538e-8abb-4dd7-996e-826274f7a175", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043516, "uuid": "c593399c-1217-41ff-b9f9-0e63499e976b", "value": "Quotation 30291.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fe487a-ae4d-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761030876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030876, "uuid": "607fc0eb-0210-43b3-9f66-2e43dcd38199", "comment": "Malware payload (AsyncRAT)", "value": "31c4e58f3464e7a3c4880c9b84a40841", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030876, "uuid": "4b595c37-3b6a-4315-90e7-73ba442a7b8b", "comment": "Malware payload (AsyncRAT)", "value": "16f52bdce049aa521cfd843f1425ead60bb4386698fb06ec7a3af59ddce20172", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030876, "uuid": "1e9b88c5-ca33-43ae-bd68-d02314269f98", "comment": "Malware payload (AsyncRAT)", "value": "b76e2916104dea7d9e8c2f463005e6e204737956", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030876, "uuid": "d79c9ee7-b7ca-4aab-b706-2e29ddbc99f3", "comment": "Malware payload (AsyncRAT)", "value": "9862eb6530d5741ccf56a9e0e38ad0fafcd32e4da6f4e08151c8515f13e646b4a71e01772fd0a653b6520a6be2214a4c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030876, "uuid": "2e577ee5-6346-4a5d-b322-752163968b2a", "value": "T1D9259E027391C062FFAB92334F5AF6115BBC79260123A61F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030876, "uuid": "5d89a7e0-c59b-41ac-8c89-721dda0c68e1", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030876, "uuid": "c2606cbc-6d2c-43dd-8106-cfea3ea221ff", "value": "24576:e5EmXFtKaL4/oFe5T9yyXYfP1ijXdaS6DZ40t:ePVt/LZeJbInQRaS6Da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761030876, "uuid": "04ab59c7-050b-406e-bb04-0f0a4f6029d1", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761030876, "uuid": "763fc6b3-a036-4240-99a6-d558ae7a515b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030876, "uuid": "a1fde983-e9bb-4d06-bad7-d950f2db4935", "value": "FACTURA 16102025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d46f19-ae63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761040479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040479, "uuid": "b77bed4c-6f18-4b74-adfa-79edcba1548c", "comment": "Malware payload (Mirai)", "value": "66dcfdd8d744a9e6d0fdf0a2e207d7dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040479, "uuid": "a38306a2-0612-4f69-929e-c178f82541d2", "comment": "Malware payload (Mirai)", "value": "1859078fd37eb07455df8c14919f929098d42b96095cdc8e4a684060dd8fac9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040479, "uuid": "f8f97f55-c27a-4943-8040-36b36a513f15", "comment": "Malware payload (Mirai)", "value": "a0bb159b69d3f6a0cd9b8fcbb66e45ed265d1dc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040479, "uuid": "5f746432-5de2-41fb-8566-939d835a3db7", "comment": "Malware payload (Mirai)", "value": "8532200c0a8b9bf49c8006209ab653746870c617dca4b5bc20dbae3c82762568ac7156f0faa5f3d475c9b36593717421", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761040479, "uuid": "4d6e0284-f58e-4139-95ed-5dd175b9f99b", "value": "T1BD34B64E7E229F7DF768863447B78E24975923D623E1D684D2ACC2101F2429E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761040479, "uuid": "0880e938-00d6-4e92-8071-cfb258ba8513", "value": "3072:jsKkSe/jB7+fbAUxU+QUqVBMLYxDvAvGrPC2G7+yBkKmxkJm:Dkd/jBQbAUxU+QU+f1v3C2/yB3mxkJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761040479, "uuid": "cfc7bbb8-99f2-4b75-b12e-3d76d5105653", "value": 239768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761040479, "uuid": "d6247ddf-55ab-446a-beb0-be3141bc46b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761040479, "uuid": "f5f24d57-54c2-4639-b909-fe9e24a035b6", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7935e75-ae5c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761037395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037395, "uuid": "41fd5b51-495a-4671-972b-1fde95974a4d", "comment": "Malware payload (Mirai)", "value": "7fb1490b72c307eef372710445bd6986", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037395, "uuid": "28d554cc-d581-4889-8faf-fdad643a76bd", "comment": "Malware payload (Mirai)", "value": "18e760c5f783cf98c93752c8d4238ac2b3b74b295f45ebcac4bc183ed3ae5c24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037395, "uuid": "041346e6-37f1-469a-9d7d-1be7b36a4da9", "comment": "Malware payload (Mirai)", "value": "13f2e553b12d88fba1ac67d7abc2fa3a107cb5f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037395, "uuid": "58b0a1fb-edf3-4ade-b7a9-74a99ccf8ca3", "comment": "Malware payload (Mirai)", "value": "ee4ada594c70bd894f9c6548ea18ab109da95ee02b4008630011c81f2d032e3fdbc9a735fe8f3a6a3cd88ba809b46d17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037395, "uuid": "5d0b2e46-6cbd-44c6-9adb-2ce0cc1a9e77", "value": "T1C504D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037395, "uuid": "cebbfdb0-f723-43f5-a7f3-255a47bd1ed0", "value": "3072:ueEksFM+wX5OZaVR8H3NaMZOTTMJxt9U+7fKbvE:ueEnO+wXBVWdaMATwJHy+uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761037395, "uuid": "54cc0364-291e-4e6c-85ca-cddc5512fa71", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761037395, "uuid": "764eef22-874b-467a-9bc7-a927dfa77437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037395, "uuid": "c4801eb1-faaa-42a0-8364-90d66d17e0e3", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786a559f-ae9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761065609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065609, "uuid": "b38e38f1-dfc0-49e9-ba78-f3cfdc5710ed", "comment": "Malware payload (RemcosRAT)", "value": "04080ff457280758362eae61947c7563", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065609, "uuid": "c9d588fb-b5de-4643-ab69-db0958939e97", "comment": "Malware payload (RemcosRAT)", "value": "194ebd6043d877ad1f79aeb6227d6d58c3c2697c29c0b84dd83970e947f73c15", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065609, "uuid": "40f3a003-817e-4f26-8b0a-009a3e1a21fa", "comment": "Malware payload (RemcosRAT)", "value": "b63337b32e23b7846cabdb7402f1fa1592ac2f64", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065609, "uuid": "a602018d-60f7-4608-a057-075bc59d8a6b", "comment": "Malware payload (RemcosRAT)", "value": "5dee12aeb73cc6061de904e9404ba0dd71201094b2b5a8e86182143cbd57a538c532c92c192ac65280c0b1a72b3c2b90", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065609, "uuid": "1c96e4b5-2de2-4698-a0d2-0eb206a2ee99", "value": "T108D5011589C42FB9CEAC5A1C80FE161E53F05A9B902AB58AFB33BD47AFF7544020B1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065609, "uuid": "1dd5cd9c-c4c3-4408-b227-c715c0402390", "value": "49152:s4z1pApbbzIrCGfBWkH6aAKKrjZ7z78D8b:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761065609, "uuid": "0f8dddc6-f7ab-4582-a2c9-cef3eb4dbd49", "value": 2950914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761065609, "uuid": "4ece8ee5-c584-4137-8987-be618e0918f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065609, "uuid": "5ab2c809-03e9-48b7-950b-ffc72004b996", "value": "194ebd6043d877ad1f79aeb6227d6d58c3c2697c29c0b84dd83970e947f73c15.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db71397c-ae81-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761053320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053320, "uuid": "6beb9d2f-df28-472c-94b0-9aca2fbd90c8", "comment": "Malware payload", "value": "d831b98ff2d708df5f37fb296994f537", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053320, "uuid": "2987d0be-5247-4966-803f-417217dd1116", "comment": "Malware payload", "value": "1ce3b5711bb0dcae1e69985630c43dd5351963f00cefaa95804b25bd6b893527", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053320, "uuid": "7953d8af-0edc-46cf-94a0-cc144bcd5853", "comment": "Malware payload", "value": "47e8604dfa3cfb42c1e8a3569fb33044b970ab3e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053320, "uuid": "1d0d63e3-e34a-4606-9a2f-b46c9659a06d", "comment": "Malware payload", "value": "b260587b336dd820febea5c90ac942cb980d1795ce84b846a1f41a72957ce2dd1afc25999e4f1bc640167bfcf26ae301", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053320, "uuid": "392ed1de-330c-44b0-9bf7-3974bec66191", "value": "T15DE07DD4507F049FD31103F1F9004BAE35926800511DD7571C9FE010281E18E6B9572E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053320, "uuid": "9f004c97-327b-43e0-9b4f-5d112ef2f203", "value": "6:5j4aDuSqKuzVW6VCQUBdGCRCykqLvEZQ0rSwYALzitca5ECtOyHO4nmt+lU1:5j4aDLQ2BYCvBaQMSwzH8cLYO81mta8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761053320, "uuid": "602c93d8-d369-4345-84d1-41c8ee040bf1", "value": 324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761053320, "uuid": "5a59e8a0-6d98-48fb-af4a-8d93b51bc6b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053320, "uuid": "577bfbab-8eaa-44c8-9f77-08440b48d251", "value": "Quote.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306123b5-ae68-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761042295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042295, "uuid": "c795ec80-91eb-47ae-b624-f7ea52cb8bb9", "comment": "Malware payload", "value": "5028c7c09a9b4296d4d5ea3a6c06a61a", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042295, "uuid": "25313a99-e1ba-4e56-aade-3af0a81ba055", "comment": "Malware payload", "value": "1cebc1c34658d5cef12b2a07c7c6b56f6a4008bbf302095d4990d606e956de9d", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042295, "uuid": "5681f96c-ef5a-4dc7-bf85-21867da788d6", "comment": "Malware payload", "value": "8468d4c0d6929a0739824a0c3adb1b08db5db5e1", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042295, "uuid": "ce229cbb-ef12-4cd0-a9a9-ebbdf657ddea", "comment": "Malware payload", "value": "0adfbbfe7cb793f9195585df2f552e540f929fc0316e6023a890212ac9b94aa4ed834dd71e6b3dad1a5eba990954bd78", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042295, "uuid": "329bf1ca-e091-4573-8476-ae2fd750d5d1", "value": "T17D4501A1DD268DD0056CC54A74AE6F04668047A30D043D5E33A663DF0F4F65FAABA8AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042295, "uuid": "b991f84c-8de8-4adb-9194-fc08298a6d6c", "value": "24576:1Vk8TnuMuH97wgoelqv8omW1oMyCG60pupnkItOMK:r3dg9GbTk4O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042295, "uuid": "ca191830-0cc6-480a-85b6-d8adbe20a048", "value": 1254717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042295, "uuid": "68965933-a144-4ce4-a184-281ad199e72d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042295, "uuid": "8b257ee4-ad29-4527-b6da-34c228845d67", "value": "tt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537e427b-ae9f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761065977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065977, "uuid": "ba2559f4-4ee4-460a-ab62-dfe5c9f406af", "comment": "Malware payload (Mirai)", "value": "e98d55500a827d0d2b3cf1d31b202868", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065977, "uuid": "ce33876d-76f4-4e51-997c-9ee2bbe830ec", "comment": "Malware payload (Mirai)", "value": "1df8e5ae5536025aa97ae51479d708edc1b687639905da55e570ca2fe9ca1845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065977, "uuid": "54b82ab6-6695-4764-a0cd-6066bf18e556", "comment": "Malware payload (Mirai)", "value": "dcfb192bde097672c3bee80cb442c840111137db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065977, "uuid": "9679609a-ebbf-4766-b8a6-e6b56ad1baba", "comment": "Malware payload (Mirai)", "value": "f931e04feaaf50269f124b89cb36992284e0fb23c0bd1f708ae7af73f6b8186f3c0f92aa577a4586d48701aeb974aae4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065977, "uuid": "ee197e1e-9c6f-402a-afcd-e4b4e0afb625", "value": "T132D3AEABB24B9811C46147F04BD38FCE3E6362168D4BC9F72E0D663E1CB65DB5906782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065977, "uuid": "cc017678-fde6-4ef2-ba8b-e1efa5bb23a9", "value": "3072:xBIBH/PcnV80wlpKQLdxcsYUewBoQzxQgynWq:xiBUV80WMsYO3lZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761065977, "uuid": "6824ad72-3984-4957-8311-747a6e71dfd4", "value": 132476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761065977, "uuid": "7c292479-2d87-4335-8327-d71c47f90a86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065977, "uuid": "fac36df5-a19e-4100-af72-683f61c439bb", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19237643-aebe-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761079193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079193, "uuid": "f44d3d17-bbfc-4e2d-907e-d7aa68ae1c94", "comment": "Malware payload", "value": "b452c8e1915125bbc770dfd806c46a36", "object_relation": "md5", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079193, "uuid": "4364a294-3cc7-40d1-b21c-01ea848ab6ad", "comment": "Malware payload", "value": "1e5f44a9f0e9ffec1fa66b1179afead53c20ff9bc186571af2c346c178bd29c9", "object_relation": "sha256", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079193, "uuid": "dce78c02-7410-4f8b-a035-98e9ebe880fa", "comment": "Malware payload", "value": "8336ccd8b701b76bb76f4b8b68ff47cb3ee4b964", "object_relation": "sha1", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079193, "uuid": "8f20f3da-e530-4ed4-b678-56c467e11209", "comment": "Malware payload", "value": "fdbec890cf36cab2f017cb4a54dfe848f2190c5214c940b946dc05a4dcd5d64f59678ce7289d873c7d8b00e6f7c85323", "object_relation": "sha3-384", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079193, "uuid": "598b24f6-250c-4740-99de-470bb04380aa", "value": "T151B4BF017580B331E1AB1B38093796644ABE7D604F71CB4AE778B61D0E706DF9721AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079193, "uuid": "a5cf117f-4867-41c1-99a0-bdb4d2913bc3", "value": "6144:zArptraBqLlAGXNZXxWaAb8s8K1aVo4uJ+6sai0jR4kQJJOHUmV:sFBaimCHxWbJeSJFsaFR4QHrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761079193, "uuid": "222c3015-2035-4d4b-a437-a614b3bc8504", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761079193, "uuid": "c19b0616-8e12-4686-a3be-3f83696cc19b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079193, "uuid": "66860d70-82a0-43ec-95b8-1219e87bd033", "value": "Social_Security_eStatement_Viewer_ID191052105558_PDF (35).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95beef4b-ae7f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761052344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052344, "uuid": "9ee9ab6e-b1fc-4cf1-8898-491a0d75db9a", "comment": "Malware payload", "value": "1c635500e01a8b7bb02b6916b7750ada", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052344, "uuid": "06d3b0e7-f62c-46c7-999b-daec6f0fe435", "comment": "Malware payload", "value": "1ee4ee613813a5615226034fc4603a1c43f426505b4929a0eb771d14cbb942ad", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052344, "uuid": "57958294-c1d7-49ff-9bf9-b47cee89626e", "comment": "Malware payload", "value": "3be8588e02e6dc84aabe759ae2ba5d5b1f7cd6b8", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052344, "uuid": "b4c5f3dc-7350-4475-989a-37d9994c9325", "comment": "Malware payload", "value": "aced76f4668851d48eb051c353fed9aeb0eaddedbd6ec7e5e39bfe03ac11658cb77907a0caacf2a1e4c4f1e9548f1ff8", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052344, "uuid": "7a2ea07f-0295-4937-9e5a-5174dcadca42", "value": "T1C57518321203FEDA1B7F5D50D0043A615C5CB967573086ECFE88269BB6EA504FE2A9F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052344, "uuid": "82daa847-0d95-4d54-8e62-87b0ae7cdce5", "value": "24576:RpmWzHHrD7YeOSmMD6SgRPYd5jKuUF1Dg+9t:H3VDmPbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761052344, "uuid": "54036b4f-5105-4f98-81a8-82f126c9c848", "value": 1637818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761052344, "uuid": "da4eb9e6-7861-46b0-9a3d-604ec79c0a4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052344, "uuid": "470c716c-33af-405e-93e7-68bd7d7fe2a1", "value": "03ba92c7d1e0c2383830c3aa389e1b817eddd494208d8fda728c54d83687104a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfdaca0-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064008, "uuid": "dde2985b-de33-4650-b608-53ce9124c7ab", "comment": "Malware payload", "value": "1249cd0f736ae8b522fb8492791839e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064008, "uuid": "12f36dc8-04bf-4e5d-bdc2-530704457393", "comment": "Malware payload", "value": "1eeb31f2ac84014494747ff095c71b9124793b7165827a893b2d68028f14b9d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064008, "uuid": "fcfe397e-b906-4aec-8585-7aa1a617dc7a", "comment": "Malware payload", "value": "e4ab6029d520d71e7b436e09109bf753551cc130", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064008, "uuid": "0e97ef7d-0e20-49eb-9c83-ade697999a0c", "comment": "Malware payload", "value": "58220a19c9e7680dd259a55f04e678c05368920ab30b0d48c8289cfb6225f7480852a5ef44ae7c24c584f9d9ef76d094", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064008, "uuid": "4f8d6f17-4251-4549-bf75-3f06cb6ad987", "value": "T11AA30A8C9FB299E1103E7E942C842FEBAB083515261D85171077B2E175EEE2BB524CDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064008, "uuid": "8e72ff55-8f16-4947-a4e0-afa7043e81b3", "value": "1536:GDB7eKg201Mwrs+QaeISTgFSKqrsWmRcPvKf6jrSQXfMP85xgOflOqoYiJZXiAkV:GDB7b0x1UCD/yhNifqshgTq6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064008, "uuid": "2b0e4f5a-68f7-41c4-806c-7e0e8cffef5e", "value": 104757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064008, "uuid": "49973aef-af30-4d34-ba9c-421eb3c9071f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064008, "uuid": "b0cecbb5-9e0f-4c1f-837e-78c7d5497736", "value": "invoice-1637482117.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d9d6a5-ae67-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761042192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042192, "uuid": "ee05ee61-6a3a-43d5-9a84-39a77d479309", "comment": "Malware payload (RemcosRAT)", "value": "7b748331b48ca8700a27b7610276ee19", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042192, "uuid": "91c32b8f-63de-498f-96eb-686fbef7f353", "comment": "Malware payload (RemcosRAT)", "value": "202eeedb57ca9a7b74d649829e50bbce24c0f1f4ad36b21e10d988e2dbe0244c", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042192, "uuid": "3b5e2c91-ac19-40a9-b5b5-0b9e5c3b74d0", "comment": "Malware payload (RemcosRAT)", "value": "0ede4bd325fe7e65b3908734c3774a390df0c940", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042192, "uuid": "247a67d8-16ef-42d9-b21f-ef176e2cec40", "comment": "Malware payload (RemcosRAT)", "value": "b9fbeb1791da6eb52e547f695b8e06564a58ca9a8e2a75bdda2d6bcd8888cf764b5d2773d8d238c73b11829f24b84f95", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042192, "uuid": "4c4cb2ac-59b4-49bb-b89d-4a6084c91d36", "value": "T198A5237458D293BC56F5373E61BB2A1BB63D869B844A58BF82F1C9A10143FF042F941B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042192, "uuid": "117dbd60-10fc-4ddf-bddb-f694b0b3c74b", "value": "24576:rbkf2oiz1IljHPF4M0oJEILiIgB8TsBGxuYQSPctY62LRrtSdYU/mYntSEDNd4TK:I2o01Iw+aCcgctWKN9ryYBGMj5Mdl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042192, "uuid": "05fa28e6-c8d2-4358-94c4-c873fd040dc3", "value": 2207200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042192, "uuid": "0039eb9c-8d2b-45b0-8bc7-38e58916aa0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042192, "uuid": "b4062ab7-901b-4cfd-bd98-1b89c5fc9b42", "value": "Fore.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aecb0a-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063860, "uuid": "fa9892cb-78f3-4591-8e1a-d62f3a1fb26c", "comment": "Malware payload", "value": "744147378699416ad615d2e404346348", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063860, "uuid": "087fb00f-9eff-4897-ab41-712757a27e4f", "comment": "Malware payload", "value": "207687b7714665530a98e9744965a857463160ebb2fee537b53e4a8edaede8df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063860, "uuid": "9911c52c-0c72-4bf1-880d-0f48306b09d0", "comment": "Malware payload", "value": "c12211779d8002402bf7a74a3d43ff25b18ac206", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063860, "uuid": "6788fcbd-2659-452a-a99d-00d8e9659eee", "comment": "Malware payload", "value": "203a027141d669842d1fbb93a870426c54c72262b71fbd74e0a9af015a01efbe80b6021756465bc6c910bed3552a61d2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063860, "uuid": "b4ed31ff-7495-4aeb-9496-370b3819b0b3", "value": "T1C9A3C80AEF27BCD45C73BEA4684075718E8FE481B1119097E609F93090DE71C9D6AEEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063860, "uuid": "5bdd4f32-9709-475d-835e-32ae3129c5ef", "value": "768:GDhd0i7J4sYKgY/CMNfWd/btbkb3bxbb5jbvjbFbNbKbJbTbwjbibYbVbhbLbybz:GDB7eKg20Krvr6kAttAt4+6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063860, "uuid": "6212cf4b-de70-4dc0-9748-350baa95bfca", "value": 105999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063860, "uuid": "641346a6-a8c3-48fd-b84a-7923a551c35d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063860, "uuid": "788fff7a-4b9e-40a5-a3e8-0476c1178a0b", "value": "invoice-1637482117.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c906b72-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063925, "uuid": "7ddbe296-d2e2-495e-8797-1ba27e932647", "comment": "Malware payload", "value": "4e14fc70ac32112bd1c2d5f6058fcc25", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063925, "uuid": "94a99401-959e-41d6-8cd3-88db39df869b", "comment": "Malware payload", "value": "210b7f34dfa6b3823b9e89034ab7ed3aeb1d9be744d2f2546fcaebbded78e238", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063925, "uuid": "94ca68e2-2c65-4afd-be59-bccaa2f9e8e5", "comment": "Malware payload", "value": "0b62ebff2cb580e14af8d01d23ee941ef2a0c82f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063925, "uuid": "2d68ea01-cdc2-45e0-8b0d-da5c7d631b4c", "comment": "Malware payload", "value": "8afa3057e0f29e60e16e77de329e9ea084354e6e8b1d85add10212a653dedda89e17605cef3d94883410faf8fc7fe0aa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063925, "uuid": "7d80cebc-ef51-45c8-b6f5-4cd37f9116f1", "value": "T1E4A319909AA07DEE4FD0F5E4BDE88263E72F4E301F59D145D09BA3510498B896EC8EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063925, "uuid": "ef199eb5-6bf3-4cc8-bcdd-a33a3bea92cb", "value": "1536:GDB7eKg20Mq5Pf6hJRu0PZ3Iq5OJL7JOhm1Hm8xBSbcSo7jX+QUphUgL9UD3fo05:GDB7b0yPTg2wm6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063925, "uuid": "e08333df-affa-4672-9e7e-4a5f40b3b34c", "value": 104073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063925, "uuid": "df768ee3-8669-49cd-bc6b-93c1f88a7ea4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063925, "uuid": "dafd7881-0f5e-4f08-99e6-f9cd2c817801", "value": "invoice-1637482117.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eea3ded-ae54-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761033676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033676, "uuid": "88ff0572-e1d0-47b8-a09d-0675da3dba93", "comment": "Malware payload", "value": "90aa71639e2e3fe8ff2666107b9be4d8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033676, "uuid": "4160894d-c806-4319-a921-229014b602e0", "comment": "Malware payload", "value": "211a7d72d39b933cd216cd048cd1afd34743a2f4c0a15360dc1638f446c9dc01", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033676, "uuid": "1fc6636b-a84d-4113-827e-81bb218fa703", "comment": "Malware payload", "value": "523c2bf49fc25a739a7fa702bea3dbc0dac5b217", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033676, "uuid": "04f6b0da-0786-499b-984c-ab39f42492a3", "comment": "Malware payload", "value": "e0b1b0235ffdd7832d86427557641dd335b40d01d8d40c92450e1996db39c2e6e0fe414ff759c5422db86dfa15ce842c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033676, "uuid": "4170e051-4e2d-4136-9873-8bac070938d3", "value": "T1605533AF000D92A0EB87E87649B077A5B5387ACE607B442D9A61458F31CBDE06D77337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033676, "uuid": "d3007641-2b75-41a1-9c3e-d1a3b96d14b7", "value": "24576:DrWllvwvCnfeplFJcg2jzvkt4nZ6+CILrVXJLTfbCQhWa:DrWltw6nU2g2XsKZE+rnOQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761033676, "uuid": "7d621b4e-39b4-49d3-8c9a-5e603582eeb1", "value": 1355142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761033676, "uuid": "27942950-f12e-4156-969c-cbe2d4393c39", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033676, "uuid": "17b8cddc-b8b3-4238-bf0e-9e165c008501", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0eac7e-ae74-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761047682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047682, "uuid": "6e5ec669-8414-4565-bdd9-123d0842f719", "comment": "Malware payload (XWorm)", "value": "75fee0eb83d4793d7e1c8c992068afd3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047682, "uuid": "093e314c-0c1c-4721-876f-59afbc0ab36e", "comment": "Malware payload (XWorm)", "value": "220e5c0ee3fec540448955bb9f2c5324c0a01d65323b48b00caed7a45d5df6ef", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047682, "uuid": "15ed9245-6f21-4403-af16-96f45a23226b", "comment": "Malware payload (XWorm)", "value": "891fec3e2a392c960973f5cb2052a47126b06963", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047682, "uuid": "24d18803-de11-4247-9a85-5ecee5d5a794", "comment": "Malware payload (XWorm)", "value": "40dbee8e36e2931b4049e35907f061743b551467c9d262835fd8a7a5ea539af5d818a4a9c262718cd0e691586274add1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047682, "uuid": "06cbbab4-1262-4ef8-8b12-83d72704b0b3", "value": "T14052D13B9C5CA170E3AFBB06DE6DED6A8274A1EB1A1F0183705C6D401BB72CDD74548A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047682, "uuid": "5347f431-4eb6-448d-8186-879a55274a96", "value": "192:Y4HDOOBLf5sI1BHugicFpp34b3p8LodzCGxS5wdHOBXQgL4stJSWV:7vJ5THt/A3p8LodzCGIQgS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761047682, "uuid": "69e49e35-83f3-4418-9b34-582eae5c0dbf", "value": 13564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761047682, "uuid": "7db55b7f-5711-4dfc-980e-05ea221604a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047682, "uuid": "9628bd40-4781-431d-a61d-9e0ce40a8d92", "value": "PAYMENT-INV-20251009-001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9a0302-aecf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761086506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086506, "uuid": "479d280f-0408-4bd3-b032-fa7e787d16bc", "comment": "Malware payload (Mirai)", "value": "81224d0f7d25d9392b5c853f41e50e72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086506, "uuid": "33b1ebd1-e4d8-48fd-9d21-76a8faaeb687", "comment": "Malware payload (Mirai)", "value": "2265494f860a54fd234afdc6321a6333207df546219fcdb27f881a140a628c63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086506, "uuid": "fba74dcc-0540-4a6e-a27e-2ce3dc630ddc", "comment": "Malware payload (Mirai)", "value": "bd7e4da986c719cd5bbdef55af4bb72b2c868204", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086506, "uuid": "9bda7aad-3de6-425b-8bc5-637310484a64", "comment": "Malware payload (Mirai)", "value": "cbf9f1103503a8ff72c006ea776fde0a9521b380bd30eb56375321d5cdd20b510885043ffd94c9c198c980c72a506e3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086506, "uuid": "1e90e46f-3755-47b0-8438-b958f9422ed8", "value": "T1B5144AC7F801DDBDF80BD73A4823490AB130B7A250535B377257796BED3A1A50927E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086506, "uuid": "de25f928-5381-4b0a-a13a-7c4bdea9486d", "value": "6144:qqKRh9IxIa3WhmvBjsNyutdPLqC2LUV0LwBcs:q/Cq2eOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761086506, "uuid": "df75fbc0-38af-4d1c-b9b8-16bc36bea495", "value": 198240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761086506, "uuid": "2d8d8ae4-8116-453a-9c34-3daa1983ed93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086506, "uuid": "8db6969a-bdd1-493f-9749-6a8dda89664e", "value": "Orbt.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee641928-ae32-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761019421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019421, "uuid": "7c566055-2696-4343-86ce-f4d4b6891db4", "comment": "Malware payload (Stealc)", "value": "7e6a137922a241d99a57deb2f58820a4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019421, "uuid": "8a2ab7dd-b339-43a2-9a36-682018b5e980", "comment": "Malware payload (Stealc)", "value": "2363d1846a0492442d1bddf715694775c1bf26ce698361d8240c7d202e088253", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019421, "uuid": "d6b8e72f-ea3b-4b71-9c11-abf5891849f3", "comment": "Malware payload (Stealc)", "value": "0827e420df0b9160e58be4c588f10e009a086dfe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019421, "uuid": "12ca2f6e-b50f-44b3-bb76-19a86ea8d628", "comment": "Malware payload (Stealc)", "value": "65b0a88043f300ef45b2e21b1619eaabbf4b17391ba6ccbdc6fd64603967bb272dfe55ace7dd741fb3a10ac009d954f2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019421, "uuid": "1d860416-bbbb-4b77-90ef-7433077b5ef7", "value": "T1F4B53347D98ACDF7CA5F8A7147A5CE4DB573160182D4B5907A228B27BA03F1E13BF098", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019421, "uuid": "8fe774d5-0646-4ccd-bf9f-d32b45e2282d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019421, "uuid": "e6626c7a-3d78-4492-bec8-cda3a48d598b", "value": "49152:L87M0w9ZTRre9SzXl4as0n02y7L9L6tB1IBOcfs39BYRBwS7Yb3P1QL:O2qYzGsn/y7VaMP039yj83P1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019421, "uuid": "eeb365eb-79e4-4a8f-9365-36f721eb0919", "value": 2443264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019421, "uuid": "ff5b0c2e-5960-41ba-90a6-64131bb05667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019421, "uuid": "74a92c21-dcaa-494a-b844-06da065ce162", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d200d260-ae8b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761057599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761057599, "uuid": "b18b40cd-babc-4a11-b738-e656f1ac0b97", "comment": "Malware payload", "value": "46503ceea1b9d1ece20480cd81a561ac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761057599, "uuid": "ec2d2df6-7c49-47ad-846a-ef2db23939d4", "comment": "Malware payload", "value": "23d716e2a277edc8d74fd974775ea53f0a73eb9a0adfc4fc0b6a72fb00c43f0f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761057599, "uuid": "41146d55-4dd0-48a2-a948-7ca3df0f11dc", "comment": "Malware payload", "value": "0c3c327e420732be722df1d8d4b63688a5928918", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761057599, "uuid": "0fdb7c4b-6166-460c-8b00-af5564dc2dc7", "comment": "Malware payload", "value": "1ebcd154d194e7ae75e8f885421a957e830b6c142becbf927ea907769b05a6b5ca3d9536ff2170a03f505323e5604d2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761057599, "uuid": "7096bf91-4d24-4bca-9e50-44c060fc0ddc", "value": "T1DEC3E0189D226D8C43E422BF38CF68C21B6D13972C2486EC780D45DC9FA697565F8AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761057599, "uuid": "a5569af7-3fcb-4ae7-b3a9-9c9cf3c87f89", "value": "1536:G5cBGSKBEfFB1QXT0IvgRawN+OX0NVNUsLWDHsbOKem7PmY9s1I1B6A3gUQ/hfLL:SN1wN+IeLWrsBh7+YtksSN6ZznY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761057599, "uuid": "46043c3f-f29e-4f8e-99f4-eacda31ce5bc", "value": 122670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761057599, "uuid": "b8e82b7d-fe80-429e-85b2-024a156b8d16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761057599, "uuid": "d6244cd5-6b27-40f1-9093-638d23967b6d", "value": "23d716e2a277edc8d74fd974775ea53f0a73eb9a0adfc4fc0b6a72fb00c43f0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a50da81-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761063787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063787, "uuid": "5e5ccffe-13f3-4b63-af1f-e837c8d27e12", "comment": "Malware payload (Rhadamanthys)", "value": "481f70073f742207ac0a78668e47a414", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063787, "uuid": "73cd21cd-d0b2-45a4-a24e-e53a4af8825a", "comment": "Malware payload (Rhadamanthys)", "value": "2427e91053241ab4a12ba4aa3cd3097db56260cdc7e3c8bfd9276e78c9255fdb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063787, "uuid": "e626778e-35ad-4757-9610-e2bcb0aab081", "comment": "Malware payload (Rhadamanthys)", "value": "077dec7656873ffa2a964b50ccbba39025ecacc9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063787, "uuid": "bcf2ba11-86e1-4df8-aab4-0704b68d2bbf", "comment": "Malware payload (Rhadamanthys)", "value": "3a21f2d61db87441b496f6458f5705a05584c20cebcfc8ffd6066f0da5f42b06ae79f90a42efde0eb107f72a59a39a36", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063787, "uuid": "8dc8895c-40cf-4f14-80f3-7918270f4c79", "value": "T173A3F8598CE86EF100BD71A72B4314F65B49B62F2502F14A8D26FAD850D9D9C8CECF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063787, "uuid": "672a21dd-607f-4c94-b437-e21bec74e4e0", "value": "768:GDhd0i7J4sYKgY/CMNfWdqIfwAlJPn+ZkVbxLHP+8wAHDG0+r+jTvscbPC7u4t8c:GDB7eKg20NMrnrw60jNA/4L6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063787, "uuid": "65b74dcf-94a4-42bd-8b34-0ee03c792496", "value": 98796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063787, "uuid": "46eb935d-e32d-4725-b1c8-69e545a9dc44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063787, "uuid": "52a7d7b6-2c5d-484b-a88e-9b5dfffed089", "value": "invoice-1637482117.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25043c24-ae68-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761042276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042276, "uuid": "303d422c-3dc6-4b8b-83ee-110005c2d4a7", "comment": "Malware payload (AgentTesla)", "value": "b7bfc5ffc70f0350a3698c3089422baf", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-haliza-com-my", "colour": "#77410C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042276, "uuid": "479822af-fc78-453d-8553-4e9435e3b773", "comment": "Malware payload (AgentTesla)", "value": "24b7d540567ac037bb83ea0bf485a26934cfef2118228eed5379c0f74a455f31", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-haliza-com-my", "colour": "#77410C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042276, "uuid": "f4a39ab2-cdff-4599-8fec-1c45dec270e6", "comment": "Malware payload (AgentTesla)", "value": "e606c87d57459e555c2b746c12d7c21ee3b4e6a3", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-haliza-com-my", "colour": "#77410C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042276, "uuid": "673afed4-f941-4d32-8389-d362d7579986", "comment": "Malware payload (AgentTesla)", "value": "0766181498776c520b0b98c077b54de4b38b793bc6bc6974bfbc1d2c537253b5962e868b0087bf339d6548a83b384ab0", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-haliza-com-my", "colour": "#77410C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042276, "uuid": "9b8f3cfa-3707-4d89-bb09-e5b1f3800fef", "value": "T1F365BFB875047DE6267F576BDA96ADDC03A617239ACBA4CC807477C305A3376FE02809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042276, "uuid": "bb518543-bb6f-4d86-aa5e-e600b41d405a", "value": "24576:5uMj1RkR3K3KkGzUy4YhHA9UH2EYzfBfvfL87+OdU+yG7vHliA+ekeGYHI0TfIMh:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042276, "uuid": "c907e01f-4b61-4456-865b-9c35e899b10b", "value": 1456436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042276, "uuid": "3c76257d-721c-4897-8e7a-c9ac7c721fe7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042276, "uuid": "eafc790d-6bbe-4831-a01f-d2e89648ffc1", "value": "stein.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e8d6ea-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063939, "uuid": "2b1745e0-928f-4f7c-a75a-012a4206c18a", "comment": "Malware payload", "value": "bb693094310135d05108300abb9605b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063939, "uuid": "35da0b8c-ee60-4f7b-8eab-f47469b6466f", "comment": "Malware payload", "value": "250d8b451eecad26d625c72b63810567313152ba3734731a0f2d69fbca163d59", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063939, "uuid": "c2d5a0e3-6500-4e0d-be14-34d420be2cec", "comment": "Malware payload", "value": "8c9ceebddb9f3f74bb091fb9e8764c9ba88a0af7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063939, "uuid": "3028bf87-5b0b-487f-960e-362724de7eae", "comment": "Malware payload", "value": "d3f823cee69657c38fefb6814cb498894739b6f9045b9294f35e2d8513bbfd41bea0439288a4585aca3500df25f7e00a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063939, "uuid": "555ce8dc-dc74-4375-9722-c4c92c267d30", "value": "T127A3D8083C3195BC68F02B7DCCE62BF965353102706768D8EE1FBF5659AA23B69021DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063939, "uuid": "57f3626d-5739-4612-9773-631141683b72", "value": "1536:GDB7eKg20baRrTr6YuXCqg9e9AG3gLUc6BkQWJ+aY:GDB7b0bahvzuSqg9eV3gLUc6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063939, "uuid": "64ca0e73-f40a-4d46-89e1-0fff8876802b", "value": 106719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063939, "uuid": "e9798fc8-293a-46b5-ba6e-8768951c9dea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063939, "uuid": "058112f5-756b-48f4-a1c6-fcfd0ff47b0a", "value": "invoice-1637482117.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d5c021-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761025497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025497, "uuid": "ecfa7530-9f72-4421-b8b2-ef45f3e0742f", "comment": "Malware payload (RemcosRAT)", "value": "1d9cdf89220f14226156e3ea04aa9576", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025497, "uuid": "71dacc5d-834e-44e6-a314-99f0a4158efb", "comment": "Malware payload (RemcosRAT)", "value": "2516cc29b6eebbe044641f7772e61549278d0d1e164c8a75f98b884fcce2ff40", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025497, "uuid": "80b1159b-42e0-40fa-a055-6ab3e5136522", "comment": "Malware payload (RemcosRAT)", "value": "f178007bbe68d6002f10dc13d4b34887a410c906", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025497, "uuid": "4a54e847-d102-4efd-951e-6f0d496df8ee", "comment": "Malware payload (RemcosRAT)", "value": "7e25b97726e94fc74685905263f832ec51d258c7eee68dc78b539f7d38781e1d4f189ab505bbe0ae583c415183b2f560", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025497, "uuid": "3d0e71d5-ca93-46ca-8fd3-21aaaf050a7f", "value": "T1C504A0A40B1E0D3985F9532BDF357221E759A42B22B04305B6EF58DC8FB74A881B85FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025497, "uuid": "080ca9a8-ac97-4ec1-b9ca-44cfafe90d10", "value": "384:mJgLikCLorsZoBK0JI9cndyfdC4xkyhcy:LQLZoBKIWuqcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025497, "uuid": "710b4559-a42d-4c22-8b46-83d81e956714", "value": 176918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025497, "uuid": "847bbba2-0a5e-4e84-a573-149ad4e3784f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025497, "uuid": "daee140f-1286-462e-bcef-47d8fa878865", "value": "kkdi99ew0cv03jdjfsdhj400df04sdxcv0we03220dcxvjs9f930sxcvj322jjsdf0sdf0sfxc0f032jdkfs.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dbe748-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761025548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025548, "uuid": "c502f32e-e6b4-4e9a-aa51-462221b47294", "comment": "Malware payload (Formbook)", "value": "09b3e189803f8f242e8d8df10be09b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025548, "uuid": "b2b614ee-b63e-470f-839c-3d18cc7eaa74", "comment": "Malware payload (Formbook)", "value": "267a4a22551a0bd05d5d35956cc530347fd3ea05d9a6d96ae1171c521cf585c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025548, "uuid": "4d0943ec-0598-4540-934c-b95823203cae", "comment": "Malware payload (Formbook)", "value": "8cb0a28c3c226b01da269f54216b2b8c08220850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025548, "uuid": "7f58f468-67eb-4f45-83ae-1757c772a7f5", "comment": "Malware payload (Formbook)", "value": "706594c24f76a5ee2e5846c6b21713a152b7982ad6a0f1a64fbfb66c115d8fc918b4e9d2aec50a8136199827263d5453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025548, "uuid": "c6d7743e-02b9-4111-8ca9-f74b57b8dcff", "value": "T1F545BF0273819062FFAB95334B5AF61157BC6E260123E61F13983DB9BE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025548, "uuid": "c120e4fa-69ed-4ed8-b27b-809ed839f1ca", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025548, "uuid": "c385c41e-62c7-4fbe-a6c4-8cd6568821d6", "value": "24576:R5EmXFtKaL4/oFe5T9yyXYfP1ijXda+34BY2ddI3u1OzGON:RPVt/LZeJbInQRammW3IOzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025548, "uuid": "d2582585-5a8b-4dfb-9ea1-60383205ec1e", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025548, "uuid": "9aa139c1-4060-4475-b79e-9ab5cc35e5ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025548, "uuid": "8ffaae15-a7bf-4578-89d3-fef30b721a77", "value": "RFQ 5767889546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cbb8ca-ae67-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761042170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042170, "uuid": "2b2e9143-b032-4c37-9852-ded00872b868", "comment": "Malware payload (AgentTesla)", "value": "c8a1ffdee2ef54aaf97a4f7e4c652013", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "simongoodluck--donthasn-xyz", "colour": "#7A259F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042170, "uuid": "7b98e9fa-a21f-46f8-bab7-6a103b543e13", "comment": "Malware payload (AgentTesla)", "value": "271a55694d923363a0b39a1a1ea37c7273410158b1e456bc5ea4f0d432c72756", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "simongoodluck--donthasn-xyz", "colour": "#7A259F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042170, "uuid": "1c843fac-34cd-45fe-84a8-baa3840c475f", "comment": "Malware payload (AgentTesla)", "value": "a3b6454c106920e4e7d21c126a16633882f1be2a", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "simongoodluck--donthasn-xyz", "colour": "#7A259F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042170, "uuid": "268b0211-5bc3-49f3-9c15-d0d484955f02", "comment": "Malware payload (AgentTesla)", "value": "779177257bf8590053f432112cecfe9ca5baf641e5edc839c38116278fa3a2bf974468892c87cb97d74d2746f23a8b64", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "simongoodluck--donthasn-xyz", "colour": "#7A259F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042170, "uuid": "ba4aed48-1206-4e4d-b10d-18bebea10bbb", "value": "T1C71523326F1BA87D9B9D423CA53FDD25AFC14FD6C08D45E93BDC60D64EE52A2502380A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042170, "uuid": "ee3c88b6-6a09-4b8a-b154-a9eaac49d103", "value": "24576:iCq+K4EKJd38lOTDb5pJujaNlQNrwTA2KJ1vCD/U02:XbLumUrwX0ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042170, "uuid": "7915aaed-a0c4-4091-8c5d-3dc97719d85f", "value": 953524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042170, "uuid": "d71ecfdf-5e6c-4deb-b807-e0033fb7d04d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042170, "uuid": "874d7926-9bcf-45a9-b606-316496a383d7", "value": "cashhhh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24608a5-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064042, "uuid": "3cc6d2c2-6fe1-4ce7-bbbd-74e040f79332", "comment": "Malware payload", "value": "96392584710dd980f84a7ab97b9af806", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064042, "uuid": "41a6e7dc-3818-4a28-9c1d-aa2244bff41e", "comment": "Malware payload", "value": "29e30f2403489f18707cbab5d042e60b4a6b172f39923ce2b5ec3069c1394082", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064042, "uuid": "d52f7f97-56dc-4dc2-9c19-5b35c8ca726b", "comment": "Malware payload", "value": "bfef5995aaa872a3deb16579d72b533039fae7be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064042, "uuid": "b366cb36-6d85-4200-9780-c4bccfdc4fa3", "comment": "Malware payload", "value": "242b27a8e443f69bf6628002108d7400899da76611dff60afa7dbe34f3c12ca1dc2090e5ec1db7f4f1ef6430a9ffd382", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064042, "uuid": "05d90d66-3693-4a3e-a04e-8a6868dc3377", "value": "T190A31B4D5F8A7CF02216696A56443B36CE62221D0E98E1F66CCEF7E31246D7034C6AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064042, "uuid": "e8144f05-3fa7-4a04-a37a-376690a4a889", "value": "1536:GDB7eKg205kKUrrrWQZ4FdnvKGABfu+4v6BkQWJ+aY:GDB7b05kKeXLZednvKvfu+4v6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064042, "uuid": "7009f3aa-ba1d-4fb7-b9c4-2332fa23b9d4", "value": 99471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064042, "uuid": "62a14fa5-061f-4e9e-9146-a1a7ed3c0be2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064042, "uuid": "4ee46ce2-2412-4cfe-951f-2e4a6f2aa1e2", "value": "invoice-1637482117.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf88f23e-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064037, "uuid": "7cac5cc5-e69e-4fe5-b0a4-6347c06741a6", "comment": "Malware payload", "value": "6bc383b491b41632cccc4bdaef62ad69", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064037, "uuid": "afc467fd-0d95-4cea-943a-60cf0f00e2a4", "comment": "Malware payload", "value": "2c363b979e25d5a19efac733e521352d24a1ecf437e74622f8742f00c923689c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064037, "uuid": "2190091b-af8c-4eff-a378-5fe4de8b269b", "comment": "Malware payload", "value": "a37a87debd8b281b980edeba21b43107623c9b92", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064037, "uuid": "bcff7b2c-e47c-4512-9765-d53355455c3d", "comment": "Malware payload", "value": "d73aea7e5edb6afe373191dbbf5887af8faa0789897e844c108d701b3db6d3b7b5edf736a190a2585b2c00843d08579e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064037, "uuid": "2eae3c4f-b9aa-4e58-8b90-7b63c514fbd1", "value": "T12AB32B054BD3F5F204A3712E5EA74E53ADBAABC58E405BDB95330703B499238E61E0E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064037, "uuid": "9794ac51-60be-43d8-ad7f-73b6d32c97fb", "value": "768:GDhd0i7J4sYKgY/CMNfWdg2rXy+rq09FHKzIIAY5yxFJ/JSLAuAAroQW+FF+Ec+p:GDB7eKg205rTrq0985AYoH/6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064037, "uuid": "90b19265-f3e5-4fbf-ade7-ce2886fafb3d", "value": 108682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064037, "uuid": "5467a1f0-98ed-418f-901a-f384bc30a0ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064037, "uuid": "21817f43-2c3f-4944-a53c-dd787e43837e", "value": "invoice-1637482117.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0427f222-ae36-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761020746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020746, "uuid": "812a8452-5041-46fa-a361-a95a26333736", "comment": "Malware payload (AsyncRAT)", "value": "e8bd1d4b441205ec2116e1acea654eca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020746, "uuid": "f0efdfdf-ac93-4575-aaee-93ae575aa2a2", "comment": "Malware payload (AsyncRAT)", "value": "2cd68c73f407a88d29c7599a427f747f4f686dd12c33be96589d49f2f879d080", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020746, "uuid": "1dd5f3a0-7212-4881-a8a1-a2014efe84a8", "comment": "Malware payload (AsyncRAT)", "value": "3f45a4787f77e43f9c609fbe0a34600242361dac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020746, "uuid": "0b9dcc56-dff1-4b36-a0d2-5d6724b479c2", "comment": "Malware payload (AsyncRAT)", "value": "3056278167c6bd4d9adba00e9d18239c96c4f44b4eeeea9c94b2d5b1f12b7b4db2e76a6ba943b1afd164f5931fe598e4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020746, "uuid": "f7dac21a-c553-486e-b2fe-39f0a3f1072f", "value": "T135B4F1686B5EED12C9D15BB008A0E3B26334CE4DD520D6038FEAADDBB469F56385D2C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020746, "uuid": "d8416d11-e7a0-4e20-b503-8bc97bd1ee4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020746, "uuid": "c9b4453d-f8bd-4932-9f85-6d3c918c61f2", "value": "12288:xBBf7+ny1Ouo0k1C++9RBiejeMtiaFgTn:xvf75DoNDqb9uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020746, "uuid": "f6b7a14e-39b9-4a68-a07a-e7d2869bf86f", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020746, "uuid": "45286d28-ff7d-4907-803f-95f32c4df096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020746, "uuid": "8a49c774-baf3-4945-b640-9cb7a02d8180", "value": "SKM_C300i2510201438065959565985959595959_65535656535.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2054e69-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063988, "uuid": "ea851b3d-bef3-4dd8-863c-cbfdf310cb21", "comment": "Malware payload", "value": "bd5e7427914510d4f8bab9ccf54cbbc9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063988, "uuid": "986a200d-aa0c-4e22-8671-ec4ca12b4d41", "comment": "Malware payload", "value": "2d2cb8f8c617b99a2d2d539eb4bdb94f3ffc07f814416e79acc47c024cf321d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063988, "uuid": "d8a4960b-7268-484d-a04d-75dc213f4e9e", "comment": "Malware payload", "value": "ee5fdc1c1fb02c819b25b8681fe9205db415b8dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063988, "uuid": "e30da368-0960-4f17-a8dd-722645000147", "comment": "Malware payload", "value": "29c5ce373ff943d2f22ec80d5e1fa0aee8eab676556e92fb94c3b45f180a7d6d6417c9debe7f1b44e8ac17245b139269", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063988, "uuid": "ee327b94-4b68-4c2f-8957-29326d02bed1", "value": "T109A3DA4F0ABCD42C8048654BBB1A27C5DE0FFAAB88516047F93BF661B54CE7909C5EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063988, "uuid": "f1cd2461-2294-420e-9a16-380b95a9a02a", "value": "1536:GDB7eKg20rmRr/r84UzYUk+5+zAspARWd6BkQWJ+aY:GDB7b0MThEkCWd6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063988, "uuid": "74c633c5-eb67-4799-88ef-828801d2897b", "value": 101341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063988, "uuid": "4f9628e7-558b-4da7-878a-361a5cffe981", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063988, "uuid": "d293c302-6807-4e8a-bc07-ff7c1b249543", "value": "invoice-1637482117.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ae85f0-ae9f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761066141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066141, "uuid": "586f696a-ac44-40ae-ac3a-f09cbe322526", "comment": "Malware payload", "value": "bfd32191130eb544c4612acb0df0b36d", "object_relation": "md5", "Tag": [ { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066141, "uuid": "d41d9653-d8dd-4532-8d9c-3122ef2b0f9e", "comment": "Malware payload", "value": "2db88271910e1f4c8a087d7c6ee40fafadff5fb2d9bc931edcd0e3ba0561abd6", "object_relation": "sha256", "Tag": [ { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066141, "uuid": "ff051b4d-2f7a-4785-b1e4-b486a147e66b", "comment": "Malware payload", "value": "b0207eb8cf035836f49e0d31dd7731dc7597c1c1", "object_relation": "sha1", "Tag": [ { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066141, "uuid": "14dc3602-8da1-4a29-a79e-e50eb422202d", "comment": "Malware payload", "value": "7193a24fc3eba889c1970932f93e69991d3ea847226b64bdd29521ab0284f16904c55834790d35da1d8dcfa5a07afed8", "object_relation": "sha3-384", "Tag": [ { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066141, "uuid": "0209b000-d508-4808-ac87-348c8c391e72", "value": "T1927601EC70B5B91AF5C4437BC6852CB2DB2CA580D7AA3DDBCE3041567D8310E5FAA861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066141, "uuid": "e4d29043-7d24-4ce8-af94-52fd9ecf4230", "value": "196608:h/QoYqHor7QFRSoyL+DwRYpQuNPTxkMzwy9n2SaQXDwlisHNmof3wr:hInuRo+AYVNP1kdu2SvT27HnfAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761066141, "uuid": "a649a061-fafc-4782-964c-a83de7215a0a", "value": 7527718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761066141, "uuid": "9f55bec8-e301-4cf1-853b-1d1134b34cc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066141, "uuid": "00c48d9e-b05d-4f3b-8951-7ec02a6ac150", "value": "vwphaoxlpzls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9838b902-ae4d-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761030873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030873, "uuid": "53a2b539-6967-45d6-913f-ef0cf5c0d489", "comment": "Malware payload (AsyncRAT)", "value": "47532bbec07430ef891b2d75a854ee44", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030873, "uuid": "4de9d50a-f6e9-4ea1-a046-1279ac908c4b", "comment": "Malware payload (AsyncRAT)", "value": "2ec7690cd13cb1f0103e50c0b542426f3db0b94ed8b3a1c7c64059b3f59dadf0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030873, "uuid": "c4a70a30-9443-4cdb-9dc0-d2ac651f096e", "comment": "Malware payload (AsyncRAT)", "value": "27b2b0d1f73ca9d029344e00ba9176ff54745e76", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030873, "uuid": "b092598e-5d4c-4c6e-b830-842f7d0341f8", "comment": "Malware payload (AsyncRAT)", "value": "248a1445704cdccd9259b30f3e8d14d538f6a8f3f6e4ca692ffc81d228d89549776e4f1b60ca61e811052f7fc57b545d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030873, "uuid": "56f5fbb9-efac-435e-bbb4-5694e8e4681d", "value": "T15BA423E9EA0841B54271F97027A19096F9E4D070235BD5DB61332BE40EBE6D8887B7FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030873, "uuid": "699f215d-343c-44b6-893f-8318338f58c2", "value": "12288:U6Zuhi6Xa5kZK3G4D0HwWKlG/yDof7ZvLO8K2iA7W1xw:U62i6aqZKN0Q9pDMlJK2iBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761030873, "uuid": "1315ae4f-2adc-48a9-a767-db181b4213a3", "value": 474268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761030873, "uuid": "9943532b-6273-40b7-924f-ae9d06f07970", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030873, "uuid": "acf72404-8bac-4edd-acff-d026346e4fcc", "value": "FACTURA 16102025.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06a8e33-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761025760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025760, "uuid": "a1260542-fe2a-44e1-a4de-c6dcf4f34da3", "comment": "Malware payload (AgentTesla)", "value": "e15b940ed5b909ee26fee16a3cfe8a57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025760, "uuid": "d635cbc3-8c8f-4d27-8737-0eefc0d312a2", "comment": "Malware payload (AgentTesla)", "value": "2ee3c5c332ea6089c6ed8b45857181afb4e1e3b63b89ffd1bdc897ea48bccb3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025760, "uuid": "1f6ef1e7-6cf9-4b4b-b601-4b3aa0436584", "comment": "Malware payload (AgentTesla)", "value": "f347205fa3246c92e69965966d171ae68f42a3e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025760, "uuid": "3584aafb-9479-4f36-9832-3f6103b97bc9", "comment": "Malware payload (AgentTesla)", "value": "09a6d3ded9c1f69d8bfccc234cbbf2d2627cf991e2c6d86c75bcbc8e157ab20f2e4e35cc2e13397877a1c9d3644eec23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025760, "uuid": "67dc4fb1-49a8-44bf-ba54-2d28d5832719", "value": "T1EB652324E9080729973A82F0BC391F156FB65DD600CABB13369B7C9D52DEB7618930AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025760, "uuid": "8d5dcdc3-0f00-488d-bc9f-662c93c58521", "value": "24576:KvUy4z8ntQK/2tqNhA1MVcrvGfYchfXOn2jIXG/c2G5yf+wcspEFX33kAnYZNos:y4slNVSjnwcD8EyAYos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025760, "uuid": "4c0d3581-ab4e-4bd4-9049-d6a09ac2b837", "value": 1458356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025760, "uuid": "ad8ae606-07d9-4e0f-b0aa-324ef7ca99a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025760, "uuid": "c3de8228-fb97-4e3f-a9da-88a04e2f10a2", "value": "slyxx.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be581ad4-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761024924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024924, "uuid": "9ed1a305-a3f2-4240-ab0d-b950170fbab5", "comment": "Malware payload (XWorm)", "value": "c756302e4a4f2ee6b081081174e136ec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024924, "uuid": "37509a92-2df7-4994-9e79-dd63fe632964", "comment": "Malware payload (XWorm)", "value": "2efb0aeebf948bed71e29c24cf0c5c629a492a81aea1b9dec1a8534d77e733e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024924, "uuid": "67f5d0cb-8435-4154-969e-e787118779d4", "comment": "Malware payload (XWorm)", "value": "e8c9ec3f4dc08341a4dc2d05272029f3ce65e804", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024924, "uuid": "139eed4d-1df2-4923-b945-d21fa1a0852d", "comment": "Malware payload (XWorm)", "value": "df24bd2895f15819d2c66720eac2eced99e050830ef367f9aa85f9831775a56e9a5cf88bbc569a34638ecd97c9986348", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024924, "uuid": "3548c775-16c0-4424-8629-a39daa9abe93", "value": "T114067105FAF29D89F7A1DE994A07BFC5D5141BE725080CA274BCACDC2FBA1B0619017E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024924, "uuid": "5c1f59f5-f833-4cef-9459-2ac33d13d67a", "value": "24576:RrgHCaLALbnrgHCaLALbC0YnRzYkh4/f3jtC5fCvsAPZIrgHCaLALbrrgHCaLAL1:T1/YzdhGtSxAPGh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024924, "uuid": "c137562a-974b-47a2-bc83-69b3772f571f", "value": 3717773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024924, "uuid": "995bc570-787a-4caa-b392-e11dd6028aa5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024924, "uuid": "1c9f97b2-ad67-4ac2-b158-b03437614e4d", "value": "HM-DP-2510297A.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380c71a8-aec5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761082252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082252, "uuid": "6828a46d-5fcc-48ef-a0b9-66cfde46e1f2", "comment": "Malware payload (Formbook)", "value": "fe8eb14dcb286d083a32252e3c1b7625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082252, "uuid": "654d3a18-b193-4292-a276-62ba35afc29f", "comment": "Malware payload (Formbook)", "value": "2fbff2faed784287ac85fac279c2c0348277552b46b0ffd1ca91d9a61ce8c91e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082252, "uuid": "7f5efbc4-58b1-4d0d-b68c-a5390a22f08c", "comment": "Malware payload (Formbook)", "value": "09b662afdf5dd64b59ccbbffd3f4779ec31607cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082252, "uuid": "ae641f61-efa7-4aa5-8bef-f804ef4133cb", "comment": "Malware payload (Formbook)", "value": "bdac4cd3d8fa903824ea3fac70be79edb60987269c24324d42172897eeeeba824da707e9caf39ce8173857156c026863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082252, "uuid": "197ce096-2545-4e82-8390-68c85c0a0b8f", "value": "T14E75CF11BE928D3AF02E3539D827DBD6591DBEE02A14B80E3AFD39587F385D32516093", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082252, "uuid": "626f4374-1b37-44d2-a0fb-3161192d0189", "value": "37cefd31e003cee7c8f3f0b24332ee91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082252, "uuid": "b18bc237-ce15-465d-a561-6bd98db1dc56", "value": "24576:8c3ku3efFKfwG32uJQsDAtg0H89/27bAExp:/BvysqfHDbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761082252, "uuid": "8bdbac84-a919-4153-b10f-1d19a7bba436", "value": 1679872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761082252, "uuid": "9889cd10-e8de-45b0-9a35-5596f6329efb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082252, "uuid": "e2d00762-6e5a-49e1-af77-2beedad10820", "value": "SecuriteInfo.com.W32.ModiLoader.AC.gen.Eldorado.3353.14431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc808eb0-ae67-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761042155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042155, "uuid": "b99c9a82-d1b0-4787-806c-fd50bee513e2", "comment": "Malware payload (AgentTesla)", "value": "8ac5b234533b823de3a6380236032650", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Telegram-bot7579245280", "colour": "#10BEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042155, "uuid": "e843a338-4e7c-4db5-b42b-54f116487500", "comment": "Malware payload (AgentTesla)", "value": "3062315c6e099f9e702202e0e126244dc8fe8bc019867646536914a72eb27fbc", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Telegram-bot7579245280", "colour": "#10BEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042155, "uuid": "8a1e41ad-89d3-4011-bd3d-eab88edd3ed5", "comment": "Malware payload (AgentTesla)", "value": "108a5c698fb0805abb8fa01b7cd7a731f21b17ab", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Telegram-bot7579245280", "colour": "#10BEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042155, "uuid": "54df0390-e3c1-4a4f-a034-3150ededd9cb", "comment": "Malware payload (AgentTesla)", "value": "3646950bff0f6e4a6cfeded829d589ab0bacddec88ef265abfd05dc5c1ff096dfc0182573aadb68cb62e4bd1c92b5e13", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Telegram-bot7579245280", "colour": "#10BEAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042155, "uuid": "63af2d43-78cb-49e4-b5f1-d1655db06149", "value": "T1A765BFF876047DE6266F576BDE96ADEC03B617239A8BA4CC8064B7C30563375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042155, "uuid": "c092b4e0-198a-4051-b570-ab2d3743c51c", "value": "24576:Hdj1oZ91FdifDsKyasZebrrA5xIgseXNAKuxv1djTCCTQ29xWUV5Zv0CfJdM86SF:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042155, "uuid": "2e37c65a-a3db-4d5e-8ed1-e2dab3fe0d4b", "value": 1429698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042155, "uuid": "2af97de2-8f84-442d-b0a8-d6f0d304fca8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042155, "uuid": "26b59828-ab00-4d3c-ae3a-29c9fc3f9a98", "value": "cash.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fefae7-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063830, "uuid": "4420e29e-1a6c-444c-bd6f-0dd2dfd292ef", "comment": "Malware payload", "value": "e5df8b7603727a7e9c2c4011ccda0ed8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063830, "uuid": "3323692a-499a-4244-8dfd-a802702b5751", "comment": "Malware payload", "value": "30d12a9dc4043b67672517afb7cca81e9bf9ffc9aa28af0b3a381cf18ea1bb06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063830, "uuid": "5a57050d-16ef-47e5-8e8b-63c1ce214a57", "comment": "Malware payload", "value": "3862a5385d0a4958c07a593dc7513d12194e150d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063830, "uuid": "377d0468-b816-4caf-b09b-1419604b014c", "comment": "Malware payload", "value": "1377a8af3624266f2d5fdb212c00fcb248b23f916889c7c84fc44a8d94c7561669d19e4f4da246f9cf21befa256ffb7f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063830, "uuid": "278f8818-b2d1-4350-a7b3-e304051ea06c", "value": "T197A3EB70EB223D9F58FBADB2D75E13EECE4526562C762186623E78139C45E000E53AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063830, "uuid": "9ed1cd9a-3acd-42a4-a9f3-09cb5e7cb05f", "value": "768:GDhd0i7J4sYKgY/CMNfWdeV2rXO1raXcoHuxACmJB6qjsSLAuAAroQW+FF+Ec+0G:GDB7eKg20jrgraXcPxACgIN6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063830, "uuid": "3d338605-fdb3-4d0d-ac65-bf12ed2fea2b", "value": 104733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063830, "uuid": "342340d7-177a-439f-a084-3312fec68834", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063830, "uuid": "83e8f5f5-316f-40c7-b386-6a75cac8bb48", "value": "invoice-1637482117.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af294c07-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063983, "uuid": "f531e3f0-fbb0-405a-8603-95853b6e98dd", "comment": "Malware payload", "value": "214a98a60fb19ebeb021faa82ce2040f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063983, "uuid": "8240133f-2cad-40cf-b8e1-d083c88a3769", "comment": "Malware payload", "value": "30dda50b918969faf6da39fdcbbd167920be8f142d21a4e59d003c77ed24d131", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063983, "uuid": "b3de6b28-44fd-4c31-bd5d-99f80c608ed1", "comment": "Malware payload", "value": "3947e3208eef2203a8dee3e3f56c168005f9ccbb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063983, "uuid": "eb8a0880-5a4c-4966-b402-52fa73f16420", "comment": "Malware payload", "value": "da659844a2d919e7deb527565a8b23209f11c474b564e3503389061a3ccd4fc26cb22bf0d0416f44c55931ce79d8a232", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063983, "uuid": "db550a09-065e-4d8c-9c39-4ddda0d98348", "value": "T1C2A3E8599FC3B9B10D609888AF9280BDD0CB48CAFA7D55B8204B76F1902E7F11D9D9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063983, "uuid": "fbbee4d6-d34c-4c1f-91a3-31db77c11dbb", "value": "768:GDhd0i7J4sYKgY/CMNfWdbCeb02LrXf5rh4t8QMH5+ThhAVynj12fKSLAuAAroQD:GDB7eKg20hrxrh4WNgAIwC6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063983, "uuid": "1c1ff152-8051-4847-bb7a-cac112dfbe20", "value": 104686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063983, "uuid": "b9775f23-7337-49ed-af42-1422695b6666", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063983, "uuid": "7ceb3c0a-5636-4ba5-9b65-80de270f6c01", "value": "invoice-1637482117.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8482ad0f-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063911, "uuid": "bfdd0d67-6868-4571-8dcd-3048fcd31bd9", "comment": "Malware payload", "value": "2f9b5ea0880f122506d19008611e8a34", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063911, "uuid": "d95cd2da-6496-42d4-bdfd-a4fc98d85494", "comment": "Malware payload", "value": "30f997cdbc109aaf11d468a0fc26c2da2d710c1b57fc2aa9b5f62d4a4b6dbe67", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063911, "uuid": "f339c061-2294-4c4b-90e6-deaccd05a18a", "comment": "Malware payload", "value": "3983403ee16a9a12a60a4777906fa712b894b5d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063911, "uuid": "64193e1b-dec3-43e2-8524-41d91f582e4e", "comment": "Malware payload", "value": "96a7015738f9505a02e9e4a43e13a88f462bb69934f0e73743df6ec6a5a05895fb24b2ff0426e0dfd6195ee434569651", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063911, "uuid": "533edb66-bdb2-4b81-b2a6-37408995bc36", "value": "T190A3190EA7E7E88C2645AA4B5C9526B14576184653003D0BD2BFBF725AE4F3A3CD0DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063911, "uuid": "af5a6810-4551-4afa-9d4f-ba6802d35a2b", "value": "768:GDhd0i7J4sYKgY/CMNfWdZ9TpN6rXc4rCA+MHQBAFn8HSLAuAAroQW+FF+Ec+0FY:GDB7eKg20arNrCA+jBAF8H6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063911, "uuid": "43b92a20-efbc-43db-b72f-e29136200c88", "value": 104020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063911, "uuid": "c1c71245-2e97-4555-9d54-285b79550a1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063911, "uuid": "e1e66f04-1626-49a6-9293-be53f9d40a05", "value": "invoice-1637482117.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684c5096-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761026068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026068, "uuid": "56026f2f-9483-4a56-821d-e061d4649668", "comment": "Malware payload (Mirai)", "value": "1375947b82962ad93c1b11a6d782e129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026068, "uuid": "cc2ac410-5f6b-4042-908c-ee205a7d7672", "comment": "Malware payload (Mirai)", "value": "318d8bf718eb3c6b69fa609da79e428ef34c3f08e89fc8dcfe7784437322c787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026068, "uuid": "7fafd8fd-584e-4a80-8f89-f2e7b5cf3d06", "comment": "Malware payload (Mirai)", "value": "50aa3e52a908e38a26261b60de6d5e39c1a98a7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026068, "uuid": "f9972de5-d9de-413f-973e-a2ca766f0c5f", "comment": "Malware payload (Mirai)", "value": "c910b2d1b9561eaa53037fe7d41ed07b5c0c1d9ca7c94d556897fb0732eb3f2054c83598da3d662167fc29a1cc571e18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026068, "uuid": "ea6c733f-228a-46ce-83bd-ed0422dade3d", "value": "T14C6301C59347A625C97C043EE6B28526D75F3FA5CCF820AE113497F86DB354A2420D0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026068, "uuid": "636f6952-e7b8-4edb-8c19-3351c3b1679e", "value": "1536:Y4hkRGmIAL4ANExmzjvTT3uaVRA384QaTAn+5L6g6XjIGG4o80Tz5:Y4h4hIAXfvTTeaks4QaUn+5L6g6XLG4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026068, "uuid": "6c969a21-2f0c-4a99-b60e-48118a54ea56", "value": 69716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026068, "uuid": "edddc545-a18d-470a-a913-9a094d7ffecb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026068, "uuid": "daf58cd2-43ca-4c72-81c6-4503e17060f8", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51246894-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063825, "uuid": "b43e2efe-6b7d-4b02-9e33-a43c1d972a68", "comment": "Malware payload", "value": "5af5d94765e21aab97c5393c16ddd225", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063825, "uuid": "b92d8ade-7600-4ebe-b063-901f44d2cd83", "comment": "Malware payload", "value": "32b1aff6004474c6e7151beb5ea6bbc6f95ffdd12669126b7f1d9dabfdb463e5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063825, "uuid": "fff71551-57b0-456d-9973-5ae73204995f", "comment": "Malware payload", "value": "579ad249ac20fa19bec5c595e91cff38a8aa02ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063825, "uuid": "6000f398-8e6b-4a7a-a138-cb63bc98da2f", "comment": "Malware payload", "value": "18809399538b1693a5a7e4bf947043553131a7f6c4d8a2f7cb1d7668d70f5ca0395af8e2b64804c88774a57b9ee096ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063825, "uuid": "02b7dfcd-d6da-4ac1-9e4b-86c495c63782", "value": "T16BB3D94A9B6717F50BF031253EDE2DEB664F6026815D59CD40ABF32A8CE4D406CA8BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063825, "uuid": "7372867e-5a8e-4a74-ac17-f9e9f9d81cd5", "value": "768:GDhd0i7J4sYKgY/CMNfWdq4kiAsbruR1ryOAbZ4kB7+0bKlbvbl9ELUJJAu2tn8V:GDB7eKg209rprAgetdAZKq6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063825, "uuid": "224f7b43-cb37-43e4-b6d1-0cdcfe7b0f99", "value": 107931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063825, "uuid": "edf07fe0-dbf1-44ba-861c-0b477bf5cef2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063825, "uuid": "a9a9b378-cbae-4a24-82fb-c963a030a2e3", "value": "invoice-1637482117.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7570d8af-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761063886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063886, "uuid": "d2c5b044-c59b-4f81-aa7c-88c7027345c2", "comment": "Malware payload (Mirai)", "value": "e21ea7e32f8e58e45d1b06bc3154b6b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063886, "uuid": "4175fc4c-e600-496a-aeab-57a6eebd4b53", "comment": "Malware payload (Mirai)", "value": "32d20ef0412bfd24101922a86f4f400eed477f0a5c11d54b4d9c48286d894c19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063886, "uuid": "94fc57b0-ff09-4726-8053-def5f0333312", "comment": "Malware payload (Mirai)", "value": "7ecdf1e7bccb1b0cd273412d1cbd5f2da488672a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063886, "uuid": "924d029c-85d8-44e3-8d53-37ef6a084f8a", "comment": "Malware payload (Mirai)", "value": "aa343b329990a739f195137b06cb1cdc299436cb2a60d13c422f7d6c7aaf7e01725097191ba489e078616a44f6df1e9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063886, "uuid": "fd755245-889c-463f-954a-c21d8d140627", "value": "T1FBD3F796BC41AB21C6D156BBFE5F418E33131BA8E3DE32039D181F6477CB94A0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063886, "uuid": "3eb8c340-e9c5-44e7-bc68-e5c2d0f06a4f", "value": "3072:FjLcu+tL3AtPjBxJFiVO2qXdex3mYa+I+zU4q371AVnM:FjLcuWktPjTJF8O3Xdena+RzU11t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063886, "uuid": "7bbad0bd-c193-4fc7-ba18-c5ad6f26ed9e", "value": 131828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063886, "uuid": "79ecd114-b1ce-43d0-8d7d-43d6a022c997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063886, "uuid": "89d82a4a-e8e6-4118-9034-651d60bcad0b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7c4222-ae31-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761018745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018745, "uuid": "2dd61da9-1b0b-4937-982f-a87a84fd30ea", "comment": "Malware payload (Mirai)", "value": "44d89420dd6289385e6e39b17bcf8b9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018745, "uuid": "24e96264-8502-4a5d-96a6-88f8ef4b6b6f", "comment": "Malware payload (Mirai)", "value": "332b0e4952931f17911218e567821cb8cb7e412bef0728056d830e36c4ead9ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018745, "uuid": "bbce2713-ddf0-42e5-8627-6d2f0fa705da", "comment": "Malware payload (Mirai)", "value": "912ea3f1451f364a2b44f0591261b8e51d348216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018745, "uuid": "2e2dc0c6-f8c0-42f3-919d-fb32e6919017", "comment": "Malware payload (Mirai)", "value": "78e673a1029e9e65096082e8fead0268db787dc88039dce0101f86d5d47bd8cf467f9b776769da10cb329416fe073c43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761018745, "uuid": "83545ec2-b1be-4d32-9049-28efffa50c3d", "value": "T15F23F134D3958CE1C5E518216CB08E628A5A3FF9E9FCB692AE6243445CB304E9FF50D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761018745, "uuid": "94ee0c67-49ce-45ca-bf0a-93571eef422c", "value": "768:XFxMhjpNsaz9dGgLVHE5stzWYkfBJZ1ZErx30tj6pGmCJfmP9q3UELxN:1x23dG0kahsfFwrJ0tj68mCJfm+LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761018745, "uuid": "f2edf132-b581-459f-8d15-36e3e4ca100e", "value": 49284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761018745, "uuid": "d193745e-1ebe-4a10-9e8f-1550a17c1171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761018745, "uuid": "8965374b-5273-45f0-bc0c-846b6be809f3", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a2717b-ae47-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761028055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028055, "uuid": "effb94f0-fe2b-4543-b608-a89f4dcbb079", "comment": "Malware payload", "value": "3bf05a29c5c0964dbe5ea47d396625c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028055, "uuid": "a34cc4d8-f42d-42a0-8ae5-0d91675c871b", "comment": "Malware payload", "value": "3337cf39c20d74dea6a46ca3381544d6d84e5e9855915e34cebc127c780c9933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028055, "uuid": "db894f6f-5946-4475-baf3-d34d1178ed79", "comment": "Malware payload", "value": "b8ca52172d39673a37f1ebfb20afab7468077b8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028055, "uuid": "b3bfde10-b2e9-42be-bddd-e66a713db5cc", "comment": "Malware payload", "value": "8ea9728f82e3e38c9b69e9dce44f9440ac4ad52bf119ce7c0de7fed60531ffb2b5a586671b1fecf86e4ee88f9cfd96c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028055, "uuid": "a2c3d315-719f-4501-949f-cac93ff1af61", "value": "T14BF6AE18A3E504B5D86BD734CA25C333CA71BD625A35D50F0999F2861F73A628F2FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028055, "uuid": "3b3b532e-2641-4d31-9860-1047c4b235d2", "value": "3c0e4aa7be777997c606166a73f99a06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028055, "uuid": "9f31664d-9a5f-482f-8d90-4a6d3f7871ca", "value": "196608:uLDrm50dODsyhV3A5M2DfJbrIzssgce1g0Y:uLDrdkD3T3SM2NrKsscy0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761028055, "uuid": "1e888bbd-31e5-4739-bc92-43f161f4f38b", "value": 15298048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761028055, "uuid": "4310490c-fae8-4d5c-a012-44b8382d0ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028055, "uuid": "7ecd9254-e650-4f1c-9efd-1ff70d3cf094", "value": "atom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e73769-ae99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761063533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063533, "uuid": "f2dd9c19-8bba-480b-bb1a-ee2cb974662b", "comment": "Malware payload (Mirai)", "value": "5d970cec3ff091bbfe8492eb6c580243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063533, "uuid": "563f6719-0769-4b1c-856e-200af3c26b25", "comment": "Malware payload (Mirai)", "value": "352f52af13e6d0b157e68d5ec886d974559e025ab8765a2314c89b1ee830f34e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063533, "uuid": "4742534c-c15b-4b45-8d45-4165f01c4b8e", "comment": "Malware payload (Mirai)", "value": "981a703c62af352ed4e6a2f28fdedeefbbecb18c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063533, "uuid": "3c4a4189-c921-46a7-9cf7-2aa4f792da89", "comment": "Malware payload (Mirai)", "value": "181b64a560dcd5e203a8e544f25b9bed078415d36daf082ddd1923aa40f8e8a29c4e3ea9e4333ec48e6ad5358965a69a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063533, "uuid": "ea4a905f-5113-4a79-96d0-14781f7c8d65", "value": "T12BB35A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063533, "uuid": "75758bd8-99f8-462f-b400-ff5aca060ba1", "value": "1536:1a97/6/q0AmnClxL9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/zB:1y6HClxZn+MCISxPKO8WL7t4LbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063533, "uuid": "4ddcb1bf-16e9-4935-bf3f-face1fd1148d", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063533, "uuid": "a1ba691e-f44e-4eb8-a665-cf3352078d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063533, "uuid": "262c38d8-3f43-4dd0-ae65-f428b88cc55e", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9beab4bf-ae35-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761020572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020572, "uuid": "f594cb36-fa40-459c-af85-c587969fe500", "comment": "Malware payload (Mirai)", "value": "c45bba673386d67139953a796072516a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020572, "uuid": "257ffd03-95b8-4f70-b50c-b4ab6cc80402", "comment": "Malware payload (Mirai)", "value": "359e6383dde8d573a777aa18ea17b1f5329b1464012f4ec09389015f04aa800f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020572, "uuid": "7c1d9b32-9b83-41db-a8d8-3f19c795e6ad", "comment": "Malware payload (Mirai)", "value": "1f5da076cc8663107b3182a34a22fa130e22796b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020572, "uuid": "008119e4-9f9b-4d23-b451-3e653a6c31b0", "comment": "Malware payload (Mirai)", "value": "9b7b8e87bc65f9800d01b52d4c889dfc5aed3a042d41c555115fff425f033656b995d09b48f238aee62a68dbd762e22e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020572, "uuid": "d600c8bc-2341-4e7a-afd7-253d0df6c6c2", "value": "T1D7430118C0520709D42E52F510BBE5891E84A94BCB81A6E26FE47ABD3CDCE4D6B347D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020572, "uuid": "3cc0e975-53f0-4460-9ac3-2797e4591c66", "value": "1536:zohP1WgyMV60wcNO3LEc3ZWDibDPgIrHnouy8HyI:zohPjyMVk+O3LoDiPg0outX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020572, "uuid": "bcd73545-7961-4993-a25d-85a4321e9be7", "value": 60496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020572, "uuid": "83652c1c-b661-4934-9f92-512cd17b9dbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020572, "uuid": "34f69222-576f-4894-8086-42850d0c0e1c", "value": "Orbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f8d611-ae72-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761046518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046518, "uuid": "60a48b80-0756-4cd3-8122-20a1569521a3", "comment": "Malware payload", "value": "d68c07bcca37e74b5d23c7ccdb8dfe56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046518, "uuid": "43f7b371-67db-4301-8aec-d98ad53dd2eb", "comment": "Malware payload", "value": "362004e32c165ef58dcb34c22872ac6286622678b2f287acd62f89d92da98336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046518, "uuid": "41929aa2-c7a9-4fab-b564-baaf32b5517e", "comment": "Malware payload", "value": "461d5e97152a1f9dccd056527f7d06787894fac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046518, "uuid": "0770b7c9-db50-485a-8629-93515175ad41", "comment": "Malware payload", "value": "273307ddf9ff6238083449783a8329ba205adabc147e7a3416925b0bc9263288062a558a4391fd25babd9d333e036b93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046518, "uuid": "704999ef-43a7-4992-aeab-0ae2c5d3b8d3", "value": "T17A42090967E88233EF7F0B7B9C7396414372F7069815EB2D7CDD288A1D62748096376A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046518, "uuid": "26621c76-0c5b-4248-ae83-1af93426c585", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046518, "uuid": "1cc7db40-65b0-4a6b-9e9a-1ebb41401361", "value": "192:EQqoLBKJnj0+UPbd84AKQs+SVSgzVpv9VugE/VN7Gymi3fBv:EQq8KJgZAKr+Py/v9q//7iofB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761046518, "uuid": "583d3fe3-17e9-40cc-8fa3-ca94d57a3b0e", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761046518, "uuid": "f9d59961-e3a4-4490-8911-90d41edaeda1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046518, "uuid": "6727fc97-aa72-431d-a846-4fa70477225a", "value": "scsv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc137127-ae51-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761032651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032651, "uuid": "3bf2cec0-7be5-4ae7-8387-8dc5426950cd", "comment": "Malware payload (Mirai)", "value": "c3f26666da115272a4d342b5c0082bda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032651, "uuid": "4e879156-f749-410a-98bc-21c07b89ba8d", "comment": "Malware payload (Mirai)", "value": "3628aaf6191d83d3ea07b875b184ab0491370fc5bfb267331bbc553534eba904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032651, "uuid": "19deb657-42a9-4112-9d18-404e9a78b5a8", "comment": "Malware payload (Mirai)", "value": "258a4bf9b7037185a0fd056e07bb9841f0dd020f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032651, "uuid": "2077ead8-55cb-441e-962f-0303592ca3c4", "comment": "Malware payload (Mirai)", "value": "2e06fa943aa7df01c6936490ceacb039ee699a8392b4deafcd26c1306d82f7d6aac07e197a938531a6f2d6407c9d7fe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032651, "uuid": "a57a24cb-28b6-41e8-b601-8c46a587ecc2", "value": "T108E329DBF800DDFAF80AE33748530906B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032651, "uuid": "fa09b46f-b7cd-49ea-977b-1a5a74e3e614", "value": "3072:jRsZqGhrvKbbWOftDA4EslibVrjbiJLnN+eAyaih7a:tsinfhAUliwLnNMyao7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761032651, "uuid": "697cc7fd-d1e6-4480-a24d-00ecef69256e", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761032651, "uuid": "ef509383-2861-4b7e-9fcb-c530dc003adb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032651, "uuid": "f14accdd-d486-42e0-9b85-17b677d06f3d", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65331c43-aea2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761067295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067295, "uuid": "88d5309c-6df5-4471-9158-5a71220c1308", "comment": "Malware payload (Mirai)", "value": "3330bd21c294dc624ff761540fc189fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067295, "uuid": "fe705a8a-9e2a-4fee-9652-da3ff543374b", "comment": "Malware payload (Mirai)", "value": "37a5883dfb748ea870355016c373df4c7ee30d9199a6658dc703979e8a6779b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067295, "uuid": "9677ac4f-40ac-4e02-a2f4-3064264c808a", "comment": "Malware payload (Mirai)", "value": "39217bec47203abc056b03fb0e1d7f5abb304be3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067295, "uuid": "63aae6c7-b105-4caa-96d0-974f830c6ae1", "comment": "Malware payload (Mirai)", "value": "41d5a4debc8a0a70e727a82d814963b7dafa357bf6e121e52bf2d232200693ed61f0fa369dfd5d4795bd0cb28827415e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067295, "uuid": "0f75eb82-b68e-449d-af3e-d240960112fd", "value": "T174C39DA43B0F7D92E2C7E37CCE484E72702B75B4C66192B4BD22432DC5D6DAA8EE0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067295, "uuid": "e152f61f-33ce-48fd-9884-83aada51293f", "value": "3072:EKz5RKCwmqoJi9g3pYEbEbFOLZPBXMWe12:EK1RKCwmqG6g3TwbaZtReA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761067295, "uuid": "c36ae176-9797-473a-aa53-47af71def5e2", "value": 120664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761067295, "uuid": "79243cd5-111a-49e0-ba58-8ed0ec79f3d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067295, "uuid": "f6356b7e-3ac8-4cfb-bd3e-2feb6a453642", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de065ee-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1761025675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025675, "uuid": "fe1e44f6-37a4-4760-b7cf-c22b28c78d51", "comment": "Malware payload (Vidar)", "value": "ea8be3da8c9e42bab87e93c4697f79e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025675, "uuid": "de40db87-38c3-498c-b43a-43185405047d", "comment": "Malware payload (Vidar)", "value": "3804440846b6af667a220725e399efdeae07148396d9ccad5b5ada03e29e3a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025675, "uuid": "f3d99db6-9fbb-40be-9ce4-4939bc9a8048", "comment": "Malware payload (Vidar)", "value": "fa499eb3a83caa871924ad14e08f4d15f7df5f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025675, "uuid": "0ba62009-b034-4158-a736-e9a1db3e3969", "comment": "Malware payload (Vidar)", "value": "803a2e39348accdba91fb789e6e1b7b2b7b107180a91f6672a0756ea9845c59d83116d966df3b21d5ade344ff8fd90f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025675, "uuid": "7f84b8f7-0dd5-407e-acfc-550f7f10d379", "value": "T1BAB5338099C67F8FF06843FCA957B94F1660C9C5C95B4E19128D0C095E6BFAB90F87E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025675, "uuid": "b0a57969-55ab-4e24-920d-2631cd84fc68", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025675, "uuid": "b0d42304-2ac4-469e-99ea-1444bf70cd05", "value": "49152:k4pXmvtYjrpLxqV8TqXKJxuzv+aAqhMPoKG7A9nFALEt:k4pXqYjrp9O8TqXqxuzv+5WMAKh9KYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025675, "uuid": "5b7d7c16-c83f-4fa8-aa4b-8d2392471de2", "value": 2444288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025675, "uuid": "0b176ad0-7b17-432a-bb24-daef9557d6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025675, "uuid": "11724ea6-0761-45ae-b4a2-db8c9b09a2b6", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd44f18-ae46-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761027953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027953, "uuid": "ddc71af8-6b78-474a-a7fd-615711d7ec5f", "comment": "Malware payload (PhantomStealer)", "value": "a6e57483ee7cd0720eeb779a2cd0560c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027953, "uuid": "141619e2-6995-4eaf-b889-565248816b91", "comment": "Malware payload (PhantomStealer)", "value": "3975996e48050e31858381e0a8adacd0eb43f7417af5d344323e4b4c22045052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027953, "uuid": "efd9ea27-adf1-4de6-9d2f-acb5ac8e371f", "comment": "Malware payload (PhantomStealer)", "value": "cda96d63e22187b687da5d9acaa9ec7f90e09ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027953, "uuid": "3351a8bf-eb87-4942-86a6-5e14c2dbb76d", "comment": "Malware payload (PhantomStealer)", "value": "4531713834a48b556787c984a034aef9f0ea1c426560b9a0761d3263abd5e44b677168b63706309c8f515fe67109c6ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027953, "uuid": "a19c26d1-a6db-404c-bd46-76762b980300", "value": "T17E4512583BADDF13D4A22BF50AB1D3B503B09D59B810D3164FEA2CDBB4B5F4A5528A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027953, "uuid": "79e17301-73ec-4153-a058-77fb4ff5622b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027953, "uuid": "4568097f-e8fc-4de4-8d64-1a6f9631a671", "value": "24576:/Gf77JZswPQsApDTjjCP9CL8HWIcDvo8p9hPZRyez7F6IhSo7HOZigwpK:uf7dmsmXS9DHWIc089h7yevTXQig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761027953, "uuid": "fe493c43-3569-4b37-a2db-91a2fd4d3188", "value": 1259520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761027953, "uuid": "5a4dc404-27f8-43c1-97bf-17f6c4ed5e6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027953, "uuid": "039a74e0-2cc1-4741-9e51-84bf771fd57f", "value": "e-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b9fb50-ae67-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761042138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042138, "uuid": "d3d83511-e89d-4dc7-85c4-fbd20d78a78a", "comment": "Malware payload (AgentTesla)", "value": "fb58870d6e5c5f9dd8df0a434d85d860", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "simongoodluck--donthasn-xyz", "colour": "#7A259F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042138, "uuid": "533d8260-716d-41e2-9df7-d151c73c20f9", "comment": "Malware payload (AgentTesla)", "value": "3a80d5b9b00b0e62973c4f8b504d134be767943c449d31865930cff5828ede0c", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "simongoodluck--donthasn-xyz", "colour": "#7A259F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042138, "uuid": "b56c931f-0cd9-4d37-9caa-8c6be7ff1c3a", "comment": "Malware payload (AgentTesla)", "value": "542000cc079e2d672a430ab75019de4d84e5a8f4", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "simongoodluck--donthasn-xyz", "colour": "#7A259F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042138, "uuid": "946d5c0e-6174-404a-a5ee-5cc49f95bd76", "comment": "Malware payload (AgentTesla)", "value": "1471322b4be783df5aab089cf881a047652c3c6709da3a0c6afd02ba3d8d68bfa3a51544370389eb2e3455a44dba451f", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "simongoodluck--donthasn-xyz", "colour": "#7A259F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042138, "uuid": "ed583470-c406-46f2-8efb-f2107c5a0d2c", "value": "T11F65B0F87A047DE6266F576BD996ACDC13B626639ACBA4CC806477C305A3371FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042138, "uuid": "81dc0b24-9c71-4255-a373-fb940765a9af", "value": "24576:Zs1jTrXEkxxdowvlnS35EFhUvuSpKfwPdGUMr2BvLe6sZUTDviJJtgmsi0D7S3:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042138, "uuid": "2ba51fc1-9266-4c68-9063-4dd621bcd813", "value": 1416174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042138, "uuid": "b8496240-df2c-484b-ba43-72d23af7ab16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042138, "uuid": "bdc42f94-7492-4072-b056-7d80e7bb4495", "value": "air.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47571cf7-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063809, "uuid": "1d480e65-ed40-4fa0-8008-166a75e72c5c", "comment": "Malware payload", "value": "eb529d5032bf231324b622e4a168d8ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063809, "uuid": "d19b1815-bee5-4607-8dc5-151069212ed3", "comment": "Malware payload", "value": "3a98757c673ffcae7091a3e8b590ca1a686be5a618b2fc1b387befe898fbbf1c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063809, "uuid": "cdd93c03-429a-4d42-904c-b29374f9353b", "comment": "Malware payload", "value": "266d6ad18e80c86847e31e0f9a97a22e06e4b6a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063809, "uuid": "6983a78f-88ba-46a0-98a3-64e4abb382b7", "comment": "Malware payload", "value": "5bf8ad3104a910ed3c0f99571d25661a194a3c1334224031a1152a419375743c966bc57aa9810649ef4d988b45c63d8e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063809, "uuid": "b038e1e7-1f5f-4060-93fa-2791ac595812", "value": "T136A30A1BFF39ACF0C260F98C2F409CB2982DCD69EA17444DA80BFB61D749955B6811DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063809, "uuid": "aa3819c5-ac5b-411f-97ff-968b958049f9", "value": "1536:GDB7eKg20I8krorPjWMz58pBiAOw9mct6BkQWJ+aY:GDB7b0I8OmrW058pB4w9mct6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063809, "uuid": "67975a30-14a8-45d5-971d-620e73b27041", "value": 106647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063809, "uuid": "ca4b45df-e4f0-4c1a-9128-bec659914672", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063809, "uuid": "31278ccf-23f1-498f-a2b3-738cb4ffb8f2", "value": "invoice-1637482117.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb418564-ae72-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761046850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046850, "uuid": "42990cf5-9630-4dac-8451-768c51a5b993", "comment": "Malware payload (PureLogsStealer)", "value": "112ee15a15b22c168b63756d62ae54b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046850, "uuid": "d6e511af-8f12-4ed9-bc2b-f4c2fa4f95b1", "comment": "Malware payload (PureLogsStealer)", "value": "3cbf0bb73e7973458f172a4d50391803a89ce183a17438f689d9045a683b5cc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046850, "uuid": "ecfd0502-0dad-4cf0-9e48-70d5eaa34c4e", "comment": "Malware payload (PureLogsStealer)", "value": "3906f2a895abac7c81039408775f573c868eb6a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046850, "uuid": "d5a12aff-4794-4a60-807a-9fc707cb2830", "comment": "Malware payload (PureLogsStealer)", "value": "97b38faf430d7fd67985e309af0ca5d168395b1192e94178197f96c6d02ef1c0d38f70ce4938fbe2498a7ae1c94992d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046850, "uuid": "ed0a1ea9-9f62-445b-83aa-d40e806b87ee", "value": "T1223512557B1EDE21D9A22BF009B1D3B617B06D0DBD00E3074EEA6CDB7468F192869B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046850, "uuid": "6f52760f-8e34-404e-8ec9-99122fe872ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046850, "uuid": "1e24601d-6a2b-4854-b929-e032e98416be", "value": "24576:jof7Dvosz8nmUxu91TAV+9CKNxe2zWDlxZ9hH15t:0f78sa9c90+Ese2zoxBH1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761046850, "uuid": "21312101-18e4-436e-8640-2ecec50eef8b", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761046850, "uuid": "5f989b89-6dec-4631-aad9-eb418915808a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046850, "uuid": "f4305dfa-aad7-49b0-8916-58d2f353881a", "value": "csoi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928f0fdd-aeaa-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1761070807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761070807, "uuid": "ae86220c-1eab-49c3-ab9e-558939f464d1", "comment": "Malware payload (DCRat)", "value": "23b27aab189c45510aa71c770aaf656d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761070807, "uuid": "82bfdaee-5391-4a77-ade7-9559cbfd6f56", "comment": "Malware payload (DCRat)", "value": "3ce4abcef0a6dd72405d73056ea13e9ed688addcee37f5135451f4af4af6f06c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761070807, "uuid": "257cb52e-76e8-46e3-85b7-1844418b9c9c", "comment": "Malware payload (DCRat)", "value": "4f5b9de3cb3cec1e568e0e3c3a0b19061894a7ad", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761070807, "uuid": "93c11e96-63e1-491b-b13d-dfb2c1d43702", "comment": "Malware payload (DCRat)", "value": "a6263aa0c9ae5ea43f6ee3fcd3581e6eacd34f9a3588ab55e1a32987a3df6f681ed3f039bcb65cec0aff6294badcdc27", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761070807, "uuid": "e35eb81e-aef0-47a6-886f-31ff50851607", "value": "T16E85333D8EAD7A9EC4812775819D5EECB26321060D802BDD1A1ED91AF367F005E6F387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761070807, "uuid": "50f2b6f4-95de-4b37-9769-7255f6a60e65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761070807, "uuid": "6e49c0ba-363d-4689-b067-d5e5eed4aa75", "value": "24576:Ij/VhzcpmQPXjwuFjMHHN3MZ64J3Fs4CSz8PGeC/CG8/IycalVfYWOVc4Rf+0:A/PzOvrwBH5v4J69GpJdyn1YW6DF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761070807, "uuid": "33de0bd0-9139-48d8-97a9-093bc7ef873b", "value": 1763840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761070807, "uuid": "78815c35-dc6a-4a4c-9700-213c37c74001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761070807, "uuid": "ea6d8470-5ec7-4d82-be53-bd3951fff422", "value": "23B27AAB189C45510AA71C770AAF656D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f853ae5-ae39-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761022108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022108, "uuid": "f201c447-e8fd-45b9-b3fe-1f5d12e0ddef", "comment": "Malware payload (Mirai)", "value": "7f229b64c4226e367e65dd7a22574942", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022108, "uuid": "e9d5dbf7-2f08-4183-85aa-824fd5e9f224", "comment": "Malware payload (Mirai)", "value": "3d241827f1484f1b5f563efc3d6f116f9346380a920ba93349d8d4dbceae9b4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022108, "uuid": "b08f2226-53b1-4de1-a39a-f3447134c90e", "comment": "Malware payload (Mirai)", "value": "640ab0a84d2c4deea5655c0422b259568cd29416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022108, "uuid": "bebe01c2-c2f2-4596-8437-7dab2ddf623d", "comment": "Malware payload (Mirai)", "value": "4767e61734a2a4676acccfa23bf0d788d5931c6c1c87e293e5a63c19c535f2291fa4440d1fd1c954b787f81b3bd51ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022108, "uuid": "4ca2c02d-2c0e-477f-affa-db696fcdae38", "value": "T11A03F1E781B54615E89DD03848BD68C22930DD3D1AC7A6E3575121F6F8D9FAC3359780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022108, "uuid": "2a3c18ce-9a26-42b0-8873-a3ee2df87b5b", "value": "768:redqhQBfDglZh4ur5j55M6p2Ni0OGH7LNqcVqj0Umq255WhwX9+UdpkinbcuyD7R:ruraZSyd5i+2NijSqMj75i9ykinouy8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761022108, "uuid": "89c7e867-55f1-403f-91f1-006658b72a33", "value": 39144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761022108, "uuid": "c9315e7d-fcf2-45b0-9060-60f4c15797b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022108, "uuid": "a036ba80-51bd-40ae-ab71-62e0168dc512", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec38149-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761024630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024630, "uuid": "680e6677-8b5c-465b-9245-45595537e831", "comment": "Malware payload (Mirai)", "value": "e21a92d237a82d31e042a1b622880f3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024630, "uuid": "d5253ad1-fbcd-4f2d-8d73-bb1c90126384", "comment": "Malware payload (Mirai)", "value": "3d25080f5909b0990967899f802d4b645649e6a1f049ac68ad4d6d93d3c85850", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024630, "uuid": "5f7e2e16-5858-40ef-bf75-5cf061e02b2d", "comment": "Malware payload (Mirai)", "value": "49a6ff9a458889e21c7cd0666b594f12ac633746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024630, "uuid": "09893345-9db4-4dff-b14e-894b860ba796", "comment": "Malware payload (Mirai)", "value": "bfbc3306d1cf3c03826765dd678ccf59045b7ac81be617b39da9ff79babc6daf792f5623aba8b79fe1707d7e9fbb0c36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024630, "uuid": "b6e72407-1c6a-4cd3-8011-a5b0bc105d93", "value": "T1ED13E110D26C930DC7BA323B5899B5858461620496D06E96F250272E39F7FBEAE3C3D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024630, "uuid": "111bbcda-0594-4b15-b8fb-5d177ab45731", "value": "768:IyUFmKQq9x1EEenfCytxwtnm8dwWPsZiTUbutjdy4o0nbcuyD7UHQRjkI:ZUEKQq9TeKytxGnm8dwWPEiTUKtjEmnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024630, "uuid": "9af58e65-f575-4caa-b93a-ce5fdc43ed18", "value": 41576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024630, "uuid": "4aad9c17-7328-4a04-95a5-ca161e7f29c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024630, "uuid": "b42cdfcb-0bec-484b-aad3-b055fc65c216", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c6dc13-ae65-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761041286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041286, "uuid": "a41f4733-ec7d-41f7-89c9-4e50d93bf7bf", "comment": "Malware payload (Mirai)", "value": "ca483cbf3d3c79746779665b27231cef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041286, "uuid": "e331efcd-4f03-4e17-b814-a363e4f907cf", "comment": "Malware payload (Mirai)", "value": "3d4ad0cccfa90460b2c80080f810c7918d348a6d13a99e321ce11c7e7729802e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041286, "uuid": "8519f8ab-e357-4563-8a80-234af42c0331", "comment": "Malware payload (Mirai)", "value": "37bd403c65bb12c7b9ea7f99aea45bbf2c909e73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041286, "uuid": "58f38f5f-2d26-404d-8f61-922eba87f58e", "comment": "Malware payload (Mirai)", "value": "c30594ec13e2b6c7d9fdf8bdf87e7e5967896fa33cb90ea0e7ce4692ec90b9f0711d33fb67ac8e75fb33fd94ba950855", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041286, "uuid": "f0619594-dd7a-475b-87d7-fc32fc873bfc", "value": "T1B6D32A06B30C0A47D2632EB03A3F67D093EFDAC121E4F641356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041286, "uuid": "42cc1908-3828-4867-8797-af3eea952470", "value": "1536:cP0nwryWv+n/qZIecST98z+xpnvTnNIkH5Afg57PMfgvAtI20jDWB/qHs0kBB/zU:ccWv+QcG8z+x57np0gVPM9t9BBben", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761041286, "uuid": "76357ff6-7256-48f9-b747-6c61ef5c2309", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761041286, "uuid": "fb9f3722-5ef0-40ca-a24c-b527f5499626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041286, "uuid": "200b89ee-b6dc-464a-b615-a841126018dc", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d54881-ae72-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761046598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046598, "uuid": "4d9e294f-3d07-4821-8e5f-7249c2bfe3a1", "comment": "Malware payload", "value": "5ef4bc00434de350e2f7700e99869baa", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046598, "uuid": "c7621c87-38d9-4314-a6bc-3a77fa229c39", "comment": "Malware payload", "value": "3d90141aa59d26d931db1833a4025f49fc76301d5894bf33261407801a6c36be", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046598, "uuid": "12f81bdd-0e1f-4e58-8404-18ab6dcd9ff1", "comment": "Malware payload", "value": "3eb43d07c851883feb5830d149ac3dc07fe646a7", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046598, "uuid": "bf15b4eb-d858-42b9-baad-63b99e9f1953", "comment": "Malware payload", "value": "c5a52bdb343c98e9870de512087de1f21b1328b2eccf4c07ce032a6639dfe09587ecf015a7a53d32d27ec38553fdd071", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046598, "uuid": "c7cffef0-3145-403d-a10a-2170b757bef7", "value": "T1DFA423E63D8E2A8F8962827722E3B24FD95739514C7F02D422B4F7606E6750949CB372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046598, "uuid": "8cc14eb0-5d47-49f7-968a-14dfc995dd45", "value": "6144:1wqinjhP0DbXszwOVJCzPJy7/jxranCPhEyYT5MfBBZODm5i1vNybvVAJq3HU1Lm:1itP0D+9SPKHJUtTvgVAJq30hAutIGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761046598, "uuid": "9a14a2a9-653c-4338-9d0e-34560e25c10d", "value": 465826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761046598, "uuid": "6568251a-b404-448c-8d5d-80a807baccf8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046598, "uuid": "e0a2f518-3a17-4450-86a6-cb3b740f8d6f", "value": "dsada.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0bfe21-ae3d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761023790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023790, "uuid": "8e8d80cb-b1e0-4b68-844f-504458c7cc15", "comment": "Malware payload (Mirai)", "value": "9a972f78bdd9c327be1cec3b68a7d66a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023790, "uuid": "71206c1b-f5c4-4007-a803-6d9b0022e2f1", "comment": "Malware payload (Mirai)", "value": "3f295a09147cd004daf02131836f17c63138f57cff206bbfb5267332742b0d60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023790, "uuid": "7122b03f-ba8a-4141-8472-7c341e296f8c", "comment": "Malware payload (Mirai)", "value": "ed34f58db42c03b9292f52017e8c0a3f241df3da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023790, "uuid": "e3d3ebe8-e54d-47fe-a247-bdf47565f334", "comment": "Malware payload (Mirai)", "value": "1d76e19cd783f852642ea02a583f91cfedea7c4af44868b9a283e399891ec175343320a46d61afab6d2918561749e317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023790, "uuid": "3fa4a6e9-b88a-45bd-9896-ddfce8aa6959", "value": "T124C3CF97F74B2091C8614BF007C74F9D3E6362129EABA8E76C0F627B0A791DB5907391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023790, "uuid": "c3b2c590-3591-4b80-98c9-6c0f108fb8e5", "value": "1536:m8JqvjmT0tke1lDw0BW0kaj+yg3Ebul5cOEPmFLxZNmWgK/LWU:mLv6TxAlQ0kyNEEbucOEPmFgWgKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023790, "uuid": "d4c96c03-c41c-483b-9850-3360c88225e3", "value": 124364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023790, "uuid": "a3c5a929-b383-4807-bf81-e2132e3eeb99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023790, "uuid": "7bd15764-e52e-401a-91e9-344d0265a4fe", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e333682-ae3e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761024441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024441, "uuid": "3b4af7c2-6090-449f-a6d0-65cd36003b6c", "comment": "Malware payload (RemcosRAT)", "value": "36650db509a2b5ad75f9c5fe9ef09bb9", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024441, "uuid": "fbc8e783-26be-42f7-9802-3806ce825773", "comment": "Malware payload (RemcosRAT)", "value": "3f7e8a794c180d47b56d0fc0a9a8fe1be851f51a2ef2301b5f27bee20f26115c", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024441, "uuid": "96992e1c-9896-4080-81cc-2f25c8b827f1", "comment": "Malware payload (RemcosRAT)", "value": "6c737b600fedcda1372d5eed36dce64c4d3f0dca", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024441, "uuid": "dd5fe167-5a9b-45cb-8c88-484cbf22f51b", "comment": "Malware payload (RemcosRAT)", "value": "ca79b7c7c100b3c30a78f743cfc9f97164a7ff1fa1559276218a7b45aaea4b7c02a6b5a1fdbfe85f6dc44c45ebcefb19", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024441, "uuid": "c9513872-ddd5-4c1c-aa8b-468516150d7e", "value": "T13A25229FEFB0F72BC42874F448D385C442297EABB1AD07076B447A419DB55F2B1C286A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024441, "uuid": "96985b8b-d070-46d4-8b73-8f42c5162c8d", "value": "24576:iG+Jk3+nYo1Szgv8pUpZM8INZjGeBck4qvl4G8w2rHPTuHe:iGzqH1pvg8YqeBkqtj2TLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024441, "uuid": "bebcc2b8-fe01-4089-870b-11ddeb5583ce", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024441, "uuid": "a4f04b1c-af88-4592-9ad6-78e279c24732", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024441, "uuid": "f74f5348-3992-4570-8c83-aca5b7dd7094", "value": "Quote CH091024A.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9ed27e-aec4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761082096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082096, "uuid": "b740da44-1076-41cd-9661-8ffdf469cfcb", "comment": "Malware payload", "value": "c33134f452bd4777049724e74badf6ad", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082096, "uuid": "0b6ae450-5470-4ed8-8e14-40a577e22cc3", "comment": "Malware payload", "value": "40297cfa5e3b2570133ce39f9d6a205fa73f554ee756af3a506cd852837c3aae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082096, "uuid": "dbd68834-0552-4637-8f49-c98e169ca61a", "comment": "Malware payload", "value": "7374babe17093af841318e92c549ff492cf25d21", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082096, "uuid": "b5329680-4c03-4553-9f10-df86970ca151", "comment": "Malware payload", "value": "4b61f040fcd5f9f3eb04053f462b63f262af5835135cab219dea154c59b0f95db288fffce253b98386dab4b9e13af444", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082096, "uuid": "6a48cb5e-ea6e-47c8-b244-585467471631", "value": "T1F263B4D5F9732C394FE5D162CE50E881007EBE8EFAB0A418EB542179DF3D924C382669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082096, "uuid": "53e90b2c-6c5b-45d5-836f-33fc3d438022", "value": "1536:c5p5gQA7gTIUF+ZiRs8ItPNA87R+Lda12pOUO1uytZIzFug5jBvXsQ3UsIcDRqtk:c5/gQA7gTIUAZie86PNz7R+LM12pOUO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761082096, "uuid": "0978314b-1558-4430-bf5b-fce4125ef914", "value": 70876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761082096, "uuid": "a09d0a82-840c-40b2-9cc6-ed12268e565c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082096, "uuid": "686b498a-589f-404f-8544-c0fde4ddd73b", "value": "y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d298d0-ae9d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761065061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065061, "uuid": "23e07846-550b-431b-a172-057a44e748e9", "comment": "Malware payload", "value": "e9f8928f27f601042c4edc477533d661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065061, "uuid": "c42f965a-c453-4bf6-871c-b53c79b5d993", "comment": "Malware payload", "value": "402bcfd67533d13ce190a5823a0a97b00aa4efaebde0e0367e59f791aad53231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065061, "uuid": "09f8021d-340a-49be-9d1b-45a3f80d64d2", "comment": "Malware payload", "value": "748f045d105913fe8ba6d13a6043cdfcc333bbe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065061, "uuid": "6b4f1bce-6f02-4a0a-a309-d35e17b80066", "comment": "Malware payload", "value": "42adaa4e6f3e069b4cee931e1a5d789bc2bfcb3238b6722ef1cd07710eeec191e6c1969649194c8f1c768a8585a4a47f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065061, "uuid": "bc486f15-df42-44fe-9b8f-d562640f48c4", "value": "T141D46A8EB57B0CEAC6DF95FB80368255F10368D07141862AE7AE4027DD872D29F95B3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065061, "uuid": "0db2d626-aa39-42d7-bbae-375d1a7b4d75", "value": "99660705ddfa2fb658dde087921ec28e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065061, "uuid": "2817745a-d36f-4a4c-801e-96d6028ada3e", "value": "12288:scYgl8F20ivjFVCOMg/taoT0JFGjRNFLPKQjNPSl31H:Ggl8FFmjFVKyLT0J+RNFbKsNPK1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761065061, "uuid": "1ae7ac4c-6959-428a-a7f8-12a915265a5e", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761065061, "uuid": "1fd73e76-ee6a-48a9-a629-69414ca41719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065061, "uuid": "c1060b6a-bd63-4a6d-94e1-b23c21a4c281", "value": "Launch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e1415a-ae4c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761030311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030311, "uuid": "580adf61-8f97-4dd4-93b8-266c056d20cc", "comment": "Malware payload (Formbook)", "value": "9dbe4194680a899aee5bb287cd3409d3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030311, "uuid": "abc06c71-f258-4666-8ebf-c6b9f4eaad7e", "comment": "Malware payload (Formbook)", "value": "4087c9ccc5b19edd2f673a342931cf67910cf82311bf9730f1fb34a308bf1e6d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030311, "uuid": "8157ea53-57b7-427a-ad81-edc17b4e5814", "comment": "Malware payload (Formbook)", "value": "fc3d5a6006c042a5648577d5bacf3539b1e816bf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030311, "uuid": "ea889dd8-7f9e-4c64-b525-f0aeaec0e48b", "comment": "Malware payload (Formbook)", "value": "fa9c3b8d793a596a00e2c204e1bcf57b3feae683c3138cc65e2f52510536c64f437a021a1deb875cb2e3e2e894cceefc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030311, "uuid": "e4b23354-1b31-4bf4-83ec-98f18ee76032", "value": "T1D2E4233692006D565472E9B70A63EC09326F34723E61674352EB2767BDC94CE1C3FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030311, "uuid": "8e3dcf6e-018a-4e8e-a54e-16bdb1d35512", "value": "12288:3grzqTsMiFE3Xlkf1d/10jpslG0fAvxuOcln8Hm38XuOXCqd2upjfC:wKwMiyHl0d0jirKxuxln8G3uqqw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761030311, "uuid": "81210f59-1304-4753-a965-7c7df7f3c26f", "value": 701906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761030311, "uuid": "2507d51f-7173-48c1-a781-b5408d19c171", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030311, "uuid": "a92d5bb2-f930-40d0-996b-b5fcfe4ce56e", "value": "PURCHASE ORDER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab77d72-aebb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761078068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761078068, "uuid": "4fe135af-e159-4826-8216-24587b74a192", "comment": "Malware payload", "value": "2395095dbe07e1db1b0fd8bbfdd27d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761078068, "uuid": "8e214a51-d976-4e23-a621-571826a3d57e", "comment": "Malware payload", "value": "409790f055bc6c4b4b7cd18fe7c2382e2d193e7154722e1b083b53cd82ccebec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761078068, "uuid": "01167073-b48d-4b0c-b55d-1657b2990ea3", "comment": "Malware payload", "value": "d6c5b550e1e94d1f9c10dcf502d81460a9961f1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761078068, "uuid": "37392721-f116-44b4-b143-5ab937a44e8a", "comment": "Malware payload", "value": "284f7dd2d17e18efff1b791d3836e19b69549d884bf8c90972aa7e948c84a70b19e0a441337cababe7872e2207894312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761078068, "uuid": "bab3ec2e-9152-45e0-8c3a-ef53bf334a7e", "value": "T178F55A0368E44A99D05AA330C5A271497B7FBC051B7223D32E50B77A2FB66C84DB6F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761078068, "uuid": "5b3a088b-ec40-4d22-ab2e-06c830a5d179", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761078068, "uuid": "6dece97d-746a-4b70-8da1-b534ef6691bd", "value": "49152:sHwS3P2CGYrbUCRE01KK075T/N8WrQBmTW:sTrAlpx/N8BmTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761078068, "uuid": "6421f8c1-b6b5-432b-bfe3-346b174092a1", "value": 3433016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761078068, "uuid": "e5c61fbb-1902-4763-9559-75d142456d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761078068, "uuid": "549092c8-57ab-4165-9c03-40f7571d6d95", "value": "SetX86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c042182-ae35-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761020384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020384, "uuid": "e4a2781a-5b15-4708-b4dc-b915843ec341", "comment": "Malware payload (Mirai)", "value": "0339442188b050887ddc7966ecb02b98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020384, "uuid": "6219d649-0cfe-4baa-a2a5-2856f2566586", "comment": "Malware payload (Mirai)", "value": "41be03d1af06f01382a1a71a5e2601b19fa3e99a108fde20d8047045f80f61e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020384, "uuid": "a53a3cd5-3cd7-4b7b-a44e-acd1aff7270f", "comment": "Malware payload (Mirai)", "value": "1ea6b88d88dbb7aa3c603f8d8a3c00c0ebe23bf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020384, "uuid": "10f5392d-bef4-4b37-9f34-dffb4a38c331", "comment": "Malware payload (Mirai)", "value": "2e71736fc8280e72199add7e3c68507be86ae25991741a5fa5dc2b0f68deda334a58fc6ae2c00dc3083b5e3eb65ad238", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020384, "uuid": "93614007-71c0-451a-bda3-a0ca06ed7743", "value": "T16BB2C0389DAED840C3384835977D45852587EF7DE4BB31A3023800A1F7E2B5AB5B998B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020384, "uuid": "e99fc10d-7553-4bef-a4a4-cde3a57a627f", "value": "384:zPmwL4w6g+H4OYMGBkUdcvCCbbdlUV6pi7uSkfRWLKXVpTNhymdGUop5hC:iURaCt9z6pQubULKXVpTNs3Uozc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020384, "uuid": "7f595f89-1581-4192-bca1-048b470f9693", "value": 24716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020384, "uuid": "0778af51-90d9-4721-a102-dcd488f711e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020384, "uuid": "4c2b5b9f-7aa6-4bab-957e-9637f9252a15", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d6f411-ae4f-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761031490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031490, "uuid": "45c9e7b5-4372-434f-9e16-dbf63857f56f", "comment": "Malware payload (SalatStealer)", "value": "ecb3ae9cd3ff8acc9354d98e7a2719ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031490, "uuid": "61697c8a-7bef-49d0-896d-69925cadb5ed", "comment": "Malware payload (SalatStealer)", "value": "42e727d45f28d8ecccd7d421d7b0e80d12cb7fd4e7e4238ae7168aa62d56a2ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031490, "uuid": "20d4cf06-7ee9-4f81-bff0-9627c3abea8b", "comment": "Malware payload (SalatStealer)", "value": "1472b2129cd61468470bdfe1ba029d05fec8e538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031490, "uuid": "f6799072-773a-4096-9e58-5224742d65ba", "comment": "Malware payload (SalatStealer)", "value": "6d8c9d839991def8301995104480dc06978c532827b0d88e7db2e684870cba62cc47773fe1f42cc439bec941f43c99e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031490, "uuid": "c2ea94fe-35f2-4d62-934b-ad5ad92f2a29", "value": "T19FF5336C580F635BCB0D80BE21C805A7729D73426D2B0BA529B9D6263D1F3D9507D8FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031490, "uuid": "72d1d308-0fd9-43ee-95e8-afeb101196d1", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031490, "uuid": "aa691bb8-72a2-483e-a13b-5df688d06638", "value": "49152:RA8sddnXe6z53AdDShkmJEDyeWLFrvHZ6lZ+CBJAD9sFZHciB4RixK5FkN:RA8QbzeGVAE16lNm9MHcg4RixKMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761031490, "uuid": "0a9d0d4a-3985-4a1d-b35d-86ea5ec4110a", "value": 3513344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761031490, "uuid": "683265c3-39e0-4eb2-8b38-6557271959bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031490, "uuid": "4fe14c05-72d9-4330-adec-a759681affad", "value": "SecuriteInfo.com.Trojan.MulDrop33.15118.7827.24214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dd42df-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761026254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026254, "uuid": "2e661115-edfc-4ba6-8277-8c469d8c10c6", "comment": "Malware payload", "value": "452c4a89c86069b52af745cf971f3ea7", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026254, "uuid": "c49c4504-7730-401e-84bb-db837d9a4d53", "comment": "Malware payload", "value": "43f6f999b13f232d86d059735e43d9ac2cdded3be9ec36a5aeb27f655e008c68", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026254, "uuid": "05762c05-7c6a-41a6-8b38-df6b786d74bb", "comment": "Malware payload", "value": "5e3675b015c4a3e9fe2d4df9b3f4f65a2126e1a8", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026254, "uuid": "787d9d6b-db2c-4fe9-ad11-a3b8f71adeea", "comment": "Malware payload", "value": "d739bb00300e3ce496f69746e0874483a3f21ddbc026d76ceb66b5430c68adb5509808a76bfcf8a016d435cec9a4f34c", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026254, "uuid": "dfc5d16c-9a3b-465d-a000-a5f7f8ce38e0", "value": "T1D545333C3AD58B5B42EE720097A3E63D17997E155528C0C2FE8076B7CCFA497DAB0921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026254, "uuid": "93530107-32d5-459c-9c1f-2d774756f7d6", "value": "24576:Ckj399o1RY/2YS8uZPq4+RxcnGyy+db97LWfKsOGbp60lczWP2wb:Vj3c1RuPYZURxcnGtGxvWVOM6Acsbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026254, "uuid": "5c836efc-712b-4080-a9a1-09f4a710ba7c", "value": 1240651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026254, "uuid": "7d041739-bfb7-4562-ba15-75a120ea7706", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026254, "uuid": "2d3204f2-deda-496a-b24a-12db9b3a7fd7", "value": "Orden de compra-65678768.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5998bc-ae15-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1761006612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761006612, "uuid": "02da200a-cb69-4e3f-9498-08834bea9a13", "comment": "Malware payload (DarkTortilla)", "value": "a3ed7fbcd1e407115582094ca1a41b0b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761006612, "uuid": "11106513-c265-403f-b607-486fc20f58e3", "comment": "Malware payload (DarkTortilla)", "value": "454fc6d5163e612b53c40aa80973f8344355e25fcfd718bc224e14f86f0e2157", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761006612, "uuid": "2515c761-65e5-47b9-a0a8-2538515bc934", "comment": "Malware payload (DarkTortilla)", "value": "aeb76726d545c5789e814e2a8ace5a325547c0c8", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761006612, "uuid": "2ae8cf8f-13f9-482e-a895-4cfebc1e5a70", "comment": "Malware payload (DarkTortilla)", "value": "3ff995b4d5e36439d0322be45a95093dfabb1497572dde77cb006997ce7aa8130116ab9bd443897e241dddec07046a2b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761006612, "uuid": "a19f0878-fa51-4e17-b392-38b1db4876d2", "value": "T1B0442355406009FA7FE4B05BD88B7AFE9BF54613B369CEEE7D083054144EB25828AF93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761006612, "uuid": "b630e95a-be2a-4a85-bdf9-c32f693c80fe", "value": "6144:sk/k1Tl3iI/3VzW7XHs1wlEJ0aalY7Luj/2w:skOMYMqCNaalYGyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761006612, "uuid": "547e6f2e-39c7-45cf-88da-c2c052bb6e75", "value": 262217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761006612, "uuid": "8048bcb4-abf7-45cc-a010-bc5c83138c3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761006612, "uuid": "3507bbe9-6e0c-40c4-948d-4e48bd7fa265", "value": "nPedidoS_202506.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c01271-ae32-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761019318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019318, "uuid": "5012cd60-a1bc-4830-8ca8-8aa16b17eedf", "comment": "Malware payload (Rhadamanthys)", "value": "cfab2c2b99ab4e77f10a53118700f925", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019318, "uuid": "35406756-4e02-4b46-9e47-80351bedcb2b", "comment": "Malware payload (Rhadamanthys)", "value": "475dde78b758af9a9ae810c128d626c15b88fc21c9db72120f42088ce75e6c69", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019318, "uuid": "7ddf04f9-66b7-41d4-ae0b-b20f97246c9a", "comment": "Malware payload (Rhadamanthys)", "value": "b8e2aab27508b0c10ee5452db87fbe44dd645765", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019318, "uuid": "7f46feaf-fa5f-4ec2-b0cd-7e0fd20e707f", "comment": "Malware payload (Rhadamanthys)", "value": "e514a26f14077961c05f186e79f01ae1c316c0d615b8ccc7657cdcd0ff941f2179420fe9bf0850617005f83e8f323383", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019318, "uuid": "bd837dd3-3040-4e13-9901-987d8313b762", "value": "T128A55C4BB3A430F9E1778139C8921A41E77278355760ABDF03A0877A2F276D19D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019318, "uuid": "a08d2334-c913-43c5-b18c-5f24c20059ef", "value": "1117dbeb097f01310598f34a3011fcaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019318, "uuid": "b18f8fb6-401c-4505-a9b1-e9ddd0c115ef", "value": "3072:cCM3B3iQ4p6ZSXEa0mXRdn7gKDu1Y41KECBQY9AooJk:cCMRSRp6ZSUaXXRB7d61HwdQY9ALk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019318, "uuid": "7493f97b-b7e8-4cb1-a88d-d125c0c2f6a1", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019318, "uuid": "06e7317b-96e5-49af-8f32-ec141df54a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019318, "uuid": "20bf7721-d580-4e94-b7d8-7d2e2ad3dc60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599ee4d1-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063840, "uuid": "81bfd9ac-83c2-4d6d-b6db-b8acefc7b1ec", "comment": "Malware payload", "value": "984382a6f5ad535a0c74959023cd6b4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063840, "uuid": "881c1f70-459d-4711-9a6b-d63164fa7a02", "comment": "Malware payload", "value": "478a106b49ea2da31096300ed7dcb7a66d8383b516a3fb0cc5580382cc7adc65", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063840, "uuid": "a99ef494-6058-4ead-afca-e090e8d561d8", "comment": "Malware payload", "value": "ef0a50710382602f84ac29d0e0f363cf2937289e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063840, "uuid": "b4a3718b-4bbe-4800-af3f-6f1f05121b54", "comment": "Malware payload", "value": "2ad7594fab2ea55552f3012cf079d530289f72ffcacc5737d92d4da6039621722d63f9b493de82717cc9345364498dc2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063840, "uuid": "18cba3bb-a806-4c7c-adcc-f8cd2a3c7f32", "value": "T18AA32A874A75F6FE25C1E7B76DF87E518F8981F78400401E41CEDA686A5C72F88A18E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063840, "uuid": "0c2b0ad1-ccb0-4762-94fb-99378a7187ed", "value": "768:GDhd0i7J4sYKgY/CMNfWdIR5w6jcGrXSprS4ShHuLAt1GnSLAuAAroQW+FF+Ec+p:GDB7eKg200rIrS4SsLAtYn6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063840, "uuid": "8b2d59d4-f6ae-4a51-b8d8-3b084101a1b2", "value": 102821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063840, "uuid": "c9d6e182-6d33-4912-ae33-fa505876d1b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063840, "uuid": "7b17b67e-3d15-4bdc-982f-2d29db757305", "value": "invoice-1637482117.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2aff02-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761063820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063820, "uuid": "7f678f7b-20da-4a9c-b7c7-26d6dd4202b4", "comment": "Malware payload (Rhadamanthys)", "value": "60b65ddd20eab75aaca3fa05bace2464", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063820, "uuid": "a7a0fcf6-3678-45f2-a563-ca5a9797eceb", "comment": "Malware payload (Rhadamanthys)", "value": "48658e9e1c04d5a1355a53edc241205bde4c5f7ebbfd44e229ac54d0088f510e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063820, "uuid": "82588a13-3159-4b9e-ab36-3fd8b92f439c", "comment": "Malware payload (Rhadamanthys)", "value": "eb3c574851b60bd11df36c03a6d0d2399fd7158c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063820, "uuid": "67c89fa0-a166-4047-98aa-f8b0d07db15b", "comment": "Malware payload (Rhadamanthys)", "value": "f4496fc4f03eeb1795ff9fc36ff1c2366b9d62aa74e3aa8a238d13d2d02221da0645b3328f6633dbeb44b0e7851882ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063820, "uuid": "44e47662-6558-4a35-b8b5-6f64380587e3", "value": "T18CA3C5C99D73AE3414043A652C854EF0FD6C93E06868219C731FBB60E75F9AA49CF5E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063820, "uuid": "4a5e8bf7-375e-418c-a81d-c321e7eb6f37", "value": "768:GDhd0i7J4sYKgY/CMNfWdrtj994sOJc9Lba/fz2qOEytwrtRe0/Y/L/X/4/grXBE:GDB7eKg20lr6rapLH6ABIO6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063820, "uuid": "9c45916a-3977-4049-b212-6e9dac6e4e29", "value": 103287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063820, "uuid": "cf4365fc-9c36-45aa-afa9-01a97b1511b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063820, "uuid": "0b79da1f-463d-4b25-8857-39e52ec19475", "value": "invoice-1637482117.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ef3702-aea5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761068749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761068749, "uuid": "de2c8427-7879-4472-a808-72176dbd4e32", "comment": "Malware payload (Mirai)", "value": "adb4840ceece75232579e93cac3e26ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761068749, "uuid": "312ea292-f4d4-450e-9d4f-1bebae9f5b26", "comment": "Malware payload (Mirai)", "value": "48a15ff06f5b45bb2f10dfb9b1273f0ba5806cb9d405f5683b5bb9b01a3d1c76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761068749, "uuid": "67a53704-8c82-44ea-a956-4698a67dbeb5", "comment": "Malware payload (Mirai)", "value": "f8f521ecc550ab77e49adcd42d0b0093de1c5544", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761068749, "uuid": "994aa97b-83cb-412b-974c-39805516aaf0", "comment": "Malware payload (Mirai)", "value": "ee1e252d3cd04e0eed10b3840857520302beabe99210b8c831f6f43ecbcc38d6e336f4a5e20b67f286e9f8ac6b4f63b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761068749, "uuid": "12ce7aa1-3424-4dc5-9ee4-5220514766c5", "value": "T18243026659C34EABF9A9373490F63A4F0F0AF8D082C94DE66EC1703D5C61D6A12707A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761068749, "uuid": "3360c79c-d8c7-4ba0-b37e-005661bf6dab", "value": "1536:2YtO5sitQBM6INvkibDrqMHIdYhWfj4KNdl2kvaddnouy8HyAg:jo5sitQ66GkiXrUdYIfDNb2xloutPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761068749, "uuid": "8dc14f01-ad1d-41cb-9d02-f2d8f70c0b0a", "value": 58984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761068749, "uuid": "d4a7ae41-f9dd-4fdc-8526-3f1cace9b2d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761068749, "uuid": "a538513b-3045-41f3-a799-1ba15c85e0ad", "value": "Orbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddce46e-ae99-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063337, "uuid": "658200a6-76d1-409c-a503-356c2b60095b", "comment": "Malware payload", "value": "5891049c2a54b6ef3a028e71037089c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063337, "uuid": "5686ecbb-5d7f-4e58-a464-ad24b99ba6f7", "comment": "Malware payload", "value": "4920749cebeaf6622bba3bb73b2a60ec8bea847952c19ba120f5ed154e7b24e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063337, "uuid": "f37f9d6f-194d-4474-8d2a-d632a5166452", "comment": "Malware payload", "value": "6608e012036b30dca79c568e7da7832f221b5f7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063337, "uuid": "12664a0a-02c7-433a-9de0-9e3de07a329d", "comment": "Malware payload", "value": "99966a6408f5226042719d76940d1bed047eab6ded1ac4e93c339d35bd10aa84ce5378bb93f94a4d13440bef20d50cc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063337, "uuid": "3f9cdb32-11f9-4f92-8313-be3fbd4a265f", "value": "T1DE164A709352B169C1A7C0318BC64EF465A1B13B42356D0F5BC8D82626BFE71AB6D3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063337, "uuid": "765ead9f-04d1-473b-9a0d-c4364aa3c6e4", "value": "c6d9475f11797d6388b0503589587352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063337, "uuid": "ba622e78-479a-447d-8d83-c3de6515fc74", "value": "49152:b38R6UOr+KpHb0g8wDwK83prADBqR6WktvnbYLhOZxjyrlwiTXPdb97q2BY2dGxt:qIRHElNBY2YCdN3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063337, "uuid": "ce8795cf-68a9-4809-844a-9f074247a691", "value": 4169216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063337, "uuid": "499751b0-6d33-4897-afae-9213fde1601e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063337, "uuid": "6978fb76-1bc6-470e-8ba3-982d54956e00", "value": "[Cou]-Jest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2ffbb1-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761026134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026134, "uuid": "0c1a1be1-7b83-4032-b3b0-f3084900678e", "comment": "Malware payload (XWorm)", "value": "c2ec45ca9fadd3c0463be13d336dab25", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026134, "uuid": "eb0b397c-763c-455e-8b40-5f960d12b6e7", "comment": "Malware payload (XWorm)", "value": "4a70f4814639685e6d3c461f16bb3939dec62ce70349335da6630eda37f69be6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026134, "uuid": "ce9748ba-195e-4cd4-8635-e1c671685e39", "comment": "Malware payload (XWorm)", "value": "418b5c0b6d029dd66ea311c16e87f3a8abbcf4f2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026134, "uuid": "58f097e6-1dae-4d16-ac09-a677dfcc9e16", "comment": "Malware payload (XWorm)", "value": "d881045345b5a98a245348acc9652196314e72a47c2c0e56e083963d7137017c1e7e6b0f9d285f4e7aa6788e9e9cf98b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026134, "uuid": "3a89975b-a186-4a20-8b6a-a01ad3fccc9e", "value": "T1CCA32B2577A9C92EDA9D4670487285554272ED07BA22C30BBED9B37EF83338915031EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026134, "uuid": "d60f0840-fb34-44c6-8284-ed760a9dca61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026134, "uuid": "b615aa16-8caf-4fd7-8e32-545f088d55dc", "value": "1536:EtX4cynvwPmCPEpuLAPGHm7PNnbC+3dih0Gf:GmjpuLAPn7RH3dihTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026134, "uuid": "57e06bc2-b21c-4613-852c-3464698d910e", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026134, "uuid": "f1bc51a8-b648-4c9a-a470-8083639a9083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026134, "uuid": "74624c32-f6e8-4ba1-bf48-b27bf83a8bad", "value": "DHL PUSR000547346_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a326c78-ae3e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761024327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024327, "uuid": "4a0c3349-6aab-4703-8eb6-6d5955e43236", "comment": "Malware payload", "value": "1ef4d18de78ab1fafc37f4157c069b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024327, "uuid": "f92d5d0a-9fb4-46b6-b38f-944d3c2b54d0", "comment": "Malware payload", "value": "4b460d4661160b686264b7acf80c077c0d3a0d19d9ea6f1a62ae6eea87b40c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024327, "uuid": "4f34cdce-73a9-460d-a8ee-89825fc71ae8", "comment": "Malware payload", "value": "3125134c050f7f646e4f682314e9c74c4ee3f732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024327, "uuid": "8cc97eae-5a8a-45cf-8284-0e56512329f6", "comment": "Malware payload", "value": "5555c14c2324fa0f6e7f7dc1cdad98574d14ca6f34ff66fcc5dd2d9b961d0e2b6ab13d6c761c2cdafd64da68b3a5248a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024327, "uuid": "7b5888ae-ba6b-4c90-a2ec-9c7247ff15c3", "value": "T132A47D6AE6A500F9D1B7C27CCA538D02E771784543A1ABCF03A49A762F376D44E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024327, "uuid": "2a320ec8-2083-4750-9e31-a866c9bb8bd8", "value": "4417249db25f76aa5ea9cf43e19a38de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024327, "uuid": "08b335aa-9396-45ff-b8b9-37b24bc29d7c", "value": "6144:2TilB1lYQedB1lINIhom8X7jgLOp3k7CHhiH6cWrvRMEMxEyRJmNgLrP6kON:2Opg9IW8I2Hwad1Z8EBmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024327, "uuid": "1521018a-46e0-42b6-8633-732743c8f86e", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024327, "uuid": "23603330-3e71-4882-ae19-65369dd31d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024327, "uuid": "ff31869c-fccf-4575-b1d7-e15919c8641a", "value": "1ef4d18de78ab1fafc37f4157c069b2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd316433-aea3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761067899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067899, "uuid": "32e8a65c-6453-4f89-bc6f-cc1ae92385e7", "comment": "Malware payload (Mirai)", "value": "1b47244676e449c2380b178bf709e164", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067899, "uuid": "9de6d5b0-1a66-4231-a57a-d3bcf8dadacb", "comment": "Malware payload (Mirai)", "value": "4ba9937bb8ee9c6e2ccd847cc49ec87f16b5b0bd934bc6bf3a29052313b68138", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067899, "uuid": "4c0ff84a-e297-4bde-8d63-fbb7f436b53f", "comment": "Malware payload (Mirai)", "value": "02ffd83515dec6c0f7b984a607009f4c5d922292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067899, "uuid": "e46edbce-7480-42c4-8216-6135be6dc3aa", "comment": "Malware payload (Mirai)", "value": "9834c1b402ba5d3b9ff944f07d8a690faa4c94aef9d945600604cce056643ac1df40e52ea42a7e7498bbf6fbed3a0fbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067899, "uuid": "37712478-ba06-4350-b9df-157e6c974b4a", "value": "T1CCD32A06B30C0A47D2632EB03A3F67D093EFDAC121E4F641356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067899, "uuid": "cdb5ef9e-a40e-40c5-9392-94dad8925706", "value": "1536:cP0nwryWv+n/qZIDcST98z+xpnvTnNIkH5Afg57PMfgvAtI20jDWB/qHs0kBB/zU:ccWv+JcG8z+x57np0gVPM9t9BBben", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761067899, "uuid": "66ba0fee-9426-44df-9955-74320bcacb87", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761067899, "uuid": "2815c512-4767-4ea3-b2f5-b9d9d60fcda9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067899, "uuid": "b3e76cc5-01ca-4b28-95d6-d8745a7da6be", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba234db1-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064001, "uuid": "77260273-1574-420f-8adc-c959469ee033", "comment": "Malware payload", "value": "8fd1dc523e39a1238d51d9625639b38e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064001, "uuid": "15b647fd-6873-4024-a1fd-1a85f15e9ccb", "comment": "Malware payload", "value": "4bd4a621dc8e3ed94f6740690b9fc63a71b51da30a1d73e423676792088212a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064001, "uuid": "63da2d7d-9055-483e-9483-b5b4e190e667", "comment": "Malware payload", "value": "b81db841a3a9ab374f2928a04d2bb20cebc7a3d3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064001, "uuid": "8f1bcff6-6e9b-4c9f-8955-f5f5cfefbe46", "comment": "Malware payload", "value": "279f1e6fc8a367452f736e8bf4c34c22a7431084d482a808f9c02b999366f05096be830f12bd2f48919ae128a58d076f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064001, "uuid": "adcb10aa-9267-4337-8545-a6ecd07de898", "value": "T126A3FA91FCA3FDAE401652B487482ABF4C1ABA68C961F6594C2B3E60459F72D00F1BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064001, "uuid": "409b348c-0b63-40db-b56e-216e088fb27b", "value": "3072:GDB7b0OSRnPmYoL05qZ2lnC6SSdQXdB50VtIAdKEZiIuUD0V3dLHheONHKX8In6a:0VSRnPmYoL05qZ2lnC6SSdQXdB50VtIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064001, "uuid": "6e38ff66-a087-4e73-9346-435fd33ba494", "value": 104632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064001, "uuid": "15588fbe-983b-4570-aaf0-53d6cb6e6581", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064001, "uuid": "ea62b0b2-e070-4a21-9168-e162ef14602c", "value": "invoice-1637482117.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e1af90-ae6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761043518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043518, "uuid": "f973a0bb-b3d1-4bf0-9b38-de73a093bf18", "comment": "Malware payload (Mirai)", "value": "c93ee1a60a186c215fe20acfae6b4a26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043518, "uuid": "b2e77814-8238-4e45-bf69-d2cbbdf165ac", "comment": "Malware payload (Mirai)", "value": "4dbd63a0119cb8fbd7ac57334ff3c7f3566dae70b75a2e7c175d3768e1c6b9c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043518, "uuid": "8c378c6c-bdc1-4c66-aefc-9e9e453fec35", "comment": "Malware payload (Mirai)", "value": "db6dc50ff5ec37d44fe5dd505fbb38c01ddc910c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043518, "uuid": "2cf62117-0aea-4fab-9795-56e3515d3a8b", "comment": "Malware payload (Mirai)", "value": "78fa1192869f02c221671b179fb152e29aa2fec14f5cafb035bd5122914574ecf63b56ba7c17427b72fbf5b0768113ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043518, "uuid": "b9d311d6-3454-45e6-b517-202b65d94ac8", "value": "T1B8535D4333184A57C1B64AB1243F17F093BFAAA021F0B686781FA75A8672F725447F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043518, "uuid": "0eb53904-4e73-4d1b-9998-e54ac9152cef", "value": "1536:DTMdrUdLI2OwXJN3qp4P4XoAoxlFNptnJ8VRx:0rUJ3TPzFDtnJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761043518, "uuid": "4374a2b9-165d-4ee6-a27d-16381fb69947", "value": 62416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761043518, "uuid": "ecc6169a-4185-4aff-a15c-fdbcb8c31adc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043518, "uuid": "247f6b75-3fdd-46ce-8137-0cb7c2491110", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed4967f-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761063956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063956, "uuid": "03834177-f4cc-4caa-933c-9aef905add87", "comment": "Malware payload (Rhadamanthys)", "value": "c6a09fcf8e47b117fac2758fe8bc3e16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063956, "uuid": "4f7eb65a-7095-459b-baa2-813d87b6d2a2", "comment": "Malware payload (Rhadamanthys)", "value": "4e79c62eaf29ad9fb2cbea602b537d2ae27741676e1dade4fc28eae9a2fb84df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063956, "uuid": "02ea55d1-c13e-4d7f-91b4-5585c5c396f9", "comment": "Malware payload (Rhadamanthys)", "value": "1a6d296cfe1108b2f3436b7de6d3827ddeedca8d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063956, "uuid": "13d688b0-1926-4603-8fe6-98bb88cf13ef", "comment": "Malware payload (Rhadamanthys)", "value": "94aa9294a136234626cefa70954346d89d58ba413e833c415ea8e645af950e0a510de58d3a4f22a9a3d5baa789cb6cc1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063956, "uuid": "d8ccb8e4-042e-4f46-a79a-d4bb0146aaff", "value": "T1D2A3EBD0C927A4EF5471B3F4DE9488ACC913C49A0646D123783DBBB6D0DC74A289E6DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063956, "uuid": "2a955840-4a3a-42d5-9f2d-fd417c22029b", "value": "768:GDhd0i7J4sYKgY/CMNfWdCIou8SpZkxZdjaWpiIoTVDkrNkRIAsLLq5KtYjxgG9K:GDB7eKg20ErlrR4nKrAzh36BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063956, "uuid": "030854cf-684c-48da-83a5-a89eae921c9e", "value": 103918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063956, "uuid": "0edf4eb3-963c-480e-8769-6d973bd80cd8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063956, "uuid": "a936a3ef-7802-42bc-bac4-b657280d3122", "value": "invoice-1637482117.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adf7ed1-ae5c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761037267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037267, "uuid": "f0231981-6b9c-4b61-98eb-1f23e488aad5", "comment": "Malware payload", "value": "cfb89567314b25327827196240b8c6e6", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037267, "uuid": "7a547715-2750-4e3a-83c5-e3fbf59ae6df", "comment": "Malware payload", "value": "4eff48aab8e16eb897373d905b5f196444ace5adb6bc5560400a7a24a5b5fde6", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037267, "uuid": "1f4bb29c-72f1-4214-addb-402b670969f1", "comment": "Malware payload", "value": "e84e006d833638b7cf12e4de0baa5fa46b2e48e8", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037267, "uuid": "9de2efb8-2c5d-4129-9ae6-43b2e8e8e14e", "comment": "Malware payload", "value": "4d97e0c7d13849bd0532a5c7ea8f1464ad8627f56d87f667bd64723d506391e2b67a22eaa5ae3f20b3410db88435119f", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037267, "uuid": "830737e8-db16-4484-941e-f9a8686698ed", "value": "T1CBA2E14782020426FE5D6EBE34585B1E66BD25B3669E74B2CE3029C457C66DB2336C23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037267, "uuid": "3603eb5d-23ac-481f-8cd3-290dc0effedf", "value": "384:1RujuXiaZgzgxqTfRGOW34G0r+AVFey7Y/ccxQ+5CdZzxQNRng0Iuu:1RujuXiaOztsEiA777YnQJGNRnRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761037267, "uuid": "de050826-5bed-46d6-9b18-68ad942f465b", "value": 22111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761037267, "uuid": "7bd121d5-fd44-482a-acd4-c50130f25b97", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037267, "uuid": "647d3c9a-c68f-425e-be49-265bf41bce37", "value": "Request for quotation-TAXC JAVS-1298123432896066.pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe37fc3-ae4c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761030403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030403, "uuid": "a977b89b-97bc-48e7-8b8c-ddb4aa5c3e7f", "comment": "Malware payload (Formbook)", "value": "52acb344e80a26c08b52800daa12c4f1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030403, "uuid": "769db58c-1fba-4908-8c99-b7c426ab2873", "comment": "Malware payload (Formbook)", "value": "4f3a66d3d6f4160fe16cf447766c6a2314b1322642b51221292e8673ea87c0c5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030403, "uuid": "35046d70-fde3-4e94-b84e-b23ddfa4ebd5", "comment": "Malware payload (Formbook)", "value": "9d4971b7dbcddfb254826e3fc091fd5c046d80b9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030403, "uuid": "68f0e2ec-7b42-4388-8bfb-787987d6f3eb", "comment": "Malware payload (Formbook)", "value": "577236557192b8f720646f27fca3ab7c99473c79fb2798a09697b4c2a978d31e80742b08789a3eabd2c87334f6a6332e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030403, "uuid": "dbdd3b28-1cd0-4b13-9076-6b3fdd68b193", "value": "T1EAE4233993002D6794B2E4770A57DC06325E34F239A17B4761EA3367A8DA4DF183FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030403, "uuid": "9a73f541-eee6-4482-af96-641740215c89", "value": "12288:UgXWBTsMifalplkT1db10rl4lGpbXvFuOa798HK/8XkGVCqd2KR/qG:bmBwMiSvlKh0rGSFuV798q/uMqwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761030403, "uuid": "53909b61-46cb-41c2-8b50-8f9061ebd89b", "value": 702044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761030403, "uuid": "4a959d27-6944-4fc5-9750-34368b146dee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030403, "uuid": "c4e8acf8-8d8f-4cce-9ce7-58d7b566cefc", "value": "DRAFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533ea904-ae80-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761052662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052662, "uuid": "4310b3fc-e6cd-4575-989c-9bf36fa2180b", "comment": "Malware payload", "value": "d8ea507fb91755c13880ad2f528fb69a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052662, "uuid": "d3617ffb-34ee-41ff-a23f-072825d4edee", "comment": "Malware payload", "value": "501b5f40d624d5b4d738d9e9f44bef784f56a64ccfb0c43a8ce713d5566a9119", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052662, "uuid": "c595c6dd-0866-4a01-a8af-e3194dcec6dd", "comment": "Malware payload", "value": "e72b127e7579f25fc556a48f9e31c3d70360f3ac", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052662, "uuid": "951bef6a-cb74-4f34-ab71-862f6a12d7a6", "comment": "Malware payload", "value": "82b12aed2c1b012d74d198d072c614becbc3e4c0bd14bdee173ddcd7878900a4c619150d56763accf7e3f684480df871", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052662, "uuid": "c4930e85-deee-4433-8ff8-a62dd569f198", "value": "T1F7D502BB98F269576A504263EB4F2C1A339F29E13714D342E911919C6F3B1D38E92733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052662, "uuid": "7c1dd1b5-6fba-4011-9d62-c4cd242d8e28", "value": "49152:SOc2yD4lTPLI5YrgSg8FPQECxfNMDBvhog3YnK193OyRghY:SoyEFPLI6gSRToCtvhoghxOUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761052662, "uuid": "9ede53e5-ff1b-4650-a635-c8dd475a4aab", "value": 2991745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761052662, "uuid": "c0b19a18-53c2-43bc-8000-ec2311030464", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052662, "uuid": "f202e914-2efa-45af-bb08-40157eb48924", "value": "Devis personnalis\ufffd.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8e7918-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761026210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026210, "uuid": "28f76294-2051-4582-9cc4-581d6cb6e8bb", "comment": "Malware payload (SnakeKeylogger)", "value": "dacb48d3616556709544bb9d99540b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026210, "uuid": "2d33cc28-a94d-4000-ad44-1e0b95447bf8", "comment": "Malware payload (SnakeKeylogger)", "value": "516caa5876ff1a9e76d69c69967090ff8556283402109bc76e5e5d896bbc5a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026210, "uuid": "be7674d1-b450-4296-a8b4-c888a60d79d7", "comment": "Malware payload (SnakeKeylogger)", "value": "4607f2ed34f87698b4496b0f488e959fd1cc16de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026210, "uuid": "9bc5ff18-b02b-4e85-aa70-7114e5c0feef", "comment": "Malware payload (SnakeKeylogger)", "value": "95ae00d3163e5152e2ed10e115e0152f83f36d9f02fea3b34e12e0aa4423d605e3c1cf131191657d7f38eb884afd2dc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026210, "uuid": "05b82c29-50b0-413a-9e1e-95c42d9953cd", "value": "T125D40258AB5ADD12C8C11BB11D61E3B52324CE4DE960C6038BEEBCEBF469F56385D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026210, "uuid": "d5979321-e05f-4710-b62e-7a2cd3a53859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026210, "uuid": "6b8470de-d992-48d3-bb31-36309c26f772", "value": "12288:QBBf7uybfFa0cuxP6iXSI8bOV3Jo6qpVwQIfrnbiHo7Pv:Qvf7uyTFa1YPPXH7oFnUrbOWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026210, "uuid": "7ba3f3a9-5598-4c49-bd86-7678f0d020d4", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026210, "uuid": "712863da-555d-43a0-934c-ee734cce7625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026210, "uuid": "d1b47e06-e4db-482b-b044-9d806642f32f", "value": "MT APPOLO PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed720de7-ae33-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761019849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019849, "uuid": "4dd9e080-b13a-4dd5-ab24-17590eea74e6", "comment": "Malware payload (Mirai)", "value": "f4493f4a55ae409baae69bb89ccc3e38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019849, "uuid": "ef750156-38d5-47cf-bc2a-28a61af83fe5", "comment": "Malware payload (Mirai)", "value": "518faa4fee85b372113e37daa020f4e9484048e50e42941368cc26056c7680ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019849, "uuid": "60887313-6ffe-4348-b353-d8b76149c6ca", "comment": "Malware payload (Mirai)", "value": "4bcf0d475ca02de253682b2d63633e0551b8cbe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019849, "uuid": "fe20e409-8d10-49ee-ae2b-1136b9f41fbc", "comment": "Malware payload (Mirai)", "value": "6f53f436af3d331812dd616d77dff0ad0a12fb5d73aa571a32f7b8f838f52f9afd4d6cd7930b75e24299cde1ac193123", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019849, "uuid": "343a7bbf-621b-4f6b-aaa2-85a0cf73b8af", "value": "T10103E067D2784B9AE09BC439B4EFFB0E3584A2E8D01D42D9BDD92127A4BCF5C71242C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019849, "uuid": "932c4992-0888-49a1-b68e-7de9d20b3678", "value": "768:zIG6aXp07+4HHXGyTpxOfQP4PfzSt8kds6nbcuyD7UHQRjQ:z907vHWapOQW2t8kZnouy8HyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019849, "uuid": "6c4f079e-04a3-46e9-b507-04a3c0dcb3e7", "value": 40740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019849, "uuid": "b5ebb8f6-029e-4936-8e21-76c5621abdf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019849, "uuid": "804ad20a-28aa-42e3-85ef-471f203338a6", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d2ed30-ae9c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064581, "uuid": "25c7ed0e-34ef-496a-98ba-6d5d5e9542ac", "comment": "Malware payload", "value": "8f90e5501e319a41a9a9649098f7c7ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064581, "uuid": "ce17238a-9df0-4d07-a696-ae0fc6ff1277", "comment": "Malware payload", "value": "51974d6489023e692699475f2a5d25e986b2e1e6c191bf8f3e51100347981dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064581, "uuid": "f93da5c0-5f39-4feb-a22a-2301d7447228", "comment": "Malware payload", "value": "130493bf86c658ab8e748497603b0869a715e89f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064581, "uuid": "a329cc2c-838a-4c1b-900a-644e4c996bc6", "comment": "Malware payload", "value": "d9756b36868c535650812896cb35b85bc00bcb95c83cec63a099557bae462322d5a6412fbf8031c76857873cd09f8855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064581, "uuid": "c253dc15-907a-4432-9974-bf09efa12dfe", "value": "T181757D5077AC8B26D7AF4AB9F4B149050B71E507A163E3AE45C8B1F92DA33829D103F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064581, "uuid": "208dd902-7aab-4ba8-96f1-599017412e95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064581, "uuid": "5527518f-80be-402f-908f-b03d88f432a2", "value": "12288:e1i777crPbCJgRD1sdJ7GrUnxa1eoUztQd7kMIu6BP55+h+gAQAeey2nBlYjobPJ:e1pQ1ileoUKAQUP3+sgQ1nBlY4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064581, "uuid": "7e5b72d5-aae6-4c51-85c3-f2961ae9dba3", "value": 1570304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064581, "uuid": "8b4aeb8a-89bc-4909-aa57-fb2bf1da9537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064581, "uuid": "d6a9a191-d5d7-44f8-99f4-fce7142ac9b4", "value": "Pulsar-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796a23ba-ae80-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761052726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052726, "uuid": "f352f4f1-c286-4c71-846c-2b8712a2d211", "comment": "Malware payload (Formbook)", "value": "ef93f1be460ab8e78d7d879b94a0669b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052726, "uuid": "59dbbcd2-25af-44bb-9318-89a50001a9d0", "comment": "Malware payload (Formbook)", "value": "519a40b4d78cd118237439ac0a212bbcefc2030a9ca0a6c378dcbac040993edd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052726, "uuid": "9ca56125-6dd2-404d-b0fb-b62241f22982", "comment": "Malware payload (Formbook)", "value": "93deffd5c532cc22dba199e21ec215f7388e4f86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052726, "uuid": "85131b63-f9b8-4071-a5a4-00aa6b04d9fa", "comment": "Malware payload (Formbook)", "value": "dc94b9130243a7ae5954f0845a7ec8651f0b9f9993977090ef0a3d4928b7085350c69857b9ce6bc1f11c84c4f610fd81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052726, "uuid": "6543ea59-51f4-4123-ae1e-66d2ea2737eb", "value": "T1AE1501182B1ADF12D8D51BB548B2D3B853B89D9A6C04D2028FEE7CEB357AF042D25753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052726, "uuid": "f47cd15b-934f-4365-b8fa-506d87cc22a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052726, "uuid": "94c931c7-65d6-4ef5-be9f-67a56cf751c2", "value": "12288:xOf7OMSh5aihUfilBTmTSRgr9dSk3KQZOSE9LS/kEBER8rezSzYLy3X3uO:xOf7OMcaiiIJ66EJ4SE9LMVP0u3X3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761052726, "uuid": "6a50b702-778d-4e87-aa2b-bd9baf21930a", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761052726, "uuid": "9bbac965-ed16-4410-8dd6-64fb8c15c057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052726, "uuid": "821dc39b-e62d-4fc6-b7df-f7eea061cd68", "value": "QUOTATION#00785220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7390e04-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761025745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025745, "uuid": "2bad379c-d115-4708-a34e-f3a34a90cfd6", "comment": "Malware payload", "value": "83ff089a48daf105b845283c25ad9d81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025745, "uuid": "a11f9d15-1f1b-418f-990b-1359407c604a", "comment": "Malware payload", "value": "52ab64c5669e140933ccaa0024ccc80ea30ffb1b34a35d0f5d900e9dbabf071c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025745, "uuid": "1b1be0a6-dc36-4d7f-9437-4f194cb80d99", "comment": "Malware payload", "value": "822e54c189788757899fa7f4daadf140a7b2ea54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025745, "uuid": "32fa0c3a-f2cd-4993-9e92-340c006dc354", "comment": "Malware payload", "value": "0d69184391a11449c939c5775f8afa8d5d11dbd7f6a2e88a4fb936f409ac9799c564fb2b2dd3049d80afe80e0ec70905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025745, "uuid": "bc1410f5-7f7d-438b-902d-e36760d3bd0e", "value": "T1EA0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025745, "uuid": "d99ae96f-12e8-4564-9253-b430f4c75b24", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025745, "uuid": "bff9c9ec-767f-47b3-9dac-445c207a0a57", "value": "98304:aTT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:M2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025745, "uuid": "ea82f65f-a48e-43c2-9d15-98f08bedf8c2", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025745, "uuid": "3d0eaf44-53c9-4614-8389-8cdf60b1af6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025745, "uuid": "0514b780-45ad-45da-bc53-10d55a595799", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad86f6f-ae95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761061587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061587, "uuid": "c384babe-156f-4a33-b2a9-047938cf38fc", "comment": "Malware payload (Mirai)", "value": "fb342272c636942f83b2c8eac6f92c33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061587, "uuid": "fc2652e3-a6c6-4a3b-98f1-7f4dcabdb2c7", "comment": "Malware payload (Mirai)", "value": "5374a66f8374b9f6f4845793c738b6e743b5646f6992500cd29336e708958909", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061587, "uuid": "5add5392-e9f9-4f2f-aacd-f15745abd372", "comment": "Malware payload (Mirai)", "value": "f874da0d6b15987ec608b6a6e9e4b4072d735a05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061587, "uuid": "6967b70e-e1e3-4e2e-9b76-bb7f040d8fa5", "comment": "Malware payload (Mirai)", "value": "8ea416531ba6fb848faf6a5d7f92470043fa34ae17742529e7fca19664c5d564008a20d56d4d48e1a64dd8fb8528ad18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061587, "uuid": "fe22d9ee-cbcd-4087-8e57-b3754168979f", "value": "T10FE030DF789123970CD4AE84F0B24D459029D2C57CE05B9AE5AD34BA86E9A00701AF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061587, "uuid": "fcdebf18-4865-4fcb-930e-8edcc7b26a0b", "value": "6:SZEPUE1lExLBrENNNIl5epEfFa0LKiplEANIMkElJNDJjZEnanITv:s0noVUNNIl5A0c0LKQleMkGNtjZATv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761061587, "uuid": "86988ff5-a9aa-4a5b-b1d5-eec2767014e2", "value": 423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761061587, "uuid": "cd4cc63a-b319-40e7-83ca-56bba01c3aab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061587, "uuid": "a1d11b04-6982-4242-acf6-330c250e9f59", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd05d38-ae11-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1761005110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761005110, "uuid": "cc5ece15-4be8-4494-995c-10608c2de992", "comment": "Malware payload (njrat)", "value": "e36e7263122c4cec3910e03719872be3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761005110, "uuid": "32abcc1f-55b6-45f1-a2cb-54e0f59be50e", "comment": "Malware payload (njrat)", "value": "53d52508d4fbf502264ff4e8482ff3c988f86f4727326d09a71724b61a152e92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761005110, "uuid": "6c7edf77-dfac-49d7-a6a1-4cf4d1c4a2a6", "comment": "Malware payload (njrat)", "value": "dbd9549e1b7ff052dc667f18777f14112f16a0fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761005110, "uuid": "2af14549-fabb-47cc-beb9-cb37b70e963b", "comment": "Malware payload (njrat)", "value": "25b831b7fcd98fe801ac990480b2a4049b4ddd73b1fd900797f0968b4f1a972876ac9e7a4ecf1fea50965a7886014ae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761005110, "uuid": "7041e3c6-49fd-4a00-8804-f79d3fe84066", "value": "T11DA3CA387D952133C67EC1F689E50A8AEB69223F3191E9ED4CA742C418B2F156EC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761005110, "uuid": "40a2f162-8ed8-4f62-b711-55bf6f145875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761005110, "uuid": "babab159-3577-4035-bab5-fc8ae423d669", "value": "1536:WAp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XP:d5eznsjsguGDFqG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761005110, "uuid": "ea561a41-7fb6-4b2b-a166-46fe66758673", "value": 101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761005110, "uuid": "7e6b7b63-6fd3-470c-92bc-013f8f7327d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761005110, "uuid": "e457245b-a15e-4a80-8254-6c82d8da03e0", "value": "E36E7263122C4CEC3910E03719872BE3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8324b93e-ae98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761063050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063050, "uuid": "42e516e8-9508-4979-ad3b-744693cfb574", "comment": "Malware payload (Mirai)", "value": "c7e8de181eaececfaeb1a9a0088f299f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063050, "uuid": "5d15050f-2d07-461c-b90d-34bd656a8a61", "comment": "Malware payload (Mirai)", "value": "554f4e108a92e17781905b23d46cea26bd7d3496b5e9fa5a671b380bb441572b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063050, "uuid": "a2131e67-c7b5-4753-ad4b-c36e13050a52", "comment": "Malware payload (Mirai)", "value": "c8f1ea53402edf043aab01793fc07d314bee2709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063050, "uuid": "b9e36d9b-6279-4b2e-a06a-2b75f058f047", "comment": "Malware payload (Mirai)", "value": "a5f2f96c2d00982e87e44c95f96a12eb032de8312f67514cf6993f2c7cd7fde05c59e59bb3d826cf3e8ebe5a005ff82c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063050, "uuid": "af599104-e1a2-48d9-857b-91e0504fdb1b", "value": "T1D7B32A96B8929A21C7C6567BFF4F028E3716539CE3DE3203CD284F6136CB55A0E7A056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063050, "uuid": "d7998e0a-e9d6-4b2c-8d1f-8f997555ce5a", "value": "3072:Wbs7MH+t7kdsUqkcsLaUB+wFN98w6SrYyvWnqCmAbFG1CF4C2BAcfn0:Wbku+tAdsUqkcsuUfH8w6Sjvk/MW4C28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063050, "uuid": "df37b0e3-b486-41f6-b668-eeb01e05a3ad", "value": 114564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063050, "uuid": "7dc92f52-505e-4ca7-8d12-4dd7cad939c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063050, "uuid": "d842fe81-8d5f-43c4-bdfe-829a6e3f46df", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3b8a98-ae50-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761032117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032117, "uuid": "d108b852-e5ae-45f3-8b1e-7c09eb67da52", "comment": "Malware payload (XWorm)", "value": "f1acb1a297dbf6c90b24d1a8b635f041", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032117, "uuid": "7a3f33d7-a7a2-4214-87ac-c3271734ca26", "comment": "Malware payload (XWorm)", "value": "5620d362152320c8b3dff6f8f3cd009f4d68d3b994ce2b9a4fcc432d32ec919b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032117, "uuid": "b69f7b92-77aa-4754-bca0-7d711773d1c7", "comment": "Malware payload (XWorm)", "value": "afd64e0301763a301668f2b5b3821ec39cc19ba6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032117, "uuid": "f91be332-f0ec-4d20-8c36-5e627a2fcc29", "comment": "Malware payload (XWorm)", "value": "761fd81e38c15299378d4bf23ee6b872aa7d1496f688a333f4ff459b5e4e423bfd9127375e0f2e71797c9ae889292f3e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032117, "uuid": "eb8865b0-c426-42b5-9b0e-883ad9a32c97", "value": "T1A1F3E62A876BA8BC3E9B209278F737081C5C954F927137F797E584B52D00E6CBA0D176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032117, "uuid": "29ba09c4-c857-4c08-b765-0a7b23273d06", "value": "3072:U06NtFTtNebUXASOssYZkIxnw0mTo0OGyHA10wuswERT+BlhLBfq/YRL1D780AP9:X6N7TKYQSwYZhq0MVMr4/Mr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761032117, "uuid": "06c38597-9eb8-49e7-94a4-42db1001bb11", "value": 170887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761032117, "uuid": "7b221b63-357e-4468-bb9f-065a0c62adb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032117, "uuid": "cf56f619-6793-41ed-874d-520dac62e6de", "value": "Orden de compra y especificacionesdoc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ec4cf2-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761026123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026123, "uuid": "d57bda61-2ad9-4e93-a962-9a8b9addae14", "comment": "Malware payload (a310Logger)", "value": "6be0e02c1037eef2b08594d1ac7e2f7c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026123, "uuid": "a94a1aac-1a46-4566-b6b2-b00fd41a0864", "comment": "Malware payload (a310Logger)", "value": "57220f31383dfe2c794ea9afd290e138b9841b7899b8cd0e73cfe8550cf0dec6", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026123, "uuid": "7d1420e3-f9e7-405c-b54c-0bca6eb7f8e3", "comment": "Malware payload (a310Logger)", "value": "9d58eb21409d5917aac8538fed145240210a056b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026123, "uuid": "ceb20011-6960-4a57-8d86-a520cf381d6d", "comment": "Malware payload (a310Logger)", "value": "a86216323dfff98192de0ed46e96982c824aad81fb6eb07993407cd9a169e2c751e7fe8c4a103f646cbb0dd2ffbbdd19", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026123, "uuid": "af83a15a-51b1-4944-91c3-7c7cc77584f8", "value": "T10B0512586B5EDC12CCD14BF158A0E3722278CE4DE910C2079FFAADD7B46DE667C28291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026123, "uuid": "5f1b96a0-0ab4-423d-b438-9c7010362b4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026123, "uuid": "601ba52c-41fb-4ab7-aa85-4c739391426e", "value": "12288:xvBBf7BVlD4+g7HUjODWdGUgjmByjRUDACZPdDK83e1xLsPPnwPPoX:xvvf7BzD4P70n9c358K83e15EPnwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026123, "uuid": "be9db2f3-a953-43b2-b9ab-627169f1a542", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026123, "uuid": "95f38e7a-eb8e-4b3d-ab64-9215b36f9730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026123, "uuid": "f02e6c59-d287-46c7-af66-7445dba0bd08", "value": "IDR 173338 _FedEX 102125 884360941426.pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512f97f0-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761026030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026030, "uuid": "9e52bafe-c7d3-447b-9d0f-0d15a929e285", "comment": "Malware payload (RemcosRAT)", "value": "2d4b3389dc9521983f2ca72271b65a9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026030, "uuid": "7a497cda-a234-4a5d-ba2e-f9f3b419c941", "comment": "Malware payload (RemcosRAT)", "value": "5775f78e49d3cc327678941c043fb5df1f79183482fbc4782a02e811ba8732d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026030, "uuid": "750ebdf4-9d11-44fe-9a5a-f0f9c4f31e9c", "comment": "Malware payload (RemcosRAT)", "value": "2d166aae1eee6c91d36489c1c35ff5b668e8900f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026030, "uuid": "6cd5e14c-4319-43f5-a7a7-8a548749fc77", "comment": "Malware payload (RemcosRAT)", "value": "48408c3a82025aeeacdc1b5d8db4919f458f8a61e2860abcfee7371f4ebbf38d93dd7b859762ad04df044e773c3aa128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026030, "uuid": "e15d24c8-a6d4-4ea5-b88e-445d6cabdbb0", "value": "T1BE15230E1BEDC805E8A36FF62872D67047B8BCDDC460CA57CFDA1DAB7C2A5021265781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026030, "uuid": "9b584219-187c-4a59-af08-280737a381eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026030, "uuid": "c3cfde88-6ce0-40cd-88c9-77d69b1c76bc", "value": "24576:ZHAnqfwdM7RXCC9P8ROXXKiANSMHGuWHc4w3y:ZHAUIC9UROX6iATHb4wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026030, "uuid": "9742cb30-8a0e-49ba-ad0c-8972bec0d60b", "value": 901656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026030, "uuid": "5581a679-42d4-4e84-89e3-04d88b8fcd90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026030, "uuid": "98ebcfa4-77e0-47cf-810a-36a5a8b95a88", "value": "Order Drawing.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bdaaa8-ae74-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761047490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047490, "uuid": "1118ad1d-ec7b-414b-9acf-365e1a2beebc", "comment": "Malware payload (Mirai)", "value": "b5a7e1f0579e8a093ed29e0670c2cc9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047490, "uuid": "8e6eb63a-6d4b-472a-8eb8-fe28efa66a48", "comment": "Malware payload (Mirai)", "value": "579e089eaaf89f5b71ed6ac59bb8a5423639d8dac5d639c0aa1fadbefb58cc65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047490, "uuid": "1c592c6f-c3be-4c35-85a2-0da6060e4235", "comment": "Malware payload (Mirai)", "value": "2e2e4ad684f35f6dc9975c1d4320179482f85c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047490, "uuid": "78f66eb9-9abb-4fb7-a5f2-a64bd99959ba", "comment": "Malware payload (Mirai)", "value": "e89cd5a5971fbda37a1e9805579efe994c994b853eca0084f0fbea44529b16ec0026262e85ded8ff209f63b3a5011162", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047490, "uuid": "4c091374-61fc-4104-b7b9-c3898d44569c", "value": "T15E530886B891DA17C6D492BBFA1E42CC332523F8D2DF3217DD116F157A8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047490, "uuid": "e42bfe88-1b79-411c-b376-674dd46458a5", "value": "1536:Gmvd8ytmi0dq/fBMDzGGukGbvD55peY22JnJ8VR:Gmvdb2zGGsbLpg2JnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761047490, "uuid": "98e83fd8-f085-4695-a13a-957ac44719f6", "value": 63584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761047490, "uuid": "84dc0fba-1307-4674-868a-f080882da168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047490, "uuid": "220a77e3-b094-472c-b313-95cb7a4eb439", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93c5d62-ae44-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1761027117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027117, "uuid": "0ead1519-e8d5-4c7f-b15c-ce5728ed26fe", "comment": "Malware payload (RustyStealer)", "value": "e28c75f68f337b23c2306efe83756b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monkey", "colour": "#BB2044", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027117, "uuid": "a016a872-b64b-4321-b172-2a20ec93a916", "comment": "Malware payload (RustyStealer)", "value": "57aebadf554e03a405a30d8ddad8caa8cfe9fa86eb32f672066dcf63691481ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monkey", "colour": "#BB2044", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027117, "uuid": "6ef47f79-6430-4aee-983f-7e91ed831e53", "comment": "Malware payload (RustyStealer)", "value": "d3e54c4edd8cf6c06f73343efa9de5688e4386a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monkey", "colour": "#BB2044", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027117, "uuid": "60d553a3-4b0f-48bc-9dfc-88f78e753747", "comment": "Malware payload (RustyStealer)", "value": "2003499e4770b90f36b2f07be11d151c08379a5276cb2dab36cb33db0b8c2fe029f4909709e35cf06560ad46c0816807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monkey", "colour": "#BB2044", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027117, "uuid": "e4e527cb-7f2f-4169-b878-cd02ae710901", "value": "T154568E03E69449EDCA8FD638C69A5339F77538864232ABFB0994DB351E12BC28F1D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027117, "uuid": "c43fb0d7-2dc3-4767-a8c1-6553c059d0e9", "value": "1b8ccf92a5f1c9b8f0b778c468e762a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027117, "uuid": "57737634-782c-4829-bf40-492edd1a749b", "value": "98304:TqopOokWF+67yF7GQyRkQXm+c5zu7H+ph:TUlGQyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761027117, "uuid": "bfcc7ef3-2000-495f-99ec-f5891f4afaeb", "value": 6454434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761027117, "uuid": "37bbd88e-3745-4204-a4a2-9f39baf4c13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027117, "uuid": "952feb25-389b-4fee-abb9-9333017e2910", "value": "57aebadf554e03a405a30d8ddad8caa8cfe9fa86eb32f672066dcf63691481ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3f3b1f-ae35-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761020570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020570, "uuid": "535b97b6-859b-4987-b95f-ad561aef8681", "comment": "Malware payload (Mirai)", "value": "6e776342098684998d3668ac2313b922", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020570, "uuid": "d503736b-abfb-4f7c-b0ad-49ae91f78320", "comment": "Malware payload (Mirai)", "value": "57fa80c7f1bb5ef80570aa47ddab13b0098fcbfa02aa693704612f99b4c32745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020570, "uuid": "7c23f617-c2d5-4f14-b394-51e59bb4c080", "comment": "Malware payload (Mirai)", "value": "51286f67ec85a3dd4a83a5edd8cf5a512a98ccbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020570, "uuid": "ed73fbb3-55be-47a3-9c13-2a87e978918b", "comment": "Malware payload (Mirai)", "value": "0ec93afb7b06d14a04639acc19fa6e35cb73fe81dfa0ab6a2f945d84f1783564b1c6c28bf179b45da00bffd23d05326e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020570, "uuid": "eb63a0bb-2e58-4be0-ac38-3c46827897fe", "value": "T1397302B87B4A3873C59E2634DDE86F1DEAA95BE995853063E013087190CF0983DF85E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020570, "uuid": "d5195865-e347-4588-b124-7837550bd8a4", "value": "1536:yex20soVGpcfP7CJdBJBJlCMQ/YWO0nG9NwcYEQtlDRtLi:yex9sospcfTCRK8x6FlDHLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020570, "uuid": "d0088ea8-d745-4809-8318-51e73caeed16", "value": 75568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020570, "uuid": "d8d9fcd2-2560-4d5d-922a-c128d0b7cb00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020570, "uuid": "87b1a185-c706-43ba-be43-fd3a752066a4", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b15b60-ae53-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761033609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033609, "uuid": "15928bdb-8b06-4d7f-beea-c98029ecaef0", "comment": "Malware payload", "value": "057c058eedf67eed391c162734cf735a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033609, "uuid": "9039dba7-c2c3-491b-9866-88949142a73f", "comment": "Malware payload", "value": "583dfef1d2122735024bc458247d983a94e779b20f3e8538a487e0945b8d7b6c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033609, "uuid": "9de1c40e-d40a-449b-a01f-4a2a1eb7aa23", "comment": "Malware payload", "value": "b6c0934768f09dadafe00c94d48430cd25efcb4e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033609, "uuid": "db1da931-1af0-466e-8910-705e94066f24", "comment": "Malware payload", "value": "d7a60964657ebf974071a56991b39bcb6012c366535e3e00bcd3af908d3e140dad0f1736c80c053eb14de3770ffc9967", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033609, "uuid": "b443ef73-d125-491d-9cef-4f913f342cf5", "value": "T1B5916588B9C0B06C0B57F533266B7547970FDD915C1E8814F370F6E4B8ABA107A7EA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033609, "uuid": "7c3ddd5e-4736-4c75-97d7-6d79d6d8d7df", "value": "96:awxnmvGXWIZwANn1/b4X/9csL4xQoDlXNY6e9N6M:awxiYXb4X/WdQoDlXNno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761033609, "uuid": "55d20582-575b-499c-b7ec-6d6c25992ddc", "value": 4419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761033609, "uuid": "4bd69c42-bd19-4fcc-a433-dfa0606b9eb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033609, "uuid": "217e473e-383d-4ab6-91c2-c3ad6136dc56", "value": "rOrdendecompra_9901266_4409961.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcf3de1-aeba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761077698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077698, "uuid": "47741637-7fb5-4af7-850a-6dd3794368ca", "comment": "Malware payload", "value": "67810622717b5206a19fcaeafd891296", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077698, "uuid": "fe6e6617-beb4-4513-a88c-7abe2574e2a9", "comment": "Malware payload", "value": "5a00704a4a1458103b4d603082903b42ef8449e1aa669bcee8417991ccc472a3", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077698, "uuid": "111d5ba1-e087-4f4b-a0a1-4cbfb4c02c94", "comment": "Malware payload", "value": "d523faeb4950d0bec8093b0a1db117e700b3699d", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077698, "uuid": "0916e499-ce1f-480d-9a2a-9446ebb28520", "comment": "Malware payload", "value": "68e579fc79a679f78fd4b4bb651d617e49d3b1e3aeb094bedf70b53d613c487f5a26c48d53db90a83f27162a7b5053e3", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077698, "uuid": "1d9969ad-e926-4cd9-ac6f-941d68146a3d", "value": "T17DE55B336CA0589DC46AE274C5A271917A387C486B3223D32E40F7FD2EF26E44D7A795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077698, "uuid": "bcd8564e-b4e8-4a02-9058-51c68a86a8a4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077698, "uuid": "7a93bd22-1c38-422d-921d-08ea225c1f79", "value": "24576:CKAYhZx349zp5oZmb7jGEgGqdXuQLvt+YBFr/alA9K9wG6HPqjn3pgPrRNSzjzM:CVYDxQzOq7jGSqdXxLvWlACQNrUjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761077698, "uuid": "936a7d94-32b0-476f-a1e2-54fc1f161919", "value": 3101752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761077698, "uuid": "8d0aaea2-57dc-42a7-ba53-9c781e8a340d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077698, "uuid": "0aa49299-bead-4a92-a686-d5724bbf6d8a", "value": "NewtoolV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403154d8-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063797, "uuid": "83edde68-518d-4bdd-b2d4-9bde0287bd7a", "comment": "Malware payload", "value": "fc0ca751522a55a5b1a4b7f7dae245d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063797, "uuid": "7f846922-d62c-43d7-a324-a5d744fe9b97", "comment": "Malware payload", "value": "5a9db766c00002ae78f50900d689e47ac28b30f83891cc112e08638931843ec6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063797, "uuid": "b79939be-5358-43c6-ae7b-354636cff022", "comment": "Malware payload", "value": "020ed6202b3f709fce59356ee319b3089ab0491f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063797, "uuid": "befdc813-13e3-4a09-bac6-fa727c8a18a6", "comment": "Malware payload", "value": "53a432e4a667b65a8e286443082c7979db9caa9f290b32fc411e3931962be8dcbebd89353b7c55f535648fc520d72456", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063797, "uuid": "08a332de-2e59-4750-a48f-a34734f2e75d", "value": "T158A3E91D0D5FDCFF90D42B5BA70A38D4B0088A675341A28D0AC5BE46A2AEE4D7E757C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063797, "uuid": "f27452a9-8c0e-4634-a39d-c3558589b54c", "value": "1536:GDB7eKg20lbTCpwUEYIgl5BxVKI7wbvJIgTsKI06gk8oNqZ10eDMp1Aw1/RmjUqW:GDB7b0Z0w7CtC6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063797, "uuid": "3a5c33dc-f97a-4a12-8a82-c01741eaeeb9", "value": 103956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063797, "uuid": "96752811-172e-471a-8318-57c0e9a78619", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063797, "uuid": "e9c83af0-5a31-43e3-aea6-b926e67a0576", "value": "invoice-1637482117.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a365130-ae95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761061586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061586, "uuid": "fbf63315-d71e-4d77-a77c-e735193cab06", "comment": "Malware payload (Mirai)", "value": "7ef26bcdc51cb206cb14ae2b4216c606", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061586, "uuid": "09ca6860-67d8-4c9d-8625-e99237c65a7c", "comment": "Malware payload (Mirai)", "value": "5b063a07087d17740315aa96ca1d2a88965818f0b786432655b4c9ad7272ef7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061586, "uuid": "a44bafcd-27bd-4d12-9740-b988d07d482d", "comment": "Malware payload (Mirai)", "value": "fbcbc6b42ab721078f1ef3e765db801d8d3b16a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061586, "uuid": "2ac411c5-604d-44d6-89c6-31c92669f749", "comment": "Malware payload (Mirai)", "value": "9f4272748e6db83b710208aed0da47184c4e2d518ccc5243e41f76cf79aa16948e84d25b9ec31dcd8d2a038089b4b729", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061586, "uuid": "5e5b9192-c552-4a32-9d0a-59ea89e8bb58", "value": "T12CF090CBE0523B8748D0FF4AB1755D04501AC28669DA9BDEFDAD30B949F4508B272F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061586, "uuid": "bd757786-c31b-44e2-a21f-37ac7fee0e74", "value": "12:tzwcotPohF6tUlUNNIl5Et70c0LK26tvsleb6t6pGNdLtZ:tqqhkO6NNI7E6fK26Oeb6g8NdLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761061586, "uuid": "162532b5-9296-4400-8282-9937cabacb9c", "value": 535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761061586, "uuid": "f375d41e-14cb-4bb7-a479-03eba653ba71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061586, "uuid": "737a12b6-eb5e-4d34-b890-133e17d39e2d", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ee0a92-aeb4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761075275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075275, "uuid": "1295b8ae-f76e-4783-aa80-3a9b9b2c5a92", "comment": "Malware payload", "value": "2b822191ef038a36e83ed4e476cfeac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075275, "uuid": "53461b33-5f6f-4ef7-9ecf-04cd6838dcfd", "comment": "Malware payload", "value": "5b0a6bf668ac5b5d4e585f0a9531fe1a4c49b8b56a8a9a940d0ccbbabb9885de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075275, "uuid": "c4b4c074-6519-401b-859e-7ece4317607b", "comment": "Malware payload", "value": "c0351708f9a582d0d1f755352f6a7b8563cf5609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075275, "uuid": "b8ccf949-c9af-4c3e-a217-24108fa1edec", "comment": "Malware payload", "value": "4819db586b9ade7864938f3fa97221603b9a0f72fd1d608c2ffca96a7a932a5e6e5f66917a54c9e0daf02843ea20a684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075275, "uuid": "77819404-a361-4dac-b95c-e8fb76de592e", "value": "T112564BC3D66A8285C038F07953E7AA73A6F07CBE893173BA5BB047121F55B54EA1C316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075275, "uuid": "27042ded-831b-4069-811e-4319e082580e", "value": "564196bbf4e5391b10b64e7254d46f39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075275, "uuid": "0a92e097-dbf1-4b25-b87b-a075e9188440", "value": "98304:/sXeKhAWTWasmuyhByAWvcO2n+NKGvOzRJz/Zsbyn+:/xWTWiuyqAW0On/GNj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761075275, "uuid": "e652e758-6858-482b-8b96-765c1e762f63", "value": 5998080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761075275, "uuid": "4c7efb22-cdd8-439c-92e2-925c87e4a434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075275, "uuid": "1da02945-e44f-4aa3-81a3-cc901292af48", "value": "SecuriteInfo.com.Win64.MalwareX-gen.86483983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7432f1-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064056, "uuid": "ef45028a-e119-4841-9085-ce22318b47c3", "comment": "Malware payload", "value": "f686da5fb6408e96920d5c91e8b1fbee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064056, "uuid": "854b5611-bb36-4bfe-872d-b929b8a29277", "comment": "Malware payload", "value": "5b5931f5e9d32a055ea137ba1ad53abe0d86a8c8946fdbc8a2ad2230853dcc3f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064056, "uuid": "907f29f7-66fa-4081-b7c9-1d691c6ed3b7", "comment": "Malware payload", "value": "d47f7c9076fa3bfa49ffb7d42e1add7b163b958e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064056, "uuid": "eec2652a-7821-468c-b622-3af04c760f05", "comment": "Malware payload", "value": "3936b2b9a0a3cab5a83778901def32f5dea0489891e1d2aadd0f79e63df1fae1215b91bfb204417264622f0ae37b3c4e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064056, "uuid": "b2da3e07-60f5-40a1-b6a8-feb8370e4597", "value": "T17EA30AD88F76FCE448EA0682658933F3CC925D1C18D8D281DA9A6F36795CF60ED660C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064056, "uuid": "54ddf74b-2397-433d-97d5-801ae4e46f5e", "value": "768:GDhd0i7J4sYKgY/CMNfWd57Rq8iqWmodgksEguxCCdn1Ug1poRhmeBrX3k7crWhe:GDB7eKg20BrXryCHUeAU6L6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064056, "uuid": "b707e88a-43ca-4156-8fc5-320ed7326340", "value": 98182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064056, "uuid": "ef475ea4-35d1-4e79-b438-638c637dee01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064056, "uuid": "7ed092cf-def5-4b28-8d88-48808c8d5908", "value": "invoice-1637482117.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befb58bd-ae29-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761015476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761015476, "uuid": "bdab074e-7649-4cc5-8b50-98f0fe257571", "comment": "Malware payload (Mirai)", "value": "e7ddeccd02b06e64cc851f96c53b2df8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761015476, "uuid": "cc20be33-6ea8-4586-8cb8-7b979c5e6db8", "comment": "Malware payload (Mirai)", "value": "5b8a84355d3b3a172f353b3cdca9ac2500682a6016a8ba0dfc51505d112d64c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761015476, "uuid": "c30de544-bdcf-4ed5-9319-29038567d36a", "comment": "Malware payload (Mirai)", "value": "973bb306f2e7fa36e259c48285f80dc5324f8826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761015476, "uuid": "de234178-d6ae-42b8-8834-1fdc70327b2c", "comment": "Malware payload (Mirai)", "value": "6888c81aa7ef59c63e6d42260bbb92129f8a97fc9e8145d5f7d7e2ccb4034afba487f8d7af913a258aa20fdf1989df97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761015476, "uuid": "3d27b9b6-b798-471c-b231-7fcc64469e35", "value": "T1AC03E130C1B81E09DB785EE99C9CC6B4FB5789A956F2CCD16A8246914DC8413325FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761015476, "uuid": "b9a3ebf6-e921-4ea7-a5c7-23e12ca4c8fb", "value": "768:jBexhLPVFQunegbsPGQEr0IGSARATrfHzGb/JK6l4uVcqgw09A:Q/V+unxbsJEr0I7TrbGbY6l4u+qgw09A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761015476, "uuid": "510917fa-950f-47ba-be07-51da56abc685", "value": 39608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761015476, "uuid": "37806135-dc62-45b9-8d3a-63376ad256e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761015476, "uuid": "cfee0f43-cddc-47c3-8853-38827ed6d4c9", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3e4ae8-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063929, "uuid": "f23bf46c-7a7b-4d26-8fd3-ab42d6db4d05", "comment": "Malware payload", "value": "fcbc28dfe8bd6dfe8f0bd2dfff9e2fe5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063929, "uuid": "fbbb604e-ab7e-4208-89a2-0e82ce7a2a74", "comment": "Malware payload", "value": "5bbb762e089097ca0c5d70b0da720b20ac77e0abe5ee078782b530abff3856c4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063929, "uuid": "9ff5545b-269f-4711-96c6-f00a39b2f4fb", "comment": "Malware payload", "value": "d84fd198d49ad18d7662667c0085cef77eba634e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063929, "uuid": "c039ed38-ed41-4930-90b8-28f8b38080ec", "comment": "Malware payload", "value": "f1227e125f332bca2d81bb2d58a29eee503eef657345806b406bf0b9416666a1ab27efb8773438917ae43f69f8381d9c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063929, "uuid": "aaa9296f-7510-43e5-9e84-49313f3b8008", "value": "T153A3FAB25DA3DCF500A076A0BDF817B8BEF4E5270118144B2946BB3B91D7B543AE25E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063929, "uuid": "2a67f862-78b7-44a0-987d-c6233b4e30ef", "value": "768:GDhd0i7J4sYKgY/CMNfWd4JPrhSxGrX86rmmt2F4HuDrIqAV3U6Bw1SLAuAAroQD:GDB7eKg20irHrmmsxTAnK16BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063929, "uuid": "68264fc1-30ac-4f59-8440-927d17837d1e", "value": 104061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063929, "uuid": "05d37d4a-2dd0-4b81-beb0-6f9dd6c1b193", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063929, "uuid": "529ff8ab-1274-4a04-99d0-12fc29d99e55", "value": "invoice-1637482117.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863b09c7-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761026119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026119, "uuid": "6461b400-b24a-4d27-9ed5-29588cec7469", "comment": "Malware payload (PhantomStealer)", "value": "245a805c3bf70f78d5d88b4592ff4c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026119, "uuid": "016d1189-f25a-4c83-8824-2d7b2d061587", "comment": "Malware payload (PhantomStealer)", "value": "5c7e1748a2ae4b30582415c1d9ca76542871c68ebc9e21f8772259d365675dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026119, "uuid": "967b5b94-0450-413f-861f-a7f9ee61eeb0", "comment": "Malware payload (PhantomStealer)", "value": "9732bd8724965acd5becdcb36c70d55b971fc3b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026119, "uuid": "dfe5a87f-eeb9-4f60-b0da-270d6f64a9e6", "comment": "Malware payload (PhantomStealer)", "value": "8bf8d7515b4368cd4082c9fc3c6394317bd4c5031687136f7526c5d58ade4998370baf441c361a63cd9c733f0ef697bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026119, "uuid": "be7d6655-512e-43a4-b924-5d254fd2ebea", "value": "T15145234DB62BFE56C72A0E77D81724468BE5811BF422F2A724C819F90F26B59C41BF43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026119, "uuid": "279428e5-7756-4917-ac8d-52e889050011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026119, "uuid": "c0d21662-ce74-4ea4-83e5-164359f78082", "value": "24576:q3fIG46GzSjWmXzwBtPiXZr67mr/3X+Po/YkdW8l:I+668WmX0tPIFr33/ldN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026119, "uuid": "6d3909cd-62fb-4e61-8eba-6624250ec589", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026119, "uuid": "44fab9c2-e68f-433e-ade7-08fb649f4be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026119, "uuid": "fc108ba1-c38b-4f0a-ab14-285633a62269", "value": "Ziraat Bankasi - swift mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277ebeea-aea7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761069339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069339, "uuid": "01b4ff28-94b7-48f8-b639-2964f40cc043", "comment": "Malware payload (Mirai)", "value": "a89154c6e8b15edc3d41bd07f9be0045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069339, "uuid": "06d5b5ff-b6bf-4286-843d-83df8ee7611d", "comment": "Malware payload (Mirai)", "value": "5c9ce7bf7968824ff91399b8849217c0d6bbff7e572f665ae2de6d67c414a606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069339, "uuid": "82093756-e026-44ae-83dc-b73659ce399c", "comment": "Malware payload (Mirai)", "value": "e5c2c904a74735521bec1f75c27172da868b8bb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069339, "uuid": "cbc20d7c-0219-4b04-b7a6-a5d8f8053acd", "comment": "Malware payload (Mirai)", "value": "d9c29c9108339525c0af15a95f24146d43887251115e774fa188a2dd993d2ca4af091897b829255f382516fe8076b015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069339, "uuid": "68d70628-d79c-4744-a098-34a4b72cba2a", "value": "T1FFD33A17B5C180FDC4DAC1B44F9EF53ADD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069339, "uuid": "698728ce-aa11-4ef7-b641-3f5ca200f692", "value": "3072:tGtwnNiaOnUTmFiPT9OSQ7AOaogjV2iZlBWCgaiAXQPdL:tGtwnNiaOnUTUuLyCXQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761069339, "uuid": "d583aa4f-6a0e-4af2-bee3-fc4d6fb8189d", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761069339, "uuid": "b1f758af-1813-4c24-b8f2-80ad0df4b33d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069339, "uuid": "725b0d4c-b1b1-4e45-b0d8-1202a9c126d2", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8b069f-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063979, "uuid": "2897200b-7191-4c0b-bfd2-f10c7f8b0d07", "comment": "Malware payload", "value": "25e3d64b78e9802987fe180b918f47ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063979, "uuid": "e976b862-50d6-4adb-bbd1-75e5ba5cde26", "comment": "Malware payload", "value": "5d37f80593619a2595f6f439a63d4dd0a75bbe52f766ca49b7680f4ae885ff6e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063979, "uuid": "09343665-7fd8-47e6-930b-523747530187", "comment": "Malware payload", "value": "aebe4ecdc5e87ca0b6c36ba59569dad53bc5135f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063979, "uuid": "20efbe3e-becb-4b90-9ae5-e787a88bff5d", "comment": "Malware payload", "value": "5d2e384f7506a9fcd9c793ed23513a0648edcf29bf4b47436adff498d8abb746af01a20dc47fed09b989d4146ce11558", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063979, "uuid": "b0e3eca0-0d35-4140-bf9d-065c6d3cbdee", "value": "T1CBA33D580DD3AFE481F0F7A05BCC24BA568669A4C57BB298C443FFE23498C40DD6A2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063979, "uuid": "b17e0051-0667-4a99-b086-a83ff7f96548", "value": "1536:GDB7eKg20lotyrCrdVV+YLTYWsA9VGA4S6BkQWJ+aY:GDB7b0lotQwzV7LTYWxVGA4S6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063979, "uuid": "a7fa3290-2aa7-49e5-8364-6db597816ccf", "value": 106747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063979, "uuid": "9ae5e5cd-bf54-4278-9415-f1978c134c21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063979, "uuid": "af8c9c0d-d775-40b4-8212-1d778990b40c", "value": "invoice-1637482117.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2d629e-ae9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761064973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064973, "uuid": "faa758ab-59d6-4a57-96fb-cbe55bc60976", "comment": "Malware payload (Mirai)", "value": "f6d13e0790fc6e4cdcde2d6ef7c3da16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064973, "uuid": "cc7dd2ea-6475-450d-b1ac-0bb22bd2d275", "comment": "Malware payload (Mirai)", "value": "5d9f54e2f7cd72723157a275d0434e7b85738e9b3cfd57124b28e782732e3f40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064973, "uuid": "10e7d3c9-83c0-4d79-9519-486721e2d309", "comment": "Malware payload (Mirai)", "value": "378e41f79543bcfca0282367d7e52d45f21d10f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064973, "uuid": "a4f422b8-5e8a-4409-9e40-34d224c38548", "comment": "Malware payload (Mirai)", "value": "d91a5807f373c199a0118dd04cdec94b8d37ed311b77319dbbafad7fd59500b4ae079ad74e789663a2b178483ec8fc1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064973, "uuid": "da50fc31-b878-4e06-a308-1144c4425ca3", "value": "T1C9042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064973, "uuid": "f64242e7-9195-45f5-84e2-58ad7533bd96", "value": "3072:O8/WszhjlvbAmfkIaboVSyckpj/HS0BpCi/hJjogM/REC/HV6:O8/5lvlcIaboVS7kVdBMi/XMgM/REC/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064973, "uuid": "ae14bede-e4e4-4d6a-8856-3c4cae424327", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064973, "uuid": "b0fa9294-f46b-4c03-8905-292bfd95117f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064973, "uuid": "bd568511-2ce2-4c5a-9208-a15fd45e395f", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8405d498-aeb7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761076366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076366, "uuid": "6723c6c8-a385-4047-a930-bd6c4e5cd2cc", "comment": "Malware payload", "value": "73a7eb1c172edcbb3e8575d3590b5cd0", "object_relation": "md5", "Tag": [ { "name": "85-239-246-89", "colour": "#1B9C4E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "kapbom-site", "colour": "#015DA4", "exportable": true, "hide_tag": false }, { "name": "petcasalove-site", "colour": "#C9028F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076366, "uuid": "eb70174f-b109-4437-b43d-650dc31702e4", "comment": "Malware payload", "value": "5e15e3482e03afe13521eee413031b0e09e660cc40a6a370b7934c3979f0d625", "object_relation": "sha256", "Tag": [ { "name": "85-239-246-89", "colour": "#1B9C4E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "kapbom-site", "colour": "#015DA4", "exportable": true, "hide_tag": false }, { "name": "petcasalove-site", "colour": "#C9028F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076366, "uuid": "4a078014-a5fc-4cc1-9e2c-3c162a7667f2", "comment": "Malware payload", "value": "3cc6e61c4a13041839348d6119a451396ec6c9b3", "object_relation": "sha1", "Tag": [ { "name": "85-239-246-89", "colour": "#1B9C4E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "kapbom-site", "colour": "#015DA4", "exportable": true, "hide_tag": false }, { "name": "petcasalove-site", "colour": "#C9028F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076366, "uuid": "ffb9bf7a-ec72-46e8-8a74-e594b9aba3cc", "comment": "Malware payload", "value": "7e11be26382922842c72e968cdf14a7c22810f9389c8b18288a3fb1091d7e8745290ef6c6e145cfa18ec7ccc1c3cd887", "object_relation": "sha3-384", "Tag": [ { "name": "85-239-246-89", "colour": "#1B9C4E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "kapbom-site", "colour": "#015DA4", "exportable": true, "hide_tag": false }, { "name": "petcasalove-site", "colour": "#C9028F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076366, "uuid": "6a7f322b-c149-43fd-8bbe-40ee3c459c17", "value": "T13A36A021A507302ADCDA0E35F636E63ED83A7E222A014C1FCEB177BA89355BB153515F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076366, "uuid": "5c050233-9da5-49c1-90a7-1bc075a6f7c6", "value": "4f96ad730bf94bad8e3b5396e2409c32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076366, "uuid": "5d905ea5-4850-4fa5-bfdc-1ffd89de339a", "value": "49152:hRp7NJqGjs0dSSjKGG9ZFJa6HzzTPAaZeDTYszE9:hH7Nx42GdJaGzTPAkhgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076366, "uuid": "0af6cf46-5099-4705-8aaf-db3f0b534afe", "value": 5003269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076366, "uuid": "d4c388a8-71b1-4d28-b667-bf7c505d9245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076366, "uuid": "a5b192f7-610f-43b0-85cd-91fc53a1319d", "value": "5e15e3482e03afe13521eee413031b0e09e660cc40a6a370b7934c3979f0d625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc55460d-aeb9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761077320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077320, "uuid": "e360818f-0a01-4801-9031-cc0a8af5074f", "comment": "Malware payload", "value": "5f139ee6184b3b0ff5362a911c48c434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077320, "uuid": "d19c10b7-4875-4f92-9b43-82136b09fb09", "comment": "Malware payload", "value": "6079d1475309398d70f906987d56000539bc3ba0247994899ae2e3a497c99b77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077320, "uuid": "a8ae01eb-4128-44a9-b3be-85471909b072", "comment": "Malware payload", "value": "5cbd3e21fa4adb33176c5817fad0ab3cfb64f484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077320, "uuid": "330c10c3-b5b0-4333-ace0-ac15db3416d5", "comment": "Malware payload", "value": "6566ed4e432a8accf01e3368fb0a869c61fbdd7541bafd2de3788a87a03408acb6a2382aff75640951cc81a9cb333e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077320, "uuid": "de641b23-fe3f-49e0-9961-da7ce8263d4a", "value": "T146283356B2FD01E8E47AC17CCA6B5617E7B23855172097DB12609A292F37FE06E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077320, "uuid": "f5c2cd6b-b9e9-47d7-92b1-d174910edf16", "value": "b5d3ce44460b794187f3e238adc502a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077320, "uuid": "fda38301-6838-4932-b10c-2b38f93b5151", "value": "1572864:K6Za6u82Dzj2TcuzKESW8jdLDvPwvSzE80f65h42/7/spjClDp42fGzA+e4iUT2K:K6L2DefWESX3waI8e65hZENClrTpip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761077320, "uuid": "3e53fdc5-dcab-48cb-afea-2c29fbc715c6", "value": 96630437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761077320, "uuid": "235e051d-fe9a-4805-a375-39574a4ebb15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077320, "uuid": "cb90aa30-7014-4da7-b334-d4a9d27961b7", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ffe84d-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761025737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025737, "uuid": "0039f48e-8215-4be5-b0d1-da45cc88ed12", "comment": "Malware payload (PureLogsStealer)", "value": "cbf7f8640b8af5b55354220e087fc55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025737, "uuid": "7a08c416-7648-4495-9b1b-f761f727f175", "comment": "Malware payload (PureLogsStealer)", "value": "608b5cfe8d87744944b7ebc3c50d8f4dbb10da03fafe0ac5bb7a3ed7ce4f5561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025737, "uuid": "22a1c2a2-ba8c-48cf-8aa6-0f6cbd486837", "comment": "Malware payload (PureLogsStealer)", "value": "0f70eb7ed0456b2764d0f1cb4c44374f90164948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025737, "uuid": "7e9c1525-1dec-4795-a154-a5ec55bcd136", "comment": "Malware payload (PureLogsStealer)", "value": "ecda629d80ade84e7cee389841bc65b313c0b7fea15b7ed7e7f2b85120ef88ee4ade468a1ba5a0321a31dca7763fe34f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025737, "uuid": "5096e318-f051-45c5-85a1-b4cb63d3189f", "value": "T1A68501297384CF51C12F0572D4A696F89737EE10DE02D3CB25C4BFAD39B67AA6A51083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025737, "uuid": "13339b37-a198-4eae-823e-3fc4e0aded0b", "value": "24576:loE3TRmq8akWzOKLfyXvuX6TY/FIX2pXWqsosC1NqN593cnXF5MDokF:loEDWIKKzavuXnFJuo1sN33cX76oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025737, "uuid": "0ef8d9bc-2ca0-400f-b320-331dcc1c2f47", "value": 1773472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025737, "uuid": "31ea9791-ee5d-4c2f-b5f0-04a343f24b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025737, "uuid": "7df59840-ad67-4566-96fd-be125283c6e0", "value": "CE510697.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc7abe3-ae66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761041647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041647, "uuid": "29243aa6-afaa-4019-9e08-1884f0409dc8", "comment": "Malware payload (Mirai)", "value": "f8378190d54c3e03f4660fbf0539d6b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041647, "uuid": "ee17b84e-a690-44fa-925a-b94b3d0283bc", "comment": "Malware payload (Mirai)", "value": "60ff6d5493d80fa7fdf066932949a90d144dadb9de5c440abf19fe7378cac53b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041647, "uuid": "67141d0d-eca1-44c3-99bc-672a4d397721", "comment": "Malware payload (Mirai)", "value": "2791c1bf3b89a6850a2b789121b931aaf2d4b9b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041647, "uuid": "7d792db0-61f7-4c6c-8ce1-2b2c87332f19", "comment": "Malware payload (Mirai)", "value": "1f2b8c07dc6a156fad473382f2bb04edea91b5ab3d8c6905edac60b65bda4ceb466fc076060cbdd29eae98592d7a4716", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041647, "uuid": "1485f8d7-09d5-47f5-8292-cf69cc08ffe5", "value": "T162C31945FC415B23C6C612B7FB5E428D3B2A17A8D3EE72039D216F60378B95B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041647, "uuid": "1d846de6-dfe1-4bd8-af57-a28ef5939909", "value": "1536:JCDwI4fG50nVg/QDEh9+19jAd424V8G2TTZtt1qLj2x1buddLqlEmwyw6FPRbxG8:MDwLYhQDy019jc4r2/Ztt1qYbu7wSbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761041647, "uuid": "1a340aa2-2640-4061-ba07-117c45d7009d", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761041647, "uuid": "14af3f18-998f-47c5-8e2c-bc9d90b84128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041647, "uuid": "79f3412e-a687-4ca3-b95e-9674eba06a47", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54b0d80-ae3e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761024453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024453, "uuid": "90f28ea6-d4fe-4eec-bb2e-a635deb52e7f", "comment": "Malware payload", "value": "c430f7829402c94d6d5f3c240492d151", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024453, "uuid": "86248858-ba1e-4698-a19a-f3bed8100e68", "comment": "Malware payload", "value": "6155f49837bf1a1dc47d612dc1f4b41e6a0fa315f7e968afc8e93fe958f64029", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024453, "uuid": "027c2e1e-ac11-4fb7-88e4-07e11e5003aa", "comment": "Malware payload", "value": "f729901aa35c5ef84e437ab78750420e823adf2b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024453, "uuid": "4c78a57a-ddf6-4eff-9433-21e2b177eb60", "comment": "Malware payload", "value": "2577c1865200e0b6d61288d0c16ed2b5b968f0732c6a444622ba4135c139a94b03835650dfafb037d421220cd4c45462", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024453, "uuid": "12b96974-8a56-461b-a981-07f6f29c5e7c", "value": "T11546D137A798011B05A2476AF00A6173FE7FC463874D86A5D88DE22D358F4EF817E6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024453, "uuid": "a15bfb3d-97e7-4a4c-8fae-cf600339fb8c", "value": "49152:h2RL9r6KdBEs6eOgkfUYmSOIiSpttYMZ9xHWffEBkd2kN2qAQ7nH3llIGzdff+mP:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024453, "uuid": "f19ba269-f5ec-47a4-abda-2d0d6176c150", "value": 5724095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024453, "uuid": "7182b05d-7e5d-4465-8d8a-8739adede86c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024453, "uuid": "2a4a1fb1-3fd6-4058-a175-a0b148979c0b", "value": "71763_-Vis4FH8ualizar@_4700269070CN6OG.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f697e688-ae31-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761019006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019006, "uuid": "080fb182-4ec8-446c-a89d-b7c441f4fc48", "comment": "Malware payload (Mirai)", "value": "c0850dd0a90a1a85e72e998e9f6110ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019006, "uuid": "8686741d-ac02-4d60-bc84-23aaeef6e5c2", "comment": "Malware payload (Mirai)", "value": "61fcd4e53ecd4ca6edd447ae108d74b70a64feb02c94d684bfc35efe52f84975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019006, "uuid": "6d725400-b1fd-416d-b502-bbfb87ff2a3d", "comment": "Malware payload (Mirai)", "value": "e9a563de1df06a7cfdbcb768a30309155698f62b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019006, "uuid": "6203dbd1-27ac-42d8-a534-717c6af94728", "comment": "Malware payload (Mirai)", "value": "dbe9083f75a61d338c60fe81c77ec89210e00ebee096fd5394bd2f30fdb2b914cc37920fa4c03ad88dd1ecdbd2670992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019006, "uuid": "d285da5a-96b6-4367-9063-e6b8c648083c", "value": "T19613E1CD25B674DDCCCD497738B81A7A04AEA4D0512C97DF86224C8D7B338DFB11946A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019006, "uuid": "233bf535-cb60-4784-8dbf-2d9217f68806", "value": "768:dZEog1cZwPSEy0A69lVvoYgEy0CIIwNud3C/33fFkFvv6GOnGJTG7tPFWtJ:TRHw6MS0/Q3+3vFIHk7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019006, "uuid": "25989a63-fa3d-457a-b201-442dc3840e3e", "value": 43784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019006, "uuid": "b838f252-3f23-4977-a309-d8c6fee8f01e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019006, "uuid": "db93729c-e0e1-4e62-85c7-91f67a129077", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffac48f-ae3d-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761023880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023880, "uuid": "b4662bad-e048-4dfc-8b82-fdf08d5e0d34", "comment": "Malware payload (SnakeKeylogger)", "value": "1d0f5279dfd56010d57115f68a97f7b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023880, "uuid": "aeca4ec2-6a15-4828-803e-ea27b257729d", "comment": "Malware payload (SnakeKeylogger)", "value": "62ca155077bc6ca7ca2e140465b8c3827545bd8dd2a83a0d67e904bbe600932d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023880, "uuid": "7a3f3ac5-4c69-45c0-a20c-aec65ed22fb4", "comment": "Malware payload (SnakeKeylogger)", "value": "2f352bd6063444691bf2fac2624d7a21c60459c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023880, "uuid": "ed3fe933-bacf-4205-9d44-cf0774ac0e29", "comment": "Malware payload (SnakeKeylogger)", "value": "55425bc3ae0bd5e88c89dde701c547a80f776c87ec043cc559cfbd81213a6548ff092e608dbe1fd60bc1e109b584a994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023880, "uuid": "75294c6e-2689-47a3-8b5a-8155c83f50fc", "value": "T18DD4014D2B5FDD12CCC157B40DA0E37216389E5CE411D21B8FEEACDBB5AAB66291C2D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023880, "uuid": "59d3e273-b6dc-4510-ac29-ca12ac1d4d9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023880, "uuid": "0806aeed-2891-4478-abb2-24ea97bf529b", "value": "12288:4BBf7qk70FYWxDgXmkftqqHUpNx4SAbsJR5jKuck0YWKs5w2WdcCn:4vf7qYIYhXblHU3xqsJDbck0tfw2WyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023880, "uuid": "3a038ed8-97d9-412d-9e2b-07a676edf5d9", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023880, "uuid": "caa5eaac-9b3f-4693-9da6-b548d4dfcdd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023880, "uuid": "9c2f6d3b-5ff9-47f7-8ace-a02749c1b2e7", "value": "General Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0425ffef-ae4e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761031054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031054, "uuid": "4e3dd3ae-d933-486e-a35e-91182a7bcbb8", "comment": "Malware payload", "value": "45d767f216ae90d13fca90dd2c392a0e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031054, "uuid": "eecc6eee-f9de-47e2-98a7-2d8225c6de06", "comment": "Malware payload", "value": "6343c9a125d560a33d2bb50b49266f37e738a9f74bc98b48938378def468b99d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031054, "uuid": "6df09961-81e2-4c78-92fd-ff143cfc0e10", "comment": "Malware payload", "value": "00888872b6c217f49bdca68d52fcdbb99ce8b889", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031054, "uuid": "33f0d7ec-cfdc-401b-a3cf-ce3789d516cf", "comment": "Malware payload", "value": "0adec9aec8d306397c0c3aff2f3ff89bf3d480fef43b1ff2e6802c7a7e4b091b7818f5780a7cf593a56c4242f595ba67", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031054, "uuid": "127c818e-e79a-41d3-941b-1a2d80c5b186", "value": "T15A0175CB1E744343C43A637438281239AD6E7568DCC1924F342761E0E6CE5E1BD71888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031054, "uuid": "8e6b4c0f-5703-42fa-9273-bcfb64c1e85d", "value": "12:5JvC2YuGpSG6GcM0lhUVFN1lFV4UhKyVwdwkBHXm53HO+8RTzh0F8Kxn7DvCh0aS:dYB7r0XUvnlFVVidRBq3HO+gx0Fhya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761031054, "uuid": "89cf3e9f-5677-4a9d-9faf-00deb7dd2a03", "value": 798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761031054, "uuid": "0cb3223b-4688-446a-babf-6253e5846c72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031054, "uuid": "dbc6cd87-0b2d-4600-8d20-ca9855ef3df0", "value": "walmart-money-24-6-32-EXE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43461cdb-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761063802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063802, "uuid": "f80775a4-ad7b-479b-b8f8-c55529040334", "comment": "Malware payload (Rhadamanthys)", "value": "40ccd0e4cb11cd1f2051ede25647eab8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063802, "uuid": "ff8b068a-886f-492d-80eb-ec5bf642f79d", "comment": "Malware payload (Rhadamanthys)", "value": "63d5984ef332585955c575457bd54af037361cf50b91032b4b2dbb4dc47fe829", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063802, "uuid": "27220455-f852-4b86-9ac5-f6d4a6d52e92", "comment": "Malware payload (Rhadamanthys)", "value": "72e802cb54edad82ad5f25c95c74ec66a9007cba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063802, "uuid": "77b14d01-e5a3-4e8f-ade7-dda2766e531d", "comment": "Malware payload (Rhadamanthys)", "value": "317b47858f4bb89cbbd8c171a7b1b81a5a0d37102bab1041a792ed9dcd2c5e1137244e5450b63d90fb0d4aa829cb6849", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063802, "uuid": "1ee08598-21ff-428f-9f63-8b3d7191629d", "value": "T1E7A3080A5FB359B4081BF6CDFA9A5CA4C4770981776FC15388C9AE23B940DED2C644EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063802, "uuid": "66ea41eb-8e66-480e-a095-edf5c3560d70", "value": "1536:GDB7eKg20SdoAdoXxdo+do3doHdopdoadoJdoxdo4dovdo7doldoGdoEdosdoVdO:GDB7b0gXh+Bcz6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063802, "uuid": "8e9bbc23-2578-4f03-a670-3570a360feb1", "value": 104746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063802, "uuid": "18fe3e1b-57ef-4286-b9a2-cd67d5be2932", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063802, "uuid": "a7d86a9a-8019-43b8-bb36-a66a302f1b93", "value": "invoice-1637482117.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f02b300-aed9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761090934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761090934, "uuid": "8b0c2078-7ac1-4173-a536-e5470818f0e4", "comment": "Malware payload (Mirai)", "value": "0227bde43523273ce5dfc42b3dbec546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761090934, "uuid": "c05f9642-0591-4a4e-b882-4d498e15ddf1", "comment": "Malware payload (Mirai)", "value": "64d7bd94658076237d749a01fa2651b86a5c7622d862313f9e9c51bf47b5a5cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761090934, "uuid": "a42030db-c21f-40be-ad7d-7ed48bd44111", "comment": "Malware payload (Mirai)", "value": "6f077617e44e0f2ba45b1dbd868b70f21773bfb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761090934, "uuid": "97871eda-d393-40c5-aa8d-7eba6649f1a8", "comment": "Malware payload (Mirai)", "value": "183287b6aa5acf80a84240fdfb26a0ff0a26a7de512da25a69ee23f420fa9440f37d7f87c79ef04a9d71d1162b25b7f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761090934, "uuid": "961422f6-b5b6-44b7-9f5c-f27405dcdf9e", "value": "T172633962B23C1727D4F0AA3951B67323B6E92A841464C78FFD690D1E9E633D01A1B7B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761090934, "uuid": "ac4578bd-6577-4824-920f-24f881cabb53", "value": "1536:KfeJrLpkiWI25llkp0KsStSJ5hGurTGbAo91cCfa3f4ZX:KGnWIZ5S51/owKo45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761090934, "uuid": "0bacf479-04f9-4f0f-83d6-b1cc13f31fa3", "value": 71988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761090934, "uuid": "e3c5c28d-a32b-45e8-9a83-437d4c618466", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761090934, "uuid": "599092c6-4a7a-4857-bb2c-d446289e15e6", "value": "Orbt.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1acbce-ae54-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761033646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033646, "uuid": "42519445-1cea-4ab2-a738-1b6ed1e6239a", "comment": "Malware payload", "value": "797acf258f72591ab570ee35f5cc3370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033646, "uuid": "d97e686e-149b-4538-8704-43a529fd1edc", "comment": "Malware payload", "value": "652dc70cdfa0099bf27fcae37f445e09d0539010ae94f5c341b444eeddf4cc0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033646, "uuid": "2eb2d3a4-a35f-462a-9ec2-ee103f8e06b1", "comment": "Malware payload", "value": "00c30ebd97b76ffa956882456f65ff680933cf70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761033646, "uuid": "1e2f4be9-e74d-4d51-8e86-31cb6fb606d6", "comment": "Malware payload", "value": "8ca45b9ec1a8ec0992d0723e8ec9754a29bcdba7e09edd1b32737f98a3d3f5134e2b079d596146be1049c1a08a56e8ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033646, "uuid": "39538724-5250-4019-af86-9dd11aa8dfc0", "value": "T1A756BF14A3E800B5E47BD734CA56C333DAB0BDA25634D10F0999E6461F73E628B6F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033646, "uuid": "31ce2927-6914-430c-88f5-f428d18ae097", "value": "ab2b8979611db815923e785c36c1b58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033646, "uuid": "7f046241-73ad-4905-9e9a-60b756361e61", "value": "49152:kU4lakenm4LBwAo64CG67vcbKrBaBhVQNIrsM4k3vDenWX8m4YJgJCkFu3I0zbPe:kPs7tvNmyN86nWvI0uwIEGgpqnXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761033646, "uuid": "b2695c18-1764-4101-b85f-4dc19827aa4f", "value": 6387712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761033646, "uuid": "75a6b73e-8832-4adf-ac94-a90728a76f54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761033646, "uuid": "7a2548e8-c978-4a43-a02d-d7c707e8ee21", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea80873-aec1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761080625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761080625, "uuid": "5aae189a-66ab-4962-9b60-290fbce17b57", "comment": "Malware payload (Mirai)", "value": "01fe755ae428c684ce5318c4da48a0f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761080625, "uuid": "01fb4524-1498-48d5-adb6-60f7f768f305", "comment": "Malware payload (Mirai)", "value": "65cd17f005e69328555bad075f900970aa3d28e7f8fae50a72e38730f89e97a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761080625, "uuid": "59528c77-7db6-41d5-b340-732ecd862593", "comment": "Malware payload (Mirai)", "value": "0423c9b3023fea29c6cf12a02634f25fca256b02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761080625, "uuid": "c2dbfd0d-b867-4b38-acbb-edc21de549e8", "comment": "Malware payload (Mirai)", "value": "548feb98495f12b521e14b78b675082ef3b2c07de1517c6a81a8a45a6bf49ed14df7beb22e0c1abfa1efdb984786af18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761080625, "uuid": "1993f88b-fa86-4d3c-b528-90fe478d186e", "value": "T1C3042A46EA404B13C0D627B5FADF42453333AB9497EB73069528ABF43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761080625, "uuid": "e86b5600-2eb8-4531-848f-a2668d193286", "value": "3072:HK/lcVBbBLHcBCkAabwdyqkkUbH/6EBpyO/hJjogM/RHyfqs:HK/iBLHElAabwdybkQ1BAO/XMgM/RHyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761080625, "uuid": "8a03a497-8248-4d50-af21-86443825a2fa", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761080625, "uuid": "c300c4fd-3a36-421e-a122-7bf6f9b13482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761080625, "uuid": "f90c6d45-2ebd-48ff-82e2-3e4fb420e74c", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce1fd02-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureCrypter)", "timestamp": 1761025808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025808, "uuid": "159cfc6e-f094-4ff0-9c27-de3c4dc7a14e", "comment": "Malware payload (PureCrypter)", "value": "99232110e2c1136d21de63d376b8bf8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025808, "uuid": "061ceeae-bef6-4529-a103-d16228ce1ca6", "comment": "Malware payload (PureCrypter)", "value": "666171ad442a6b1ea545932c2534b3f1e76bafcdffe982c933698e90c1cdbf23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025808, "uuid": "2b0ee16c-031c-4ba2-a350-78c7a5ebf358", "comment": "Malware payload (PureCrypter)", "value": "505e50ec33b5090d26dd0c8ae76799e084df9b1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025808, "uuid": "c4e2c548-88f6-43f9-aad9-0afbdab0aebc", "comment": "Malware payload (PureCrypter)", "value": "ab9a6724108fb0b140f9f8db42a716c04073e8cf5f788d75d8db082f3bf6c4e31f606a30a36c027fe2be0fa8f7b83266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025808, "uuid": "a1d7dfa2-c11d-4577-b1a2-e32e4cd227d3", "value": "T10893086DA3C5DEB7D5EA0A3398C2EB49C7B0D1139707E34A29D80EE80D1EBD61501A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025808, "uuid": "16715797-1a49-4787-9c44-51811b2aa71f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025808, "uuid": "383c5d9d-c6c0-4132-bd5e-8ba3baff2219", "value": "1536:Q8WVBT3ZJlQf42hpH/hrCJJ05jLSoENphxdG4SGiYKgrL4/hA0:uppJ0jCJJFoENphxdGdvhZ/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025808, "uuid": "c2480701-f85a-4a2c-a492-d064a37d2c51", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025808, "uuid": "53bad6e4-7304-4022-994f-58d63c76d0cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025808, "uuid": "5a04d0ec-4da5-47cb-b314-fdc24946540c", "value": "Ycyfafmudke.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969b5ce8-ae99-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063512, "uuid": "59abd717-e525-4646-ac49-55c1f98b98e3", "comment": "Malware payload", "value": "1877f8cafdf5917514843622a1c51d98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063512, "uuid": "c8e8e63f-d8c7-4c0c-bcca-88f0bce36bfd", "comment": "Malware payload", "value": "691648af3c839900834926f8ca1367220ff4d524a7adb2c33fd1efdea908e8ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063512, "uuid": "d7f794e6-f542-4c25-af01-ae53d4f599e1", "comment": "Malware payload", "value": "e76995554ca5bfd247862d9c3d8bf3369b3ad7c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063512, "uuid": "2307327e-b91a-4fa6-9dc1-d1d1b06b56ba", "comment": "Malware payload", "value": "76af1a3ecb70a58b3e8b250c1f3b71656fff597e048deeba4fba09254abd853c8e272a125e80062115d51e51bd987a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063512, "uuid": "edf02bfc-2d1c-4034-b111-dc1468cade47", "value": "T12E064A2BBCF089A4C0596235BDB652513B3DBC094F3263D36E43B6742EBA6C1A937314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063512, "uuid": "61762b9c-ab3e-48c8-9580-366bf1a4b4a3", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063512, "uuid": "ce2a5ef8-4e6d-495a-b34e-ff0baf2d5cca", "value": "98304:jlUWI+JUEiY7MFLvgZxH3r05QwVaS46Nkh:jW+JUEiY7MFLvgZxH3r2KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063512, "uuid": "46323c01-5bb6-4c50-bcd2-e898d81db7e8", "value": 3736406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063512, "uuid": "b213d082-a5ae-4b78-a2d3-82591d864fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063512, "uuid": "db8e7a88-bdb3-4498-8a7e-8250304e870c", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74dcb737-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063885, "uuid": "8d734899-eba7-4840-aa8c-7d529d3b3d24", "comment": "Malware payload", "value": "dd4736960fa55f0639ff0a01e2b480e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063885, "uuid": "fb753d48-18cb-4dd3-8703-5ef42846e3e9", "comment": "Malware payload", "value": "692574a05e4dcd5c147d06649eca550302f389fbec94e0f7d3d5a321f5c5c22c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063885, "uuid": "3ff1ae28-592f-427c-8167-5c1960debac0", "comment": "Malware payload", "value": "143db09499a52d2419738f15c92cab60b02d76ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063885, "uuid": "bf97a4ca-e50f-4989-a3ed-ccd920de64b2", "comment": "Malware payload", "value": "7257ac0e825e12203395f7f462c138cf18647f1eb98a57a251428c9547474cedad210b71e0546b2cd17ee53a0215d007", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063885, "uuid": "6d099624-eef7-4ab0-b85e-17454264a80b", "value": "T1F8A3F75C6F63D9B430D730A2BF8477E9364EF868A7563088B027FF14199866E09781E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063885, "uuid": "5de50f1f-36d0-49cd-b07b-24681e1e99cb", "value": "768:GDhd0i7J4sYKgY/CMNfWd9T0vrXyArsyA0HYeGsAVPYbSLAuAAroQW+FF+Ec+0FY:GDB7eKg202rJrsyAp0AVwb6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063885, "uuid": "1c846581-f36b-4413-8e86-cf9de2c573e1", "value": 104697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063885, "uuid": "017400e9-2634-4d2d-824b-720637878628", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063885, "uuid": "31f42b44-ac35-488b-80fc-ace4b5fef835", "value": "invoice-1637482117.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376183da-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761063782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063782, "uuid": "59edeabc-c459-45b9-9bac-8c4cd4b95fa8", "comment": "Malware payload (Rhadamanthys)", "value": "89d43d246044abf0655d8828626d53cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063782, "uuid": "ed8a4e49-675d-4568-9201-7308a488d9ba", "comment": "Malware payload (Rhadamanthys)", "value": "6c790e5bdbdeff684dad63a70526338496421d4cc2fb24bb894f5a1bfa1913ee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063782, "uuid": "023bf0e0-aceb-4fdd-8761-853604b9bd17", "comment": "Malware payload (Rhadamanthys)", "value": "bfa18343ee6cd6711908235e777da87347c58645", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063782, "uuid": "d3ce9614-c14f-495e-8f22-4348deec10ef", "comment": "Malware payload (Rhadamanthys)", "value": "916ee1dc24c15d6e88e46d324ac71c38e452f07cb8557d0e75634c687c822434b453c8a8eb5f2c210a7bd728abb79281", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063782, "uuid": "461c189b-371b-45fd-b802-5700f6cc1c65", "value": "T17CA30AA81EE1BDDB218264FE3EDF45E089629C7E384438D672577F54D29871D22A8CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063782, "uuid": "350f4b53-2996-4544-bbe9-16741522fd44", "value": "768:GDhd0i7J4sYKgY/CMNfWdKOq9svOvBvd4K2xfv3Vc6bqDbv14KWXXMk/raQK7iio:GDB7eKg20rr7rCghI8AcsR6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063782, "uuid": "f05477f4-685f-49e9-920a-4eafeb372f97", "value": 102082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063782, "uuid": "68c11945-0855-4f7a-971b-b1d03f3ab191", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063782, "uuid": "88462bb8-2c9e-477e-b921-931374c48342", "value": "invoice-1637482117.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c442f83d-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064018, "uuid": "62263c6a-e642-455c-9ab8-a711ff2f2f21", "comment": "Malware payload", "value": "f4f40ce6951c9e5caef1a02b079649dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064018, "uuid": "a79b22ad-dc3a-48a8-a4ae-13b900aa2363", "comment": "Malware payload", "value": "6d53a15298d032534aca1d44c1836bfe7453f7e17420c1d90fc613b8eb83b131", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064018, "uuid": "70bcdc3a-a515-41ba-8d27-ccfbde80ffd4", "comment": "Malware payload", "value": "45fb5bef4fb82e6453ed7ef007b183547f11d591", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064018, "uuid": "64c71fe9-a4b7-41b7-b2a4-d9f4b559f12e", "comment": "Malware payload", "value": "033233f83bd55144474a5cecafea0531c8db0b7859d02e5864d7d575dc9284b7d784f05d2c752c8151ba5712f56b89cc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064018, "uuid": "5c6a89fa-ba6b-4981-9937-fad3deb35e2d", "value": "T14EA3C69C6D36F9B16304B27A2F450CF0EC944A88642C25C59697B71AB798E0D20FF5EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064018, "uuid": "fa18afb0-e78a-49ae-97bf-5f229ba36ae7", "value": "1536:GDB7eKg20WL+rDr2X2CDRQ3iZAeRMrDb6BkQWJ+aY:GDB7b0WLk/E2SRQ3i3RMrDb6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064018, "uuid": "e1b7ef4b-64e9-45d1-bc15-4e0775d1a8c4", "value": 104741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064018, "uuid": "e649f91a-270b-42f4-9128-bcd62a73388e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064018, "uuid": "4e0b9994-2872-410c-adff-a1b0e2f6a79b", "value": "invoice-1637482117.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8262e4c4-ae98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761063049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063049, "uuid": "fe7e49ca-d1a8-4b88-8401-1add61ed3e90", "comment": "Malware payload (Mirai)", "value": "badebb5eebd13df145a7824a525f6cea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063049, "uuid": "6a9e9a84-a185-4555-8210-8ffabeb22997", "comment": "Malware payload (Mirai)", "value": "6d8483ac102683376035c4300d5108b3d3b88b52711b39e9ec670170e363600c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063049, "uuid": "aa046b67-a037-4e54-8736-d6c5c69f8673", "comment": "Malware payload (Mirai)", "value": "bc3efb3c13ff7675d0579ef963dbae9b04762832", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063049, "uuid": "188bb5a5-4c6d-432e-b025-13310f64fb2d", "comment": "Malware payload (Mirai)", "value": "e83f59b448c86abd4664ae09a3eaeaff4678da9d71135a7012ee5e3719354b0a8a5a90095b83f65584133c909a04a000", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063049, "uuid": "54f1bc9f-2351-43b6-8a94-85f40a32b52b", "value": "T177E329DBF800DDFAF80AE33748530906B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063049, "uuid": "c9d17763-49cb-4085-ae30-ec5f75cbdcdd", "value": "3072:jRsZqphrvKbbWOftDA4EslibVrjbiJLnN+eAyaih7a:tshnfhAUliwLnNMyao7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063049, "uuid": "cfebe0d1-c812-448c-8dd1-4a1712908f3e", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063049, "uuid": "931cdf20-619a-4339-80a2-847b997ac1ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063049, "uuid": "75c7e83f-9df6-4354-b33b-d2b83ed2e57c", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d94e28-ae9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761065623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065623, "uuid": "a0389ee1-1fbc-4fc7-88e5-fe56a27a4632", "comment": "Malware payload (RemcosRAT)", "value": "a228d2b004cfaaab119b39e8d58cd8bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065623, "uuid": "8df38901-271d-47b4-b321-6c775e445c09", "comment": "Malware payload (RemcosRAT)", "value": "6dda744aac3215478c15a9cd00eebc26e47acc61f76d601f489be3b860b736ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065623, "uuid": "47709aff-5e4f-473a-8adf-d608b2d26c9a", "comment": "Malware payload (RemcosRAT)", "value": "b0a6866c5e981db3183d62f1ed3f34377e8ec827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065623, "uuid": "5b37dfa2-6de4-4870-ad2d-755ce097acb7", "comment": "Malware payload (RemcosRAT)", "value": "abd1281c7d81169787c18dfe278faf66fbab67d4594fc6dae210994eb9307525ea645f89ec3b36554b901612b3687b0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065623, "uuid": "1289147e-319b-4573-b4cb-b4b2b8644a8d", "value": "T1F91445E1D24598AAFC6713FA98338D32245BBDBD98F4561D205E7135AB7338310ABD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065623, "uuid": "46708922-27fb-4f90-ad3d-a38a293ca4fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065623, "uuid": "489e9646-0110-49f4-b099-98e4dd3c56b9", "value": "3072:WM4abspAphYrJmQgSB75kGUzwrz5SPxkrR6JiaexolrVRxP:NbbgNzakOi8rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761065623, "uuid": "e53c033c-021a-4caf-88d8-ce6c6dbcaf3f", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761065623, "uuid": "7cfcbac4-81e3-45ef-9a23-fb10c92a4394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065623, "uuid": "bdeeefb2-64f7-4fea-ba4c-748c87e12cbc", "value": "6dda744aac3215478c15a9cd00eebc26e47acc61f76d601f489be3b860b736ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09419ce9-ae43-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761026338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026338, "uuid": "ffc71d3f-5941-4f8e-be29-6e1d4c8e04b0", "comment": "Malware payload (Mirai)", "value": "a2a68c15c8d8920bba3225de41e807c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026338, "uuid": "34c4c1f7-1340-42d6-a9a9-1d30311e49c0", "comment": "Malware payload (Mirai)", "value": "6e502ca451063dc22fb3f25eddbeae69174a82f6d81f75790f8c08ef056ffab5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026338, "uuid": "01de172d-77f1-4d56-ac18-52beb4a60bfe", "comment": "Malware payload (Mirai)", "value": "63bd914036691edea0c3b179101758cc0273aa50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026338, "uuid": "1eae382b-7a7a-4c54-8975-96d1dc77d0c9", "comment": "Malware payload (Mirai)", "value": "39fba50a1e8a2bcf12ea6acec50bac8afa329951d7d32fb70e38670b58a70640faba083010073060a841107b916df731", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026338, "uuid": "a097dbcc-66a9-4231-a882-0ee22802eb86", "value": "T19804BF63BB4F2091C85147F80BCB6B9D263321025D6BC6E76C6E363E2A770DE59123E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026338, "uuid": "489da566-f86d-4df9-a32e-28af3a0b3410", "value": "3072:n59EOWXN1MJTBIZ6RVAAngPjsCU+iDgUlndaNSyLna3pBwk0g9C9veajxJhLq:nrwN1wvDCrvUldka3pmkXC9veKJZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026338, "uuid": "3ac5e4cc-f9e6-40da-acf8-fc6a81c2e718", "value": 173820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026338, "uuid": "c15f3ec5-8aee-4a30-a127-c5f945fec9f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026338, "uuid": "91162e4b-14a7-4007-bc5b-5d88dd446312", "value": "Orbt.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f810e1-ae52-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761032886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032886, "uuid": "3a18c494-d708-4f63-ae6b-14d7573728f7", "comment": "Malware payload (Formbook)", "value": "d26686db27f974161f2b4eb8a510f641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032886, "uuid": "17b1576f-7520-4e64-bf51-b77306d009cc", "comment": "Malware payload (Formbook)", "value": "6e949357f4dcb358dc0ce30daf7d688490f41fbba41a6368059fccb6b24e5230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032886, "uuid": "9bf896d5-6776-471f-98b4-7ffee8507dd7", "comment": "Malware payload (Formbook)", "value": "353ba11dc70c14703f1486a732f4ed368aa54bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032886, "uuid": "bf499913-9b51-4efc-9cb7-a601676141a5", "comment": "Malware payload (Formbook)", "value": "d49707562e50e1d4fd73449232b9674f4e82f90ef015480365e21d039534b8326c7e1ebae93a7a7808fce56a8195b438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032886, "uuid": "c889f7f1-a795-4817-b835-317521dca283", "value": "T13AF40148276DEF13D8A25BF548B0E3B113B49E4DA420E3064FEAACDB7479F156918B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032886, "uuid": "07d8ea17-e545-4698-a367-84cc9ab94cff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032886, "uuid": "a7bcea2f-01a0-4093-92ec-b17c4308d9ca", "value": "24576:cUf7W9dQNLJnlmwv/xseqQI0jY3jxHf32BHPb3:7f7W9w3mO/IQ+Hfqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761032886, "uuid": "e3414dee-9c3c-4ffa-bf22-ba60f98b11b4", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761032886, "uuid": "378fac96-c4db-4114-9ff3-1de0b218fb5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032886, "uuid": "eedd42b3-1b6c-4611-9394-297130bff32f", "value": "shipping documents_ETD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4d1ab3-aeb2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761074048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761074048, "uuid": "22c9a343-4ffd-4bc0-a25e-5563275a917a", "comment": "Malware payload", "value": "6870d147df5fae7e18fe101420da186e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761074048, "uuid": "786ae5c9-faba-43c7-82c7-ae00c46b021f", "comment": "Malware payload", "value": "6f9a1286f950da68e81bfe3e6c7655df00558df4d50289bf84df79c7d5073a2e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761074048, "uuid": "7488f8fe-5c23-4a71-a8fb-d52b2ff1edde", "comment": "Malware payload", "value": "10853f461aa33ecfa5bcd9ca0079c000148c225f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761074048, "uuid": "7757b5a1-e045-4de2-9ef4-59e786a1c073", "comment": "Malware payload", "value": "cf5590d3871b96db79da49bf4e3b47967ef6e3787cd8c00fe7f15d9b0c2dcfc56b059e7f743fd068b617a0a114c7d03d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761074048, "uuid": "b70cfd55-16cd-4463-9fe6-45bfc4503cea", "value": "T19A5173432A6643A9C7F68B49F4E2A325DC4F173E022B0605747C54483EA16EFC3A8ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761074048, "uuid": "79e3ca4e-c76c-4f3b-935f-1469466a2aff", "value": "48:N17Utzm6rKiM+pnLKA4RYv0KXqDg9A5RRAv9JRAvXEJRAvnS4mlqWztGjKD0njAB:4zm6rKiP9K99V6sKBl5zE1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761074048, "uuid": "5cef2656-bd34-4f09-9048-433f45a30f53", "value": 2856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761074048, "uuid": "35817da0-1eee-4ec9-88a9-7b0eca66ee1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761074048, "uuid": "4bd3d711-8bdf-4476-9839-1b87934bcbbb", "value": "08b28a56ec9f4e918d929ac621dfb48f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04317707-ae65-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761040933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040933, "uuid": "584163d1-9e3d-4587-979a-86a4734d00f8", "comment": "Malware payload (Mirai)", "value": "bdd1d8cf5464f6d636ef99c5bf91be8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040933, "uuid": "264dbba2-9f2b-434d-89c8-d17d249c2816", "comment": "Malware payload (Mirai)", "value": "7009c23636632e7da03ec6cc9cbef7876a956e948de177dc397628232e578ab0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040933, "uuid": "47c99add-04d6-499d-afa6-7324e5366299", "comment": "Malware payload (Mirai)", "value": "036dbaa57c5e4f938db984902508c9b2b7a1b68b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040933, "uuid": "2156a4e0-d702-455d-8b43-a2f3533ce651", "comment": "Malware payload (Mirai)", "value": "c796f776e64f7f5253d05c4a773660ba738cb95b29482e523d0930bf6ef0bacebe4d689504a80df78390903ea0d9e031", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761040933, "uuid": "4ec4168f-fef2-4906-af78-d8282077f356", "value": "T19AD33A17B5C180FDC4DAC1B44F9EF53ADD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761040933, "uuid": "caf3a503-9720-43a5-b1ef-be1ba7414304", "value": "3072:tGtwnNiaOnUTlFiPT9OSQ7AOaogjV2iZlBWCgaiAXQPdL:tGtwnNiaOnUTLuLyCXQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761040933, "uuid": "bfa8d777-e585-442c-af80-95b79a209927", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761040933, "uuid": "7a6e9bc3-18db-4897-9dd8-e7288650c33c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761040933, "uuid": "5960e4b4-d2ac-4d66-a156-a8620f257421", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08798665-ae4f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761031491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031491, "uuid": "964199ce-f424-4407-9d8e-e04844f6bbd0", "comment": "Malware payload (Rhadamanthys)", "value": "730c9da5151f297966d9e22007030866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031491, "uuid": "7706e2e6-c1d2-43c8-9209-2bdba0564a8d", "comment": "Malware payload (Rhadamanthys)", "value": "702cb46b7073a4f0308bd369ed82313801f8d0d5f4633290f50b461000996992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031491, "uuid": "40f0e22b-d0c3-4b57-85e6-2d29e0009f4a", "comment": "Malware payload (Rhadamanthys)", "value": "945b906a2d6ddb88393ca1381fb7ac4a5c71be4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031491, "uuid": "eedf93f5-1100-4c96-90ae-692a0aa2ce45", "comment": "Malware payload (Rhadamanthys)", "value": "ac5caa33aca830c6334df65d91dd440e69afdf105c4a0ac90786f3ac0d8b07b0373eb00700e36c1535f2a1d67bfc5673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031491, "uuid": "174204de-c0a5-46aa-a488-32917a41de4a", "value": "T16AD3499BB3F530F8D077853985920A05F772B87657616BEF03A4426A1F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031491, "uuid": "20686725-afec-4977-abaf-9f3575c346f4", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031491, "uuid": "08429424-d2c7-4493-bd90-cc7e068d1fd2", "value": "3072:Jv+zxFifIup9RzJ3oZBysYCbpP5VTGbbZ7GqWDA:bwQRzJFdCbpTsmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761031491, "uuid": "56113ff7-53e1-4426-9c46-649d74632d46", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761031491, "uuid": "5b56fcd2-4c7f-47f2-bc03-bdce6fa234a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031491, "uuid": "22ec4e8a-3967-4e91-ae52-21192214cd27", "value": "SecuriteInfo.com.Trojan.Siggen31.64782.26374.21276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8e942f-ae9c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064628, "uuid": "4a1424e3-9465-4f19-a963-26d8ef154884", "comment": "Malware payload", "value": "77db7d52ad71aaea8ff04596188d52e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064628, "uuid": "6a9df99b-a84b-4522-8710-eb91912e0a35", "comment": "Malware payload", "value": "70f11f2f80100ac90e1b10fa51f586ed18b54ba0c6b6d96e767fd74266e7b4ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064628, "uuid": "be919d70-28d7-4fa2-b7d8-96352e5a85b5", "comment": "Malware payload", "value": "db9298a9369f9443e34bb21dd6c15da062f37453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064628, "uuid": "cf3ac33b-7df5-4420-ac65-3abad0b8a708", "comment": "Malware payload", "value": "fff6a7efb6fc836603391307085a5e60f92eca0f410cb5ad9fa5afe9e2941b52ba5891438d92f2b3170744374038011e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064628, "uuid": "6c40ca49-b6f2-42f1-b0a1-da2f77c0a68c", "value": "T1F3C34957B3E530F8E1B78235C8910A0AEBB2B83617619BEF07A446555F237E09D3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064628, "uuid": "4a188fb0-e1bd-44e3-899b-f66ebd7233f3", "value": "dbad47c31f77243fc519f4f9ce1eb2ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064628, "uuid": "a4b517a8-cbb3-42c2-bdb4-45fd507b1155", "value": "3072:n/7BaV0M46/H3xzHVeDdnAmt9jIvlCNSt6:nd00yHBz16n7M6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064628, "uuid": "6fe8e37d-b83c-4b16-9c74-cd564c89e7c0", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064628, "uuid": "b8e15808-daa1-45df-bb5f-c93ad2ca4240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064628, "uuid": "d57008f6-6480-4b08-a77a-bc5b186131a2", "value": "Dropper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42703717-ae11-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761004960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761004960, "uuid": "a27d55cd-0d70-4987-9e99-276ccceffce6", "comment": "Malware payload (Mirai)", "value": "3e0936a054d80a284f2ac36c07543bab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761004960, "uuid": "37359206-66e1-4521-91b3-6caaddf999e0", "comment": "Malware payload (Mirai)", "value": "72a99e66be73ffd9bbf58936942d1afd620b82485ce8fca2c42daf7afff08d01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761004960, "uuid": "659229e0-d26a-4e48-92c9-abee34fc92d3", "comment": "Malware payload (Mirai)", "value": "285ecb5c1cb32054aae4b79fa0056878b0ccee77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761004960, "uuid": "4efd87c3-351b-433c-b442-152e8b2ebe99", "comment": "Malware payload (Mirai)", "value": "375fd8cf0b6496b128b2b2a777c9722dae9b31dec55b91a2a6b646e757400a1f0b959b7c5960533586977ad6b253e147", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761004960, "uuid": "3bcf1e94-3875-4d79-b7c8-f7571f8c978c", "value": "T1F1439D77C57DADD4D10802F8AC318AB93B53A210D6562EF72A45C1628043EBDFA8E7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761004960, "uuid": "20e02848-2f32-4fde-aca7-fc024000f51d", "value": "1536:NaAwtOiD3/6dc2iv1WnTl15VWtC+tnJ8VR:N3+D3SdTHVWtdnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761004960, "uuid": "6d763cdf-78de-4a41-9898-e29bb6a8b777", "value": 55608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761004960, "uuid": "1564f310-627d-46a2-98c9-d9b465e85f5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761004960, "uuid": "246af5ca-38dd-49e9-bbd5-8bab49831364", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb0c690-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063850, "uuid": "6ec9e2f3-9003-464c-9399-77905ed2ce5d", "comment": "Malware payload", "value": "82bf5de68956a137099b72ab9410e8b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063850, "uuid": "010cfdf1-2da9-4b84-9e01-ae8eae0c5f06", "comment": "Malware payload", "value": "72aec06f531016db90b04c9f1d0aa8b8224f837f66b6b2953c83605f2e3a2c6b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063850, "uuid": "75f59116-21df-40d2-be71-bac00821dc65", "comment": "Malware payload", "value": "54b86399ac0a816ff52a083918036a19147e18d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063850, "uuid": "75117d78-4679-4677-afb4-13f50cb42b53", "comment": "Malware payload", "value": "4068811ed7ae221eb545e894a133fa46b7ef8739c093a280a6a0d1cf20af5024b6c9c7449d55ba4eddd933a595b2ec12", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063850, "uuid": "31463653-aefe-4a27-8555-66b79fc4489d", "value": "T14CA3DA050A27DFE6594123350F9166BDB58F23403E89C81CE1DEFB6247BCF1AAE82597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063850, "uuid": "bf43cef6-0415-4cf5-bce6-5cb515ad8d61", "value": "1536:GDB7eKg20sFNrJ5eLaOKdrhMFNEIKyzs58uWTe1RkMr5VCrBWNADOVD3La3zai0O:GDB7b0OSjbNKQqgbGJfUPWz6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063850, "uuid": "196f78b0-2193-46a3-8aee-ec0785ffa4c6", "value": 105978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063850, "uuid": "a0559977-b71a-439e-9c53-bc5d761de875", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063850, "uuid": "6ed1323f-2f7b-4451-919a-433e78449a4f", "value": "invoice-1637482117.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7fc46d-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761026156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026156, "uuid": "5d7f767b-bbf3-43d4-8489-0653f055f70b", "comment": "Malware payload (XWorm)", "value": "589f5a02f1e19feae511c51a9798a080", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026156, "uuid": "e6384be0-b83a-447e-89ad-64c84bebaf3b", "comment": "Malware payload (XWorm)", "value": "732975f6429f6127a1927f1a5ebeb2a28b2d64e8b7b2c22df37708ac165074cc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026156, "uuid": "90a46e46-c3e0-433c-9782-de7d24dfdaa0", "comment": "Malware payload (XWorm)", "value": "c1c1087dee11f53c12dbca3bb2ebe05bef191324", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026156, "uuid": "a28feeb1-c1ca-49d8-bd3b-42e2089d2581", "comment": "Malware payload (XWorm)", "value": "9e855966994d6bf222e7600109e0c0ad6bd4746e157349c6a4a2f22f5bd690d9c71e5ce150fe9fdbc3285f756e29c86e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026156, "uuid": "f39bbf6c-417f-4084-aeb9-4beb015c27bc", "value": "T16F735A676930037BF7E361AC92ED5DC70E6A7340701A06B1E9D364DB4CA6B133672B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026156, "uuid": "32e8f3ec-330f-4561-a4ac-66cf12b74e88", "value": "1536:or609E0QWvMpuaDEYq4DNYq6VyAkS3Nuu:o+09E0QWvMpVDyq6V/kS3Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026156, "uuid": "a17e0c08-55e2-44d0-b4d8-2d4c8134e0d2", "value": 74318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026156, "uuid": "29b81fb1-f8f8-4b69-a974-73dba343fa24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026156, "uuid": "c8f2d761-a32c-4e93-8a8a-e084d5aa854a", "value": "awb_DHL_original_shipping_documents_delivery_10_21_2025_PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d905e3-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761026056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026056, "uuid": "fa2b3261-dea3-4b6b-9123-86bfd9250885", "comment": "Malware payload (AgentTesla)", "value": "7079e06d54edb33fe72cc4d61db89ed3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026056, "uuid": "9ab503a5-d66c-4921-afd5-d59904fbc8e5", "comment": "Malware payload (AgentTesla)", "value": "7331f0ba8fcdcf63415e91a068dc0b978f959df5c6736b6949bf95b6980d7eaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026056, "uuid": "fedd9fc4-610e-4504-bc88-e73da63744e5", "comment": "Malware payload (AgentTesla)", "value": "1194024eb5de478c53febbf8bfd193e40113e5c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026056, "uuid": "1ad9dc1d-8d44-4822-9df9-0c65c8483eae", "comment": "Malware payload (AgentTesla)", "value": "5a29994897d8f8376be3492a5613c668bccce00c34653d5287359c758d01d013d8b5b00d01f6f20806b035ad260e106d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026056, "uuid": "e7de93ab-9305-43d0-a3a6-88270c12d030", "value": "T181D41294279DCE12D1421FF45930E2B06BB4AECAED21C94F8ECB9DABF47DB149410A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026056, "uuid": "8d5a09e1-1fd0-42ae-a752-b79660326c2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026056, "uuid": "9684b048-ff01-4372-aa5e-6e4ab00d7eea", "value": "12288:kHAUc4WEC7DDFAgd1JYXEYKirjSPziC8fr5OnMxZiC3/imeXRUW3mGvAQdMb9RWW:kHA/4wzFA4YKKSPziBtOMxZiMLeXTWHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026056, "uuid": "e5318c6f-f042-488d-96ed-e8bb795cd314", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026056, "uuid": "e82d78a2-aa00-4041-a569-aa368aa35b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026056, "uuid": "42e68855-605b-4703-8d23-c65ffe2f91be", "value": "Purchase Order NO 33876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee3068e-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076787, "uuid": "f255ff30-d64d-46e9-b90d-7a99e2de0a99", "comment": "Malware payload (Mirai)", "value": "ed08b4d2e3c8a1a389224425b3a66930", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076787, "uuid": "101b10b0-1059-4e33-953d-0c873e775388", "comment": "Malware payload (Mirai)", "value": "739c670d0e96270aa9363f0d9a99ed7106f27094f892a95145759ff2309faadd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076787, "uuid": "e6dcc825-ba88-48f4-aa6d-ba9d5914d165", "comment": "Malware payload (Mirai)", "value": "8263b0055a0f0664d584e132e0f1f31ccea7bf2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076787, "uuid": "ef8b25e4-ee16-4bd7-92ba-1885bdb9a38b", "comment": "Malware payload (Mirai)", "value": "043c6ab73fdc23502e7481f8630e8d9e1c8fc9575fa6d1739f221faa9200e187c5983039e90409f13b2ea6070a45b5b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076787, "uuid": "a78a0ce1-5f26-4b23-9530-2ab6f629d95f", "value": "T102C31B45FC504B23C6C612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076787, "uuid": "1102305e-6e0c-4126-976c-da091b6ca8ea", "value": "1536:p3Ka0rG5yC/cMChygtXOBdWFAcJX4VlgXTAjcFAaUGxrf851WhXVVlnKwywEReQC:5KaprMh7ROXWFh4UXwcFAa5xovW5kKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076787, "uuid": "afc61dfa-8b8d-4be8-b745-410848a6c7ac", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076787, "uuid": "93fc9036-222a-4138-a3d8-ab1eee78e372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076787, "uuid": "abddfc45-bfe9-4ebf-91fb-189ce3849a8a", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69800676-aec8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761083623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761083623, "uuid": "e990cd9c-1dc2-40a0-bb51-d53ce8551b21", "comment": "Malware payload (Mirai)", "value": "f224237a60884fa721e868b99eeac1b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761083623, "uuid": "3c813375-eefc-412c-9ad7-dfd170030910", "comment": "Malware payload (Mirai)", "value": "75f928fd7680e71f55d4cac2c14858d0ab8de3446a03f020e1aa33cd67571c87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761083623, "uuid": "5709dde7-d90d-499e-b51d-ab147346551c", "comment": "Malware payload (Mirai)", "value": "9fa55b95a97ae151cc115b7f34ed28e63d95b578", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761083623, "uuid": "7f8ef8d0-3761-4713-9a55-88424ca5f42f", "comment": "Malware payload (Mirai)", "value": "72d93040805443bd93438c29d2d375c4813f083a6baeceec5190727f330485c300894a93b0303606c50c732439b87424", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761083623, "uuid": "a78e8a88-0482-449d-b096-e551f102e180", "value": "T1AF7302BCF2BD5EBEEE0D297B474F63267E4011C051E39ACE8B3948DE632651F2566080", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761083623, "uuid": "41560254-f7e0-46ca-8a5f-c3ea6cee135b", "value": "1536:Lv7fyveuTiTosx8XdNHYaplzZvYHzfHH0d8nNp4Bxkcvpya6p0:PSkbGAWdxwz48L4Bxkcv0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761083623, "uuid": "ad4a2f43-e5fb-4256-a03a-3029438e9688", "value": 76808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761083623, "uuid": "00340833-4b62-45fb-98c7-e7a3c17ed0db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761083623, "uuid": "1959e98e-5c65-43bc-a14c-c27de3c563c9", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017a7244-ae93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761060685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761060685, "uuid": "1550f783-64ad-4954-8895-163573a4bac4", "comment": "Malware payload (Mirai)", "value": "ef579b4440ad8d66005fca13ae8f8a18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761060685, "uuid": "438c6c4a-6f33-46b8-8840-b160cb380813", "comment": "Malware payload (Mirai)", "value": "767018b04f6e5c3b07b6bc78767dcaa72f0f6f3dfeae3455302272d0437f059c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761060685, "uuid": "e26dee7c-d9ed-4866-82cd-e92a014b61b5", "comment": "Malware payload (Mirai)", "value": "2e67487291bed0985ed2ececa6602a5b4141cf42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761060685, "uuid": "31bf3a1e-cfa7-43b9-8cf9-efe58b013bf2", "comment": "Malware payload (Mirai)", "value": "4936cab36e69c17016fc3baf8f5d98715f209119766b27bcfbeb7b025a273c5c6373cb5eaec3ddebfe3ec541a10cf0d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761060685, "uuid": "aa814d0f-f2fa-4ecd-9ab8-de98881efa94", "value": "T12304885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761060685, "uuid": "b853a90d-d63e-4f21-911b-2f4af88fbca8", "value": "1536:Cl2JvnXPvLsQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/znt/Y:Cgv/qcwZsCK9VRhAX+bShFSP0HbbnlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761060685, "uuid": "6ad3f262-05e7-4fb2-bc16-58db8bde07ad", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761060685, "uuid": "d223c582-9b09-42c0-86cf-eeeaed1cfa84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761060685, "uuid": "d63183bc-2716-4d95-a5e2-d1ca2af732c9", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c3ea12-aec5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761082253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082253, "uuid": "d951ad22-e821-440d-8754-c4660ed8016a", "comment": "Malware payload", "value": "6e6de56c1ac39f13d38427487e9b91ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082253, "uuid": "8dbc55c4-6440-43ac-b1b5-a7c3ec77e01f", "comment": "Malware payload", "value": "783118545a37c055f09350a477b9e24590a9fcbc04ea6b37311d86bbd47a5c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082253, "uuid": "78b38e2c-855d-43d4-a844-f1e6293f4d32", "comment": "Malware payload", "value": "af0fdcc8ed21f9e58bd0c197e57025b70498c066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082253, "uuid": "694c934d-ca1a-4f3f-9d2d-80b59c225033", "comment": "Malware payload", "value": "f92cd691b2c918139fd81f158f4d7e14751a61863d85e2a13babfa95aa669a2a23ee076e9264101b0ca32e55fd3af775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082253, "uuid": "cf37e8a8-2202-4dda-b03d-bb03685d6910", "value": "T10E75D022EE528D3AF02E3179D81BDB96142EBEE12A14750E7AFD394C7F395D32416093", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082253, "uuid": "c65c825c-a325-4a43-8bf9-1db91e3168ab", "value": "37cefd31e003cee7c8f3f0b24332ee91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082253, "uuid": "28da1c3c-8fe9-4a8f-9b35-97b09e15a915", "value": "24576:8c3ku3efFKfwG32uJQtSLDknyHwiPYN1d2xOeHwKSLDknyHwiPYN1d2xOeHwoxp:/Bvytwontis2xOenwontis2xOeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761082253, "uuid": "81c7a265-71df-45ab-9138-97e8f589f849", "value": 1679872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761082253, "uuid": "153fefbf-99ca-4622-b914-5cbe5cdb9f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082253, "uuid": "58479293-ba45-49ed-8272-e027e1c37f0a", "value": "SecuriteInfo.com.W32.ModiLoader.AC.gen.Eldorado.5055.32568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f47fef-ae6f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761045494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045494, "uuid": "94b3dab2-fe58-4d6c-aff8-a6e46c00368d", "comment": "Malware payload (Mirai)", "value": "211affe42aeaa58f643615ff3f0cfe34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045494, "uuid": "602b933f-1236-412c-9f9d-1859a88af7f2", "comment": "Malware payload (Mirai)", "value": "7866783601c7bb7e8a61d36867c517b5d3fa54cdf964e99bfa2514b7fff11448", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045494, "uuid": "6861389a-ce39-4e36-8802-16b277a6bf7b", "comment": "Malware payload (Mirai)", "value": "f29289c29102ae3520a76f0f985e06d9d70ac3aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045494, "uuid": "fca08994-4d77-4717-89ae-80dd00be9583", "comment": "Malware payload (Mirai)", "value": "d595cde2f163fb3282e59e265e2f52c1ed0f7810600623a30542ad1d865c5a08756073339ec866e97ed69a2eff052e8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761045494, "uuid": "bb6438ed-a192-4975-80e3-406f1093b565", "value": "T19F7301ECE8650BFA8C3E487E90882751EC0697F2330CDB4EE77D864AC15189EBD154B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761045494, "uuid": "e53a9386-eacb-4bb8-9119-144d298fe311", "value": "1536:wBLRorQFnvFJaVdTGT66ecOo43JUzJPfppKdHYYcMMNqeFPx27t9YFV:vQFvFQVdKT668rqJG/cqeq7t98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761045494, "uuid": "3a62ee15-7803-4330-850d-7b7ae43b83be", "value": 78496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761045494, "uuid": "03cd32ca-7656-4924-a27e-6ea0fbab779b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761045494, "uuid": "c21a4510-a4d9-4e80-8b9b-2e568b580761", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f466a7d2-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761025015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025015, "uuid": "590a1d1e-d7b0-47ca-8b00-238bcffcecf8", "comment": "Malware payload (AgentTesla)", "value": "b1cd7e881a36d3fb431e3d0356fe814d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025015, "uuid": "d2fbbfd3-3539-4186-a00a-fa4cb79522ed", "comment": "Malware payload (AgentTesla)", "value": "787e1f1e79b87844453faebb5f2b5a57ef52222786e8ed8176f61348cc92cfaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025015, "uuid": "506547dc-8b46-4fe1-a402-a8914a34e481", "comment": "Malware payload (AgentTesla)", "value": "ae3ac4a3c6135295f5c7203b748e566b1b48f89e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025015, "uuid": "9e3ef502-de8f-4c70-b977-50881f95cc3a", "comment": "Malware payload (AgentTesla)", "value": "049d271b0a0e5b3749b74803771b47a12e227146f58268bb9a1a9a2acba8d2089c45107976e7d14c16ffc50a858579ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025015, "uuid": "6e761c51-b3f9-4518-8bfb-7374b67caa99", "value": "T1FB5502118DC86FBCCFAC5A1890BE1A1EA3E0568E5016754DFB3BBD4AAFF750402171CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025015, "uuid": "a6d3e21f-1a21-42ad-af5f-cfa19dc5a6cb", "value": "24576:h8ozHFBa1Yd5fy7KMa6lVCBr0Gc6D3mTiByOQIBn5kaNJg/pmGSNn:DHFBWTaWzGyiVxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025015, "uuid": "2dc09aaa-57e3-47e7-ac26-460290e5f7cd", "value": 1289201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025015, "uuid": "21e55743-7b95-40c0-9e06-e2595e44b1f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025015, "uuid": "33a0d41f-f3e3-4c88-84a7-2aaf8e58bca7", "value": "N\u00daMERO DE PEDIDO 264418..VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9ca155-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063900, "uuid": "e54819bd-8a59-45ba-888f-eae68aa32dcb", "comment": "Malware payload", "value": "a2f39945899c7b2734c37b228eba73c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063900, "uuid": "9d875c80-d492-4049-acfa-3fb596ebce62", "comment": "Malware payload", "value": "78dbaef7c356f37683cf185132f79f74700126a19320b9dbbc78f6f8436fea26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063900, "uuid": "d6876cdf-ff23-47b3-8b41-9ccd49299360", "comment": "Malware payload", "value": "ba7f3c9ff333f8e963cd8659a2261fc9d7cb6868", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063900, "uuid": "c79a1a7b-9064-4333-a19b-06401dc7cb06", "comment": "Malware payload", "value": "b19f1a215f574c31a024f4fe798657ecb18f965e764acb342973957f392c61c8505b24c4af477bb7b5abef265d559204", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063900, "uuid": "83c9167e-7b8f-4505-a0eb-77d8d3a12536", "value": "T161A3FA24194BFE79E1D3343B2E0270EA056FC2849C0C75056F65BF336A9DF821EA56A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063900, "uuid": "ff1657a8-237e-4edc-bf8e-e0f39db6b5a0", "value": "768:GDhd0i7J4sYKgY/CMNfWdXeoGKrXePryxl9HuHqVAB1bsSLAuAAroQW+FF+Ec+0G:GDB7eKg20xreryxlAqABJs6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063900, "uuid": "8da6ac78-edf9-4b11-b4c3-ed9b5dedcb68", "value": 105367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063900, "uuid": "905e3341-8e9e-4396-b894-f077aac46490", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063900, "uuid": "9cf0ff98-d603-4c89-bd32-676a311ca662", "value": "invoice-1637482117.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a709102-ae35-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761020462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020462, "uuid": "107fb1c5-5545-4ea2-a88e-ff4fed6e5c79", "comment": "Malware payload (Mirai)", "value": "2fe1da385d298ba296a0ba86c8115273", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020462, "uuid": "ab12e758-c280-40e5-a1b1-f5c28b2914ab", "comment": "Malware payload (Mirai)", "value": "7b6a20fe4855c378fd619de723d19671da2a52ae3562d6279fbc14d18fb9c31d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020462, "uuid": "399d4dff-9e6a-4ae8-99f4-3b7ed31517b8", "comment": "Malware payload (Mirai)", "value": "d24cc77353b5ef70ad83735d5ba98d5ec0df7371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020462, "uuid": "ab06e99e-9936-4f60-a604-540ba21a4019", "comment": "Malware payload (Mirai)", "value": "e59575d9ed5761acfc7f933db439c2160407dde30c5f7284b92fd8c9337c793041b0b3567b7c08d9e1beb36a16770ef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020462, "uuid": "37392cd6-5c85-4dd8-a6db-e48766b99661", "value": "T13E430785FD92896BC6C4177AA76E128E3351B3E4E2CF3613CE185B11338960F4E7BA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020462, "uuid": "2d8b5b1c-8cfe-46cf-805b-42375648aaae", "value": "1536:R8giAiCiCCKQmGSNvLXIZFm1kAAGXjaK:atCNCzmQZFB6jaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020462, "uuid": "f600583e-6371-4eb0-8c27-3aa1e63ca994", "value": 55244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020462, "uuid": "986690c4-bb78-4d50-81b2-05f47c6f51f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020462, "uuid": "03c30a62-1d3a-4d4d-9f2e-a2633db6718e", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9081092f-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (MetaStealer)", "timestamp": 1761025706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025706, "uuid": "ffee9078-5325-4304-8fc8-fe2681578eda", "comment": "Malware payload (MetaStealer)", "value": "912c9f57095eb8b2122acf8123e1c03f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025706, "uuid": "53a46733-f8e0-4565-8ebd-ed1ae66d20ad", "comment": "Malware payload (MetaStealer)", "value": "7b910a8a522431771087495724fb30ee1620d2490fb5aa7e77ba9114545a05ea", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025706, "uuid": "2d3cdc7a-bc1e-46a2-8758-011e8cc21d91", "comment": "Malware payload (MetaStealer)", "value": "bbe35dc83bf97c14421e7a16ed5b5c1e70a73e92", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025706, "uuid": "8830deb9-afa6-4f3c-8413-199abc39875b", "comment": "Malware payload (MetaStealer)", "value": "3ef136319220d6ccf61634a94b51704d48db3f0b072634c0655a683bfcaac5e0b8be1349eaffea3ac096b6975b494d09", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025706, "uuid": "7773a170-ddf0-47da-8e1c-e7f53e5d9ef0", "value": "T15251FE003BDD4769E3724D3A04B9A710C97FFA42ED258E0D02565D4D2C66A10DE38F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025706, "uuid": "af800934-dda9-4ff1-ba53-2da85279951c", "value": "48:8212YwkqQxArZ4ndrGT2OMdyRiXuHGfV:8c2YwfQxg487Cui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025706, "uuid": "2f84d253-c633-4dbd-b214-30a18b30b35e", "value": 3067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025706, "uuid": "50127904-2a79-48c0-81f7-345588f2b37e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025706, "uuid": "179e03a4-d791-4aca-9fe1-f3f71660c358", "value": "shkb-support.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38dc78c9-ae51-11f0-91c6-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1761032431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032431, "uuid": "813e3c0e-2391-4d1f-8c08-e7123fba9809", "comment": "Malware payload (VenomRAT)", "value": "937f4baac80191b5f839a9c486eba0b5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032431, "uuid": "f10bb73b-82b1-4413-8c55-aa53dbab0366", "comment": "Malware payload (VenomRAT)", "value": "7b97323a791c54e7fcc3888dc317abf7563a73c0155d095e17912aa59cf13c39", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032431, "uuid": "3b3634bd-4a05-47a6-ab70-858b7e787b05", "comment": "Malware payload (VenomRAT)", "value": "fa1abba246a43e5a80fd0aff996d94634fa03d7e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032431, "uuid": "c50d5635-8a35-490d-b6ce-aa179a49f74b", "comment": "Malware payload (VenomRAT)", "value": "fee1cfca985e814c50bd211b8e56ea4fa56463e55899cb211f6b6e100d9f4c7b752c075f954589aca4704947677ce872", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032431, "uuid": "c44c1d30-fd9c-4165-bdae-01793635aa7b", "value": "T1D075CF11E2C2853BD3121539CD6BEBD618197B212A14BB5E7ADDDB487FFD2C22C26093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032431, "uuid": "50c8b1ab-1aa9-4dd0-abdd-93ebfa87c9f0", "value": "24576:o10SC1dUc8CJjLTIwC9QdvHU3+dL31/o+0B+byhAkb52k/Nb0/eFDy:o1x0qkC2d/e+p1ddbyhAkb4+Nb0/eFDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761032431, "uuid": "64ca9718-73c4-430e-add6-1584fc0ab0a1", "value": 1603791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761032431, "uuid": "aa2833c9-3eb2-401d-8628-5a4e62902ad7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032431, "uuid": "da2abe6b-e933-4ea2-a6b4-b47ab2f5ba25", "value": "OUR REF RET-402-1438.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0938fe1d-ae6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761043518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043518, "uuid": "8f89d71d-7050-45ab-bb2e-e0fdaa9ca080", "comment": "Malware payload (XWorm)", "value": "6f10eb4afd412d595f44fc655f089402", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043518, "uuid": "6f3cdc06-238e-42ad-b8c4-1a68e08cd509", "comment": "Malware payload (XWorm)", "value": "7da8b1b116e90d9f75b03cc90d9dd147185fcd2df7b44fcdcd6d9c5ba50eac9c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043518, "uuid": "daac72bc-ecba-4ad1-a175-0f43d83aab11", "comment": "Malware payload (XWorm)", "value": "6823c6a08ecbd62ddc8e1dd99db5b4b4a955ca08", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043518, "uuid": "79c4db12-63e6-43da-bee1-edd0af2e9045", "comment": "Malware payload (XWorm)", "value": "8e5a818bd9d456916bc8183239c22dcc7ce6d94f768b0f4248be07fb7d3e732dc5b6af323a1dbc2391072bf7ff561cdb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043518, "uuid": "1e91cc45-12d8-4324-b191-3fed7cfab475", "value": "T1EAA5AEB28DB79DC92F7824CAC5CE7AC47F1C47438568A6906A4FB27F21585017FD88AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043518, "uuid": "ece42aba-c9eb-4198-89f5-4cfc7d55c210", "value": "24576:p9iUFS/f/m5PoR/XufqsKRjxZqiOJReeXQs0E8xjsg5l01OMnalvotk:bSe5PoR/ewnHSRvCSD7a+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761043518, "uuid": "2fe84fc4-500a-437d-8797-6419e893116e", "value": 2188987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761043518, "uuid": "b50f6192-492f-415c-a395-ed029745b9ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043518, "uuid": "f04ff280-ef87-4bd1-8265-5ba251632748", "value": "YW240802002C.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a8f293-aead-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761071862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071862, "uuid": "0946afa1-0cae-4c9b-bd5b-3818ea0e0e20", "comment": "Malware payload", "value": "c119e0f3a49856f921184839d8d7a09d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071862, "uuid": "793f30e0-178d-4e9b-a323-405d9d67178f", "comment": "Malware payload", "value": "7e69512592c819ad4d11bb2afefcf22890609f10b805a1eb752dab7b97f969fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071862, "uuid": "0aac6099-2fc0-4c98-ac88-63875d13e422", "comment": "Malware payload", "value": "e4dc4acddc1bc7d742fe974748449616c4bf51e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071862, "uuid": "9f9000dd-117f-4967-958e-7697d7d455c7", "comment": "Malware payload", "value": "284c4a63d1fd9e08762c8b4f61fac3dc462bb84da9dc20645c4ad59b3f0ac741cf4ba61bc6eefe42bbd13ac49f7aab0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071862, "uuid": "47b986a9-5394-436a-8a3d-96bfb6ef3784", "value": "T148464B83FA625498C47DF879829AA573E5A07C6D8131737B7FE04B022E15B20EF1D74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071862, "uuid": "8d478584-2e1b-4edc-90a3-310727f2ff46", "value": "49152:xC92vtdjMNwEq8qs6tsVHb4crP6IyGLnCG6CocaFW0Ei0w7EzKGyId8tH/h6UMu2:wOwLqs7YGzCEaFWINUaXMcTUP+7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761071862, "uuid": "76fce863-e62c-4d1b-bba8-439b4c93942a", "value": 5397360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761071862, "uuid": "9cc91218-faca-46be-b95c-d9d51b61a550", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071862, "uuid": "ff420b83-56da-4155-bed6-5b1ab76e0c90", "value": "explorer", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7572d74d-ae35-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761020507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020507, "uuid": "c6fed90c-103a-4c65-bd6a-ecf1c4ff1e67", "comment": "Malware payload (Mirai)", "value": "df045183b7abdd021af6aeb74aa38861", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020507, "uuid": "5b347112-9d4b-4cec-97b7-2817eb187537", "comment": "Malware payload (Mirai)", "value": "7e86d9905f9e47959d166ac6a95e9a50cd545271695123c27f0d65413b4ff7be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020507, "uuid": "ca82c916-239a-41d5-a720-69be83e71c6a", "comment": "Malware payload (Mirai)", "value": "67ecb008c53dc2dfd3fa7e8e404296868bd20b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020507, "uuid": "19089ffb-6c6c-4287-a631-c4fd6e901e46", "comment": "Malware payload (Mirai)", "value": "d5a2ebe72dd6e25890ca19c598efcbf78801bf9f0f7ed881f84bcbf6bc763bdaf80d650d01ba2c1d8e7a1f81b3dff675", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020507, "uuid": "c9a11a08-9e46-4eee-8a68-1db07abf516f", "value": "T199B3A64E6E318F7DFFA8C23447B34B25A65923A627E2C985D1DCD6012E7034E641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020507, "uuid": "c8b4388b-8c8a-48fe-b731-084bc09a3c07", "value": "1536:OsrBgQlsG+1nDr8W0mqsjmi9nwop8efQXqOS7XieVt3O+sxKr:XBgQylv2UjP9nw+7fQXqd7X8+sEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020507, "uuid": "8ec9c493-6b58-49d5-9018-c02336d4c2e4", "value": 114028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020507, "uuid": "951a7113-4747-4863-9d38-01dd847a9237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020507, "uuid": "1dc2bd05-a742-444f-8bea-e87df261a232", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d426e9-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761025769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025769, "uuid": "902f387a-85e6-4c66-bbab-258952286bf0", "comment": "Malware payload (AgentTesla)", "value": "d93bae14bf9b0ded0e7e538ee0cb0d0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025769, "uuid": "d89c34e9-5f67-46dc-8a16-5278e11ffae4", "comment": "Malware payload (AgentTesla)", "value": "8052921f09c58392bda4d4067820a9d7bd36d964635c494c50d04e1a4e485a3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025769, "uuid": "458f7c5a-eaf7-4d5c-be83-eacc4981cdc4", "comment": "Malware payload (AgentTesla)", "value": "ab7a165e5470a7b8cce233e88416b98e55b13da4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025769, "uuid": "fa29becb-6094-47d3-8a7f-0f1fb304e72b", "comment": "Malware payload (AgentTesla)", "value": "a27e250303facb6e22174b344c488a5aa335a029072db6ff3618a0d9e39563d76b7f8f386d1ba52fa5598a4c0e7f5e35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025769, "uuid": "f270c019-f42a-4fc1-9cf9-c35b98da709e", "value": "T1A26533654FF82CB81388133DF0BB8D2D16F50F8294BEA54DBFA8D046271D7925A4787A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025769, "uuid": "e1fcb0cf-80ea-46c0-adf9-6f4b89e4cf69", "value": "24576:OtX3JSSLyHByhAwokjXHPLD1bnd7wbtQn5FwfjH1ShCQUHms:63i0hnPZx8btms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025769, "uuid": "b33da1a3-82fa-4b74-bf62-68da1f353278", "value": 1462376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025769, "uuid": "b8ae2fde-67e9-4450-8567-6df81bf51179", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025769, "uuid": "a1700719-5e51-48c3-8680-962760d573f9", "value": "sirdee.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692a1dce-ae93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761060859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761060859, "uuid": "422a9f35-5de7-498d-810d-0b89ad1afc4c", "comment": "Malware payload (Mirai)", "value": "fc95fea068879652ebaebb1acb3d1b21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761060859, "uuid": "a64094d9-622d-454c-bce7-b43b48b7458b", "comment": "Malware payload (Mirai)", "value": "8072fcea6c878103b8c9b10b09eafd03245ed706bc7884c6943c907dbf4191b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761060859, "uuid": "4340c3e5-8646-4c01-9562-a98e0e3cd7d5", "comment": "Malware payload (Mirai)", "value": "d7b77c955a37ed1a178d2a0f175ccd4b81a4e094", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761060859, "uuid": "89aa0317-33b6-45b7-b4af-cd14185daf2f", "comment": "Malware payload (Mirai)", "value": "366b17a8ca9e62cbbf88c48a9b1e581bb36da0b6d26a747481d9329edf33e5d067ebc1a55965b609b97f626f2dbc636b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761060859, "uuid": "93118cbb-93c9-49e6-88af-048fbf076930", "value": "T1B6E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761060859, "uuid": "fa87d24c-302e-4e4c-9268-483896c3f111", "value": "3072:pUkePnVUPX1JJXJUwbY+a9scgTbOCm3DoVRpL:pUHt4jJXuwbjaPr/3DoVRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761060859, "uuid": "f337a8e9-2a48-4bc2-aa56-77242388cc49", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761060859, "uuid": "dbbc077d-37a1-4c6d-aa94-0992a818f438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761060859, "uuid": "8e06c0f9-af9d-4470-9eec-e8d229890c8b", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4439579-ae81-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1761053335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053335, "uuid": "a055b6b0-9988-4f65-a2d9-ebe056db88d4", "comment": "Malware payload (GuLoader)", "value": "dc6a8534330dd44c6174624bc38ea463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053335, "uuid": "96daa3f3-6680-4abc-ad2f-8c42640a62b3", "comment": "Malware payload (GuLoader)", "value": "809b67ff6e9e4623014772f056f0bc300749e019ebcd5c661d7939e59c4847bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053335, "uuid": "12d1a1a9-9149-4414-9032-8d74823747f6", "comment": "Malware payload (GuLoader)", "value": "4b2608f1de44a82a21162466e9c27b18313375dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053335, "uuid": "4d477da1-3fe7-4eb0-83b0-880137aba6d8", "comment": "Malware payload (GuLoader)", "value": "375dd1db8e3d80e59eaa6a4deb76c0f97d52842b58a3dccc2da6ae75d14720034d2c7a485c97580bf599e6e1c9040021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053335, "uuid": "9a47f000-14af-4e53-ac1a-ce29a91c78c8", "value": "T1ACD423197BBCA042C9D643F04F67CBB98AB1BA58745D47673B01BB9EAC34792452C323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053335, "uuid": "a489f348-dede-4bdd-bc7a-0840085a5951", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053335, "uuid": "99b35e52-aa96-48d7-817d-f5afccfa1644", "value": "12288:fkyhh2f9g00xxtgC+PnrWaDREzpjrh0GuhzFovyOmxJMUgdCPNkuVkzIcW+5rX2Z:D2VgIrWatEzUDFovTIMUgdCBkUcTzo0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761053335, "uuid": "7ad82982-b388-4fca-ad5d-0026a3ec4a1d", "value": 608072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761053335, "uuid": "52b75fca-5f44-4c2c-847f-9282be4f139b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053335, "uuid": "ecf8b549-19c8-4b28-a6aa-271de8c97d62", "value": "Spidshundenes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82b5f0b-ae32-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1761019330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019330, "uuid": "4aa8274a-c8fb-4de0-8736-b71637e37034", "comment": "Malware payload (Vidar)", "value": "43c4c10e1bf981dc82593a19d730705e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019330, "uuid": "c98d8914-a097-4ade-b7ca-87b1cc1f6dad", "comment": "Malware payload (Vidar)", "value": "81ebdaaadf64c1a82e086afd696e217469d68dc4a89709e447be2d7e78b53410", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019330, "uuid": "53a2c3a0-94a0-44a5-8032-e560bd6e128c", "comment": "Malware payload (Vidar)", "value": "9c56c6c2cedc60e1062914bb07c2875a98248302", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019330, "uuid": "d48ebd97-b674-43f4-a968-7ad02ff64f50", "comment": "Malware payload (Vidar)", "value": "fd82a3f42b96d84d01463958801d963f882df0c290dd2f68358a421d3c9602ec72a42926cf904bb71b5408abb6952c7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019330, "uuid": "6051b60c-4fe8-43cd-a2e9-0f14492b581a", "value": "T188B5334F88E6BC8EED58987488355B65B7D9DB052416DAFCBC04B1C8CC8BA1186FB1F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019330, "uuid": "ecf90042-c178-4d7a-b21e-499c939d33d1", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019330, "uuid": "d629ee97-6801-4983-b62c-2736aca18cf5", "value": "49152:OYARah6cMhpOWAKkjVBeBui14Kn82OlSMist28osdSpLr+XrObz0:OVRah6lhpvARjHeBR7hMist2eSBCb8z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019330, "uuid": "9ae61c29-3922-4376-973d-ce6671ce40e5", "value": 2448896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019330, "uuid": "e37a7a2c-1a63-4fb6-bab8-912554330425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019330, "uuid": "b42205e9-fcd8-4d7e-916f-9a33249cd695", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978b4b65-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063943, "uuid": "8d056e69-9fce-4ac4-85c1-0cc7cf8f68b6", "comment": "Malware payload", "value": "fdc60f5f1c71ddb841eb25f46795cb93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063943, "uuid": "506c0647-4125-471a-ac25-e1439e003fa6", "comment": "Malware payload", "value": "8271442fa37788397e8f7cb54d4c84655198dbc9e37ba11d0a9b5a84361b4aa5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063943, "uuid": "da877bcc-d645-4e16-bb22-e3310b72cd50", "comment": "Malware payload", "value": "531e4368c03e002a759b5cc9974922aa5aace87f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063943, "uuid": "c487f9e9-32c7-4c9c-8b16-d15ecf9f0366", "comment": "Malware payload", "value": "521517086dee37c7919b32d25e61293da698e2f1aa1d36b220e2fa97c45deda2aedc4e12d992d67d3b9f78f17af8e8d2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063943, "uuid": "91475878-c599-4143-b19e-3eab0295f71c", "value": "T1F7A31A08ED0165ECE1A63A487BED65B7FD0CD2797224E471B90EBF11B078E401F96DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063943, "uuid": "cf190ff9-ca2a-432e-ae28-59151606256e", "value": "3072:GDB7b08n3nXnGnlnvnSninFnzn3n6n8nVnkntnQnGnln5n9nynrnpndn9nfn5nCi:06TBiuWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063943, "uuid": "e8eda097-f582-4463-93df-160e935162fe", "value": 104722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063943, "uuid": "376338b8-c7ba-42af-9758-eb97b25ea2ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063943, "uuid": "c1b24231-f1a9-4538-9fdc-a2b0c6e40219", "value": "invoice-1637482117.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2359cb7f-ae80-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761052582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052582, "uuid": "5ef01ce7-8efc-4c19-8688-2a3bd5e7bc5c", "comment": "Malware payload (Formbook)", "value": "7662b969e5de9a46224078963ec8286c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052582, "uuid": "7b70771b-acc8-4f46-b713-1706b74986d3", "comment": "Malware payload (Formbook)", "value": "82cec82230bedc61c4206eb6fe7aa9ed9b3173468b591b77a0a0cfd998869a9a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052582, "uuid": "f95df049-f94d-4d24-9d81-e14cf5fa2814", "comment": "Malware payload (Formbook)", "value": "4a007ce0f1f3d33d8ff44a1bc1da2689eaa66de3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761052582, "uuid": "a746e529-8289-428f-8075-d3b6f4d583cc", "comment": "Malware payload (Formbook)", "value": "985591f4f612bb605d391ab1698c46d40fcf2d544fa745edc0132c0a0e929eb2627c1fb07f943331d01fc597a1c56346", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052582, "uuid": "d99d57b0-875f-4350-9782-ec3aff608998", "value": "T1B18533086AB2305DEA6026C9FD184283DDB1287C8C5C077B7537ECDBCB62739196BB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052582, "uuid": "0905a985-8c2f-48d2-a90b-b7d60f7ee476", "value": "49152:frA1mIOK1uzOm9rpoEgt2TZgQO2BDxkPVJ2oahxx8:fnIOK1uzO9mbO2BDqVlmxx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761052582, "uuid": "d372c82f-2999-4cf2-8407-03e99b172ae5", "value": 1802099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761052582, "uuid": "d32b72f5-4be3-4123-8d99-bff87f424da4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761052582, "uuid": "457e3ef6-e399-4783-af5d-ebae06e0a675", "value": "MOPEXHIS RFQ#2365980.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c71fd58-ae95-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761061589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061589, "uuid": "3c4d9530-60f0-481e-8f21-eeb2f423a729", "comment": "Malware payload", "value": "6c2bab0e80979137ab1df9a37e24c359", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061589, "uuid": "690597ea-853c-427e-b1be-4d7cc9b2d41a", "comment": "Malware payload", "value": "838fa050c80d7d90e0681a569f79938d883bd9d0852e2f9df0a3f95b830c57d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061589, "uuid": "df9f725b-40e8-4f01-8594-f2ef7279bc36", "comment": "Malware payload", "value": "0f4bc7b0d9ffd934b30483b93a3dff8ebba61e32", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061589, "uuid": "f9ec8cba-934f-497c-b019-668c6615dc39", "comment": "Malware payload", "value": "98a5b719e5827926d7f56c1810fcb47dcb0a297b4640044e5b2bcf1ef80165350392bf78379cb9ec58bd7e58d070a635", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061589, "uuid": "8481b2aa-4184-42c9-8d8e-504920d6dd18", "value": "T1D221BE5AE441A3545D92594C71CBC62DF07BC3ED29C52AD9FC5D2E68F6CC848F032B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061589, "uuid": "10157b4c-ec4f-4cbd-87c3-132a57af719b", "value": "24:xoWBGhBh9Mk8QoWDp/Vt+/I/V78/7bXszlHEni8atkk0:xoGGhL8QoWZVt+wV78/7TsztEnBat/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761061589, "uuid": "537edfb5-652d-444b-8507-5e9bca7c3534", "value": 1125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761061589, "uuid": "0f9db3d2-8314-4c60-bb7c-7cfba8147ea5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061589, "uuid": "32c7b6d2-cd00-484f-bee0-00128cb2edee", "value": "av.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1df373-ae5c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761037238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037238, "uuid": "da63491e-e67b-4cac-8016-6a8a8d8563a7", "comment": "Malware payload", "value": "d56d8bce6be5c658dccdd2d09245ef02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037238, "uuid": "45459dc5-0ee5-4a3f-8562-de835a3b0795", "comment": "Malware payload", "value": "83c886d04b54df7265e9a0b8e48a35578074e0d4807526c14f8d80821c4d8bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037238, "uuid": "00332a6c-7824-4d7d-88ab-955d86cd31ed", "comment": "Malware payload", "value": "cd4ba0c62bc0f2c56b26e91e7b3950f9f3cb807c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037238, "uuid": "da6d4939-a4fd-4483-a128-1467f3971b3d", "comment": "Malware payload", "value": "70c3fa5c41172c09fd5a8877d61730a8d951dae6ce3ceb86a9fae4939b1a1b31c074f6b4dfd38cc8847ba8b0cf84f7d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037238, "uuid": "cdaacfa8-a6ad-4934-97bb-5926b01f047d", "value": "T15D4612D254B7E4FDCC838A34158E0C89DAF8917446E83A3C39C668079C77E9A58C9FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037238, "uuid": "804ee7aa-e9c0-4b1d-a6fe-f58034d3b2aa", "value": "bff37c7a49190d2c339ddd01860611a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037238, "uuid": "d9190ccd-cb6a-43b4-b9dd-33b51a795351", "value": "98304:P6h7ueSpfeIUY9G5AClMSPQDdgaI8KH3/6o7LLpNg14gfgrRNPkeiqaOfA:PqAeIh9cAClMqWEHv7rg13f4Xs9qaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761037238, "uuid": "0c52ec88-b219-4161-bf73-cd1dccf7f250", "value": 5550592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761037238, "uuid": "ceb2a9b1-3dff-46c6-9434-5cb3cd469128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037238, "uuid": "f6affbca-2010-405b-bb54-3991272dc4ba", "value": "samdrv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca8fd5a-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064033, "uuid": "939dc683-e4cf-4d10-9d7d-e4666f855a73", "comment": "Malware payload", "value": "626a0a4e5e06610fc559ce945aa172ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064033, "uuid": "fda3454b-eaeb-46b5-a45a-b04689cd1993", "comment": "Malware payload", "value": "8474b54918d4ccd0648cc78774b0d42be823a8a87e6a183d3e6091aa3d619bf7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064033, "uuid": "a763e284-a54a-450b-9c9e-da077d52557f", "comment": "Malware payload", "value": "e64f9364f95613ce3283555b2beb1b0620840345", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064033, "uuid": "f8dde20d-8d31-4a50-a43a-4d2f45262886", "comment": "Malware payload", "value": "07b73a2da51fb4cd0a2e8c1103e8014874084e046c054a84f1ee41f510381b4f1d7e246588256a26e8c58a9d83bd22e8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064033, "uuid": "be4afef5-e015-4ecd-99ca-93ecb7cf6f07", "value": "T13DA3E8BD79BAB9DB158C1EA986C124E5C81CE416CF191088A7CFFF9241838ED05935EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064033, "uuid": "2e724f20-3656-4a72-b487-98f41ff35127", "value": "3072:GDB7b0ivupcEdb9PlCYnKfUen4nOElYSOG9H3HQuMfEg6BkQWkp:0XvocEdb9PlCYnKfUen4nOElYSO+H3H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064033, "uuid": "bb5c9b1c-fa08-45dc-8693-7deab10475bd", "value": 102117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064033, "uuid": "73dbebd8-6c94-44f3-a6bb-437a5e87c7b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064033, "uuid": "358fc572-d264-4ada-ab1d-498868fc352e", "value": "invoice-1637482117.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849a7d1b-aed2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761087963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761087963, "uuid": "6ecfbc6e-3cec-4d1b-9773-afc6414ce4d7", "comment": "Malware payload (Mirai)", "value": "c8aef8dde4b7b86eee709b3f065ba445", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761087963, "uuid": "337dfc92-eb87-4591-861c-d3426a3a4972", "comment": "Malware payload (Mirai)", "value": "8568d149ea0a5c6454fa0ab6847ffec04b84f8c8e08e9122b6212eb0b18a9123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761087963, "uuid": "6f66c2d7-9873-40e5-a86d-2169dcf00ae6", "comment": "Malware payload (Mirai)", "value": "93a04c8f56c030dbbc09fec80bcba0e564a23f09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761087963, "uuid": "173059d2-fb38-4d7d-85ee-307f38d83e8a", "comment": "Malware payload (Mirai)", "value": "c1b792ef96b0a8b2b5bef7ca3f1522a97b8e1777b9f5e90741c07ade123be9a0cbb87692ad8eb8123b83531b0358b030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761087963, "uuid": "6b5cdc8c-0d76-48bf-8dab-188ab155ae24", "value": "T1CA442946EB404A13C4D627B9FA9F42463333DB64D3EB73029918AFB53BC779A4E62501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761087963, "uuid": "4d17ba62-3deb-4b1b-8424-d1c46cfd93d7", "value": "6144:sTFlUXNYYU5FmAWkSinaqGFSsb/WBp9hmdFPGjyV/GZ7Ar:sTSYYU5P/S8a7FSsb/UzhKv/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761087963, "uuid": "917af5b2-50cd-49b6-8511-9ca343de1f39", "value": 257765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761087963, "uuid": "75baa29b-5d7f-4284-aa1e-f84539a916c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761087963, "uuid": "2d73da0d-c0c6-437f-89cd-30171e57a6be", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0517a75-ae98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063180, "uuid": "fd781f15-372a-445b-9e10-4770ef2758e7", "comment": "Malware payload", "value": "1496cd0b2bb2f7fe57666e8ff9aac7c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063180, "uuid": "4d84e03b-6487-4154-acaf-8f75075684b5", "comment": "Malware payload", "value": "85d1120686e391202a65fafa9ad76fb4df5666371219b2dcab90f2da2c3e045b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063180, "uuid": "6079854d-2cc9-464e-80b0-b8489c6bb12f", "comment": "Malware payload", "value": "fee5172a7871ed4ec44a448538a783369053947d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063180, "uuid": "8e3bdadc-5b22-4825-ab59-ade5875b67d8", "comment": "Malware payload", "value": "9f5643f2bc9394e23f7a1903f79ddf750978e9eb42f22ee0e13911bfd4858f77616557658a4551267cd28c48090d7530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063180, "uuid": "90f8ce88-a448-4ced-aba5-41793af2a369", "value": "T1E4166B1759A56699C07EA23898A3568137387F002B3373F33B40BB793EB32D52536B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063180, "uuid": "024bbd39-b852-4a53-a703-c669ae757ad6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063180, "uuid": "4903d69c-d919-4aef-a3b2-b84919308eec", "value": "49152:2/4ZxTPTE5tAfnJ2qERmKR39QAg8hb6TExCmvp17RNRz6XQ3xkDm+/:2jYeRnzJx6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063180, "uuid": "3658d43a-0ee2-4635-a79f-0c0bfef9b5ad", "value": 4156032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063180, "uuid": "7ef77c63-4749-47a9-9fc8-2f123af1f1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063180, "uuid": "553d879a-b374-40f7-b8f6-c3585fd48da4", "value": "Boostrapppeer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875c3f66-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063916, "uuid": "5454da3d-90f1-4029-9c76-2fff638f4025", "comment": "Malware payload", "value": "4d7e9033d027a68b63e96b4c6507f549", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063916, "uuid": "ceefd960-1f54-4492-b6c7-227eb37c6bf7", "comment": "Malware payload", "value": "86b747117a457d0063a388d916ee646fe36b412b8c6a3b8afa278a961b54d6dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063916, "uuid": "f50812ca-8742-492c-b2f0-6cde7c2304ee", "comment": "Malware payload", "value": "169c851a4f0b74a38df85c5295c7781120658af0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063916, "uuid": "1fca7ebe-3123-4933-84c1-a3bc90de0ef3", "comment": "Malware payload", "value": "54acbec718d2d1bbc7fba609e85d320addbf722b88578f1a18ec045b3c3ebad358f5aabe343d8c34fc0aeb2e409eabb1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063916, "uuid": "30e2b144-5bc1-41f7-adda-0b78b76ca81b", "value": "T14EA3D7E28903FBA93469D3606EC05836E0CA4792639169CF905EF33D6E5C7D63616EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063916, "uuid": "59a17c48-8ed3-407a-9c8c-6ff888d44866", "value": "1536:GDB7eKg204kS7wugx4Jbin4KPX7wE5M7HTtzGu3Jz961x5Y1LZ6126GBiUl+rm7w:GDB7b0DHXmCkb6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063916, "uuid": "829c2428-c35d-43c5-93c1-2245bde3eeea", "value": 101499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063916, "uuid": "2eb6f7ee-82ef-4734-92ea-60490e50da76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063916, "uuid": "e424f5ee-5489-49b9-9b2e-cf409bbb3267", "value": "invoice-1637482117.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c3c75c-ae51-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761032698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032698, "uuid": "ca9299d7-7a8f-4bc8-a9df-d7cf7a049bc5", "comment": "Malware payload (a310Logger)", "value": "4258d2a55cdf856f10a986cf7463435e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032698, "uuid": "db3449f9-da62-4585-8582-b62e5b6ee04a", "comment": "Malware payload (a310Logger)", "value": "86c2dd655edc3f517215c742d21343b4bf5b40c16b4bd6907812aa8673b0654c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032698, "uuid": "33f04902-4103-4d49-af08-b375378731d2", "comment": "Malware payload (a310Logger)", "value": "5a61f4e32a151bb1fe6ad2240b5672d874fbbce4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032698, "uuid": "581af2f5-b793-49e4-9fa6-7a83f2143193", "comment": "Malware payload (a310Logger)", "value": "822d79f9f2763426680d15fbdbf13c44fe76300e08edb3bf1a05b661c35b1ae33e8861a4caaa942ee9941926b0294a88", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032698, "uuid": "58f48265-6137-4984-af47-f06b77878ad7", "value": "T14975D012EE518D3AF02E3539D81BDAD6541D7EE02A25B82E7AFD3E487F382C37416056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032698, "uuid": "a3d2f593-5469-4aa3-8c60-47a4d4bf77db", "value": "24576:t1x9k6hSHdKu0IDGgCQEtiABqEs7Do2InuIxlgUpNLJZb2K2p:tZEZEf4Ho2IxxlFN7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761032698, "uuid": "6d8ec5c2-de63-49b6-b29c-4c5e8ee3d713", "value": 1643008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761032698, "uuid": "e153d1b1-e543-4b18-8f71-a73b8b5391f6", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032698, "uuid": "97d0db20-f948-4fb3-91cc-7158c0233a63", "value": "Payment Advice_pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c7e184-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761025653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025653, "uuid": "f34814c2-8a6d-436c-940c-3d4faa4fc976", "comment": "Malware payload", "value": "a7b5ddb484b9001539c5f81d8dc41a1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025653, "uuid": "422bf20a-8492-47d6-8cfc-e25b5b828feb", "comment": "Malware payload", "value": "87f8a84a88c4d7b5eed769d5ef0f8965d12bb06e36e40dbc98cbd4844912b6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025653, "uuid": "b19797a1-7bc2-4a4f-92f5-76bc040034d8", "comment": "Malware payload", "value": "497895ae5b837be68ee1fdd633b314421f12073a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025653, "uuid": "a3ed8142-6d0b-4dfe-b7aa-98f18ad884a5", "comment": "Malware payload", "value": "c725781eb4bcd9764d250587ed2f85730d8fdb08f2d5dfe3f3ffe439b06e695b9fea2495e828b9c2001d2dbda35b255c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025653, "uuid": "1fcdfd65-aee1-4b79-be47-d6d777206dcc", "value": "T18BF6AE18A3E504A1D47BD734CA65C333CA74BDA25A39D50F0959F2861F73A628F2FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025653, "uuid": "8601fc00-a605-48a4-a6f5-fc12d3bd7d39", "value": "35522303aef9889fc01a52e17aff81b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025653, "uuid": "1e09096b-c0fe-483f-8c98-f90af3a1bf97", "value": "196608:Dz44WaW0D/C5yWjOP9FLcKQfP4NJfOyLowr:P44TRD/C5FOVLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025653, "uuid": "9deaea22-49f5-4dd6-8315-362b6821ba5a", "value": 15308288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025653, "uuid": "855ba7c8-f848-416b-b5d5-261dbbf32b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025653, "uuid": "cbb089f3-81d8-4da6-a138-a2ec4b032195", "value": "atom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0f782e-aec8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761083684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761083684, "uuid": "5e217622-ef55-474a-b145-10c133cfa4a9", "comment": "Malware payload (Mirai)", "value": "eb2125a41db7d50f43cd2b4f163eca8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761083684, "uuid": "7821eaf6-450b-4393-8531-a337e02a0428", "comment": "Malware payload (Mirai)", "value": "8913b3517e3b2eb6bae298b66963d41e75084dda6ab113c64b1e15bfd4d5796b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761083684, "uuid": "0ebf28f0-bef9-4f16-abad-a3cbc8e404d1", "comment": "Malware payload (Mirai)", "value": "0c5ff994b46442e40e4f479c85eaf3ad24ab9e8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761083684, "uuid": "7822d7e8-7e47-41e9-8ca2-34af9a4229fa", "comment": "Malware payload (Mirai)", "value": "14d63223492b0b070143553327d786c499f8efdb8c3f8301c5f61a3b721b2b4a2f77c65e7378387fe3c7054c9fd2908f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761083684, "uuid": "d9a56c8a-487e-40bc-9130-56821deeb507", "value": "T1EC34080AAFA10EFBD8AFCD3306E91B0124CC641722A53B757674D918F54B64B5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761083684, "uuid": "7f030908-0399-43e9-a5e8-01aa537af7f7", "value": "3072:XQ7FtEyddwaez5tiNg9W30VLQUiATShQu2XXY1LGro2F7UTQCs+g0:XQ7fddwa+teEW30I0CQLsQhmQCLg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761083684, "uuid": "31de5bd1-5386-48dc-8c6d-393ad883134e", "value": 239680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761083684, "uuid": "900e6e58-1290-4409-b973-832f89800300", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761083684, "uuid": "21dcc779-5cb0-4338-a4ef-797e7d39d0e9", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ff99eb-ae40-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1761025420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025420, "uuid": "77003cbb-f934-43a6-a950-20dab4e8489a", "comment": "Malware payload (DarkTortilla)", "value": "34bed8f08fb73a626ba9806a284654c1", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025420, "uuid": "8d26a865-97de-4859-8774-af47629d1170", "comment": "Malware payload (DarkTortilla)", "value": "898aedc9de508d5a88e225689c03908dbf7ae7f86067cb2930da7f53143e9b97", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025420, "uuid": "a0875645-5c12-44c1-9311-d803bb3e4ff8", "comment": "Malware payload (DarkTortilla)", "value": "bcd9f69ceab729424a1532db97379f0690062063", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025420, "uuid": "cc412344-0297-4c8a-8ab1-d784a5cd0772", "comment": "Malware payload (DarkTortilla)", "value": "80c85002a8b4a3db499db8e582410d41f7e52feb14823857571e9c523b85375ca5719e756a1d7e2502acbf689138b6a1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025420, "uuid": "75ce9794-fa6f-4668-be1e-4cfd9ed1fe65", "value": "T1C405CF4B4AC94CA0D83C9631E3647915C7F8F586BB17C29E6FD58BEC66392233B4134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025420, "uuid": "ba84ce10-0547-4169-8b9b-73350394b9d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025420, "uuid": "c1209a1a-80a7-47a7-9783-e5d218a18f94", "value": "12288:69JHM9+1y4mzNq1+JtqzuSoVWkC3vAXwpgC6gdgXJ/:UHU+OuitEufVWkC4XwpSZ5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025420, "uuid": "0c85fc19-4545-449c-8ee4-c829be9eccd6", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025420, "uuid": "95cb3f8b-2ced-4952-aa55-532adec42c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025420, "uuid": "878d48ef-c5f8-4c05-9a2a-f4d527273e7a", "value": "COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4ce4e4-ae33-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1761019579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019579, "uuid": "d3915676-a2cd-4fc8-8456-e1edc8863e89", "comment": "Malware payload (GCleaner)", "value": "395be10678093336d0a577eb6c092247", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019579, "uuid": "c89294c4-43cd-4c5e-9556-992eb2f6e8ab", "comment": "Malware payload (GCleaner)", "value": "8a2d73a285e70d2cb0fd970ce2a0fe531edce68764ab0e6b7a5e0b13352361ff", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019579, "uuid": "abb73047-6b42-4447-8f95-2b19c8064e7b", "comment": "Malware payload (GCleaner)", "value": "b8509f34de53892edf45ac3a9fc23c240648115c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019579, "uuid": "0055462b-f7f0-450b-8135-e399c8c2243f", "comment": "Malware payload (GCleaner)", "value": "9a463c530d8e6795b2cb4f47af7d73ebb888be69aaef09a03c8291e599930ad4a38bf09101122d2e7e3c9893b75236d4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019579, "uuid": "59ef4214-d21b-479c-b210-985d0443b184", "value": "T19E16F156A6B79176D4459DBA4F5AD23C0C3A92587F307B6339D23D18EEE8703006E8CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019579, "uuid": "97f63c2f-9be8-4295-9abf-f7c98ba527aa", "value": "78a45e959efc07af567f9c2b889acf08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019579, "uuid": "1c580cdd-4840-4da0-8aca-fd5629f8dd1b", "value": "98304:7evIn8iL0iv5M/nk8AvewjaP0FOBeX50h4gjo7ZT8/c8s2:yvI8Nk8we1P0FW250+OsZg/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019579, "uuid": "e1ca4d25-d5bc-4e82-83f1-481b4babc239", "value": 4074784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019579, "uuid": "3d89faf2-6f4e-454d-bd1f-b723251ae1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019579, "uuid": "b69ee5b8-c8ad-42e6-b3c6-d4eaa241728a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325d78a1-ae6c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761044017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761044017, "uuid": "60538e03-75e3-4241-9129-7e885f79a4df", "comment": "Malware payload (Mirai)", "value": "0b821e8c622337ec5a8a71ff9a183cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761044017, "uuid": "6df2afa8-c1b8-4c55-a985-3092fba353de", "comment": "Malware payload (Mirai)", "value": "8aeb29ac9fae13c598c8e7e3857f8a19852b75cc7442f038db422b538ad4ecc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761044017, "uuid": "ef00a50d-3d7b-4097-a03c-367dbe66968e", "comment": "Malware payload (Mirai)", "value": "e019891f628d8e019e2225d5f8af856699bd16e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761044017, "uuid": "7834b3c7-dbd8-4270-892f-8a1436123e40", "comment": "Malware payload (Mirai)", "value": "bd46dbbbe20bbc8f04aca9799ff48c2fab451c8d51f4a65f3ea886adaffb26526226f558769c49120b1121523135937d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761044017, "uuid": "c8aed7d4-2ee7-4fbf-b62d-7b0b54dcc62f", "value": "T1F3B34A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761044017, "uuid": "a4f808e1-f566-4d17-8a0b-f804cd6815be", "value": "1536:1a97/6/q0AmnClKL9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/zB:1y6HClKZn+MCISxPKO8WL7t4LbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761044017, "uuid": "e494191b-849d-49df-911c-e0120ceedec2", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761044017, "uuid": "d6aba115-6344-495d-8441-7e2e7385ab85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761044017, "uuid": "40e93c8f-7899-43fe-a0e3-881ad9bf98f1", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824b10d7-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076793, "uuid": "d87bf58d-c18f-43ee-936f-c6f4fcbae409", "comment": "Malware payload (Mirai)", "value": "55fd3d66b2dcd932269941dc2a74edce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076793, "uuid": "0bf4bc00-408d-4de6-a44a-7f0956aed1a8", "comment": "Malware payload (Mirai)", "value": "8bc08b90618197e12c1246ebd2c8c7e956a67c20744ee308ea202aedaee9a120", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076793, "uuid": "4f271489-f49a-4e49-abd3-63ebaa496c56", "comment": "Malware payload (Mirai)", "value": "d368012ebae867066fa7045535647eb3b8ccd402", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076793, "uuid": "eab738f3-144e-424a-a60f-f73f9f1cf7ed", "comment": "Malware payload (Mirai)", "value": "3cb91de41cefea8acdeb96ba90d8d3f3856adcbfa8d7f437b44431d5d8eb06cbd96198de20153274f8d11751e0d2750f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076793, "uuid": "44f65036-09df-469a-bc15-1674d5fbaf7d", "value": "T1D204B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076793, "uuid": "9e151e89-c388-4df4-ac4a-f8927c4e612e", "value": "3072:nKpzGjeNkSfcQqmav8SqaRVlnYz65nVt:nKYjeNYQqmeqavlg65n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076793, "uuid": "f807521a-c115-4def-ba60-118b05d85067", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076793, "uuid": "32ef2171-4d4a-4b42-b260-7fcf8b8d95ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076793, "uuid": "6f80e776-ddb7-43ec-8a8a-fd64ae8c5623", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1922a67a-ae95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761061584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061584, "uuid": "51638df9-b6e2-4194-a9f9-29ea6cc39e1d", "comment": "Malware payload (Mirai)", "value": "5e2cab96cf67dedca3ef4272ad3a04af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061584, "uuid": "bed1cf57-40e0-4dcd-8159-408c6e089d64", "comment": "Malware payload (Mirai)", "value": "8c135cf6071f5a78cffc54185f8447f8da4b1f788fa6f19cfa79ad6989452091", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061584, "uuid": "5a8ee5fe-97d3-4ee1-a023-805a9ce136c7", "comment": "Malware payload (Mirai)", "value": "f14514aa3957b26ea1a44c5ef47bbd5078eb19e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061584, "uuid": "ad281103-b296-4596-b507-a4b8ce851c60", "comment": "Malware payload (Mirai)", "value": "c7e29f87f68a575bd18c8e46c91eeb2e92980706a1722877294b266d7c0b66f4f12418fc8b9c7ad2ad111cb866ad0b15", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061584, "uuid": "a8956224-84a8-4cf2-b2cb-c4064ce2467e", "value": "T1B22124DF65D133655CD49D80B0A28C25F02FE3D53CE02FE9F65E38E6A699810B016B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061584, "uuid": "f1dadc95-d3ea-4598-b3ea-45ef622b91c4", "value": "24:boWBGhBh9Mk8QoOwtOe4JNA1iifKjXcatkkK:boGGhL8QodO/JNA1iifbat/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761061584, "uuid": "7f11829a-fbd7-4cfa-9d09-be5978a965d9", "value": 1243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761061584, "uuid": "cb216c1a-e75b-4519-908d-3cda3cf31df5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061584, "uuid": "2735f7ed-9089-49d1-8d02-3ed58a9c7380", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28c708e-aeca-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761084578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761084578, "uuid": "a5c06311-27bb-4a08-b9fe-e53a80d3463c", "comment": "Malware payload", "value": "1bd4520349b34e9bc7717a5a12cb41cb", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761084578, "uuid": "827d0968-6758-46a1-b640-5d6fbf6c5b41", "comment": "Malware payload", "value": "8c3a2713cc7faf53292331131628027416fd4c65a54a8d70ab7fc526f21ffb6e", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761084578, "uuid": "eadf8990-5117-49b8-ab2f-4b2c12574003", "comment": "Malware payload", "value": "4221443aaf9cab43fe436a34f172d885510e1413", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761084578, "uuid": "e28c1e6b-69cf-4ae9-8b33-557c345d5b50", "comment": "Malware payload", "value": "8f59f5ba65ede451f3d26036c96f82a875889a48e6c0aa8dec6012d3148d7e7c4df3fb72d6c3ded416c5189c77ada8c9", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761084578, "uuid": "38efacb2-b9b3-4c9d-a21b-a9706f21d999", "value": "T1FDC5C05D94B05D926024FE74A6C5F7978CEA13851A174B930FE5E2A63201C43FFBB3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761084578, "uuid": "52e21fcc-6c89-43da-8936-2361475c068b", "value": "24576:z27TZbQLUBqvHmNJteHdbnFSsACYmiSYVqwywi3wit2Bz7:z204", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761084578, "uuid": "276308dc-4a1e-4485-af92-4058c3e17ffd", "value": 2627822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761084578, "uuid": "d8fd08ae-1fd5-46ec-b849-1825e9c57b2f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761084578, "uuid": "c13a0962-f971-454d-80fc-ec5d4813c235", "value": "secv56fghgh56n67878700hhhkhjvdgfdfg90fgf6555f56656.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc55d3d-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761024658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024658, "uuid": "5a9f30a2-bcc8-4f6b-9c03-458d0adfef72", "comment": "Malware payload (RemcosRAT)", "value": "389a3a661fa02a8e3d2d9d1fae5a612e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024658, "uuid": "7939fc25-a51c-4311-a995-08fe3aaf6f3c", "comment": "Malware payload (RemcosRAT)", "value": "8cce07678037a7962fb05d5da9fb8cef36a31265e1800e96158ca77b68f1aa73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024658, "uuid": "1272e603-015c-491b-b26e-c166fa65297c", "comment": "Malware payload (RemcosRAT)", "value": "527f2c2275fa75886930aea6b9725421d9efe149", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024658, "uuid": "833ff72f-091a-4e2a-8e38-3e7fd9bbcd1c", "comment": "Malware payload (RemcosRAT)", "value": "a3c4086c4e4faa2dea5567fed38fa02ccd4608ace5fe8102b29ef65f5eecc8e1afcfbea41eaa8e5696e7c6f8a5fec002", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024658, "uuid": "ff6e2fd7-9b7b-4632-938c-00293aa99bae", "value": "T1A72612A9263C19E5D4FD3CBC4F3FF5187614044EDB0A8DA9B85A20EF0B272E47562636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024658, "uuid": "9451931b-93a6-4903-b5c8-4cf148836315", "value": "768:0kbXa/tGWNs4fVxcnbJkpDYZza+G9QYpzvXhLrUS+0emPfTWpelnzHJ7xXa0VxeB:vTajsSJB+GiErWpGVxXa03eKC6B9Wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024658, "uuid": "0b6544e9-6b84-442d-86df-c8467213f45d", "value": 4628321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024658, "uuid": "48dcc4c6-9033-42cc-a0b5-5601629c5980", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024658, "uuid": "d6bb8447-f434-4f8a-9f53-b52267fec0a8", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89b62a3-ae46-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761027975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027975, "uuid": "2cf3cfa2-e6c1-4955-afaf-f91b8f623399", "comment": "Malware payload (Formbook)", "value": "5bb45171d0f8c97ff6951d2f756115eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027975, "uuid": "9cb6d4a7-9ddb-47aa-a334-79b12b0ff6f0", "comment": "Malware payload (Formbook)", "value": "8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027975, "uuid": "91e36d77-021a-4905-b60a-f06cde61ec3c", "comment": "Malware payload (Formbook)", "value": "e159b79e4be1d90105adf342f794c93d80dec914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761027975, "uuid": "a6d284f4-1e01-441e-9e31-a4acd419c481", "comment": "Malware payload (Formbook)", "value": "5ba4135762cbb9e973d61f983f52e2ac91ec7081d9eafd136e11bcb9111ad07be12c5e66b2116e4ff2e9c8b438daf37c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027975, "uuid": "1a059523-02b4-4982-9cf1-89a6cde19aca", "value": "T1550512583B9BDD12EAD157B509A0E3B103348E59E510D2078FFAADDBF429F66781C2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027975, "uuid": "c7625205-3928-4aed-9ec0-f94e5060b09f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027975, "uuid": "d6b4b4db-58f0-45f1-96ef-01a11cbb1c17", "value": "12288:vBBf7GLK8w2OKwH4OBYOiRtaOP9HZGJ8twqMQGcwLofZsF7M6OW0B:vvf7H8gBYOizRP9HoitJM/c6oBsdXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761027975, "uuid": "0731feac-2574-4af6-91f8-6c049087b0fa", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761027975, "uuid": "30eea277-1571-4a1d-9b60-4f2d563e441e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761027975, "uuid": "f4a6568d-b2fd-4bc9-8b24-019df2624ae1", "value": "MACHINE QUOTATION#005464511MN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1586bf-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063951, "uuid": "65c40619-6bb4-43a3-a85d-30c77232fbdf", "comment": "Malware payload", "value": "d3895a931c58048b6b1045dbec02023f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063951, "uuid": "e3a830c1-fba2-4924-8f62-90c986adae4f", "comment": "Malware payload", "value": "8e10a729b88aee94662030d5c0560d212c8ca12d8829b9c0a236a44886cf337e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063951, "uuid": "273e949b-0bc8-4a52-ae71-faccbb7a27ab", "comment": "Malware payload", "value": "182406f79dbca14d97ba6e59d2c7de99212510ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063951, "uuid": "2a72e871-7537-47e5-982b-93bc3d0c3279", "comment": "Malware payload", "value": "d2eb776718c4d34748446e3c1685c13b22f94fa1f9f2b01ff8be0ecd3608b37766436f9fda49a4f6e6b29aebee9f1ef0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063951, "uuid": "6915309c-96fd-484e-8c3f-73dfe2c7cb29", "value": "T115A3F91C2FA33E5400756560567B9EE8C8979DF10330ADB499CDE628E142FB21F8E9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063951, "uuid": "2f5af2a8-387a-4d08-93e3-3afaadb8c38f", "value": "768:GDhd0i7J4sYKgY/CMNfWdnbC7NCQrXD+rm5KkHulAF12pSLAuAAroQW+FF+Ec+0G:GDB7eKg20Kryrm5KTlAFYp6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063951, "uuid": "25711f81-27a7-4f81-a176-4341286a8c9a", "value": 100080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063951, "uuid": "0c716557-03b2-42dc-878f-c112f49c5d7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063951, "uuid": "25105994-467a-4dfa-be01-d16477c5020c", "value": "invoice-1637482117.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b768dab7-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063997, "uuid": "a4f57395-cfe2-4f6d-8942-d82e5e6d90cf", "comment": "Malware payload", "value": "6d0f3ca975f70d02d56b4d058c582df5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063997, "uuid": "cf610bf7-4f29-4546-8c0a-a18b0defa1fe", "comment": "Malware payload", "value": "8fbe4015597fd4d30bdbf1c52749d1358f2f2018109223298f4b4e7a26e9cbf8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063997, "uuid": "4e8b9d66-cfc9-4df0-8d92-a617c480cf8d", "comment": "Malware payload", "value": "0fd21b8bb29de422c9b76ae4ef6c7ca320f769f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063997, "uuid": "8db8b643-e500-47ab-9715-2e6edc982134", "comment": "Malware payload", "value": "20e3c86157f6bc55b5b2b858934fb0ba46071fb11ddf5bb49b2c586ba3c3988ee773d4a8c0af39c4ed11f6b20857936e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063997, "uuid": "5036f1d0-1c3c-4983-9729-3081d4047a68", "value": "T123A3E8054B81CCFA27535E4F1EBC32F388958A3F1A98471863D572F98762DAD18AD387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063997, "uuid": "e1bac607-1571-403e-9c36-13fba7139a31", "value": "1536:GDB7eKg20V2wPl6okrVMlGRr8U6oqaew7NDu88kN2NTDuAky++lHODLfX+cj0WLS:GDB7b0Vcnt+hAN6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063997, "uuid": "dd34ac5f-ec8f-4f11-874d-32c289a1aa19", "value": 107262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063997, "uuid": "0ab3cadb-4b56-491e-8e74-486a70fed0a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063997, "uuid": "4bf2ac86-437c-4ed0-8b5a-7973be1bc19d", "value": "invoice-1637482117.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6759ed21-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761026067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026067, "uuid": "b1167354-623b-4dbf-8bc6-ebca6afc4d7f", "comment": "Malware payload (Rhadamanthys)", "value": "e09ec3c3df6a8cb5f93a1a467cba7e89", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026067, "uuid": "f85ca7dd-39ef-40cf-a5a6-519dd3eb8464", "comment": "Malware payload (Rhadamanthys)", "value": "9007661e48e9d4b325029b08a941aa99d315e33be6496380dacf238f0b95ccf3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026067, "uuid": "aef5b01e-46c9-40de-ae81-fe82712e3d14", "comment": "Malware payload (Rhadamanthys)", "value": "5f2e1189780680dd29fdfff5760ea0a06bae7320", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026067, "uuid": "8202834c-27c9-4d9f-ae2e-8e28062eeb13", "comment": "Malware payload (Rhadamanthys)", "value": "b35f219d86edd0082c0d3d7cbed0ff626598296db3d7b9cfdb41218ae46c1a11c5e5de79349be738cdadf6e5609de41e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026067, "uuid": "80581539-110f-4494-aa36-72c34d4b57e9", "value": "T1A41633C678EB8FB7CBA6C2B55302B5544DF0DC055A23EB6AF88C72E90C353B96046725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026067, "uuid": "7bf19376-f8c8-4676-9708-0ad72d7cda41", "value": "98304:jjA6d8XaSMnmx713yy3TgDz7JisUD4VzVHSEkm:jjAw8KqxZ3yy3UDz7kssAVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026067, "uuid": "fb5a1cc8-6f39-4615-925c-805179bca0b5", "value": 4182016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026067, "uuid": "fdf24047-7c8b-4eca-b1d9-99b129d26614", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026067, "uuid": "8aa056cc-9a1d-49fb-8a42-1e2c7494e32b", "value": "Set_Up.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3258f4c9-ae9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761065492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065492, "uuid": "b5e5d383-8a72-4425-bd7d-dd9cf74a1c99", "comment": "Malware payload (RemcosRAT)", "value": "648709b241925b35f0b8067cebb899c6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065492, "uuid": "de48b8fe-1bbe-43e0-b147-df2cdd9ac33c", "comment": "Malware payload (RemcosRAT)", "value": "904129149d521ca9f415f98bb3c791a1e9d9132ee546120e839d756a8d29f8ca", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065492, "uuid": "4aa15c21-62b8-464d-90f6-c48ab8263d6f", "comment": "Malware payload (RemcosRAT)", "value": "42afd80036645665c8ed753dfa5496f3951cce55", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065492, "uuid": "0c652694-ae81-4447-884f-a5ed36e4d40a", "comment": "Malware payload (RemcosRAT)", "value": "63c972ec8a4fcd63ec81c47d8b0c0baaecc43b87e229bb84646dada5c6533a580c66a1899c67a39fc337a0d57bb2b7c2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065492, "uuid": "d5cf07b1-62a3-4cb7-a480-9a7c3240e8b3", "value": "T1B3A533309F1ACD3C55BC8279F1AB5F191ED00AE84825A5EFA6E600D7507DFA3038786B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065492, "uuid": "25765383-95c8-42ab-b69b-518f123ac66a", "value": "24576:gswsYoApXgGILKwm+2CABCYZRl1+9loO7ceVv0GQNPEtrsqfbEviNO/qHYZNEVwb:gs+pXgGgmwa1GcOYhNsiegOAbrBWqdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761065492, "uuid": "03ffb688-2139-446a-bfbe-5014a0598f82", "value": 2206802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761065492, "uuid": "6553b5ae-10e4-4fab-b40b-a2791b7c3871", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065492, "uuid": "8776b5bb-3c2f-4d2e-b3ab-baadd56dbbf9", "value": "5ejufa.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b711f9ee-ae9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761064426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064426, "uuid": "59a8c56d-049e-404e-af3e-f70ead821656", "comment": "Malware payload (Mirai)", "value": "e9b0f74b512baf01d5f5df1b48598df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064426, "uuid": "f34ed16e-1147-47b2-9b95-c100f36432b5", "comment": "Malware payload (Mirai)", "value": "9074f136e29c67e1d8dfc7d361a8059f4d7838bbab81ec6487fa6c5414b31a45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064426, "uuid": "35a12b34-ee2f-4299-ad90-75b465a6dde9", "comment": "Malware payload (Mirai)", "value": "5b3f789dd099b2c57eb025073a9c594d42b114bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064426, "uuid": "50020fca-340a-4b62-83b2-6f4d055979a6", "comment": "Malware payload (Mirai)", "value": "d327f09c12f4920345f605a075bc81c16a19e24d72481c32405d77f92adaba3a0dce39169e317781cd566f2b144bccdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064426, "uuid": "04a45e87-a5cc-4c73-b7a0-bd97523f6db3", "value": "T184C31945FC415B23C6C612B7FB5E428D3B2A17A8D3EE72039D256F60378B95B0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064426, "uuid": "985e8cbf-c120-49c3-95ec-1d554fe0dcdc", "value": "1536:JCDwI4fG50nVg/QDEU9+19jAd424V8G2TTZtt1qLj2x1buddLqlEmwyw6FPRbxG8:MDwLYhQDH019jc4r2/Ztt1qYbu7wSbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064426, "uuid": "fe1d85f8-d5f9-4bab-bba5-731573c9ddc3", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064426, "uuid": "7db19556-f82a-42c4-add3-e9beef802571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064426, "uuid": "61781843-2241-4a18-8384-347d546a4b81", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97735b15-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761024859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024859, "uuid": "0a900940-c5ea-4bc7-bc96-cacc32df6c42", "comment": "Malware payload (AgentTesla)", "value": "d9780efe7f9988095bfd3884fa069147", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024859, "uuid": "72985639-6b81-4add-8d20-fc3a286211ce", "comment": "Malware payload (AgentTesla)", "value": "90814d58dd84ac300bc19e4bd3cf7d0ed9ffb9cbd93fd097d1124b1c950dc801", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024859, "uuid": "5cb0ed46-8c56-4eb7-bfc4-439f5bbb5475", "comment": "Malware payload (AgentTesla)", "value": "aa2a571113c0e018a984709fbd2c63bc3ccbe658", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024859, "uuid": "c094be1e-b089-41c7-b27b-02291e420a08", "comment": "Malware payload (AgentTesla)", "value": "dbc2cba39a35205abfe066fb1560a3c92d437b680621310e6c1f424d62d3a5dcd84df04a1a560b51d01b3da93eef326b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024859, "uuid": "b01c813c-5fb1-4619-a4cd-f26b1df89353", "value": "T1ECA1454C7EE4F0D842AAB123369F5D0DD526D840B4CE4528E131F698BAD2625AB3BA70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024859, "uuid": "e057cc25-4362-4ffd-a10c-6ac059c4c9c3", "value": "96:cq3CTJjfmh+HmD9yW0EyfqFewKHu44y8JhnXeQPIjb+L1xE9dHO3Kp9:5QJjfwJXhQjbEEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024859, "uuid": "fe9798d2-5fa9-4a60-93e8-b59e8ccd4fd4", "value": 4712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024859, "uuid": "ab2fd5b7-726d-4b95-a618-15f24cd5b2f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024859, "uuid": "3dc0bcfa-2d3b-4dfd-aee9-e19cfb5e3a1d", "value": "Bank Details Reconfirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23d780f-ae3e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761024448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024448, "uuid": "99064de2-7c77-489c-9031-ac2869f8edd8", "comment": "Malware payload (Mirai)", "value": "1444520ad394d26869ec8d4938ca52d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024448, "uuid": "d2840ccc-9a11-4a55-8e94-350adbb392d3", "comment": "Malware payload (Mirai)", "value": "90d0bb4673afef4b5fc5374775af75a34c8800d78824aca97e8a057042d3a71e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024448, "uuid": "6f3abd1d-a027-436a-aa2b-ba17994fe62f", "comment": "Malware payload (Mirai)", "value": "1d768299741edeb5c9f59761111e78dd37b6344f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024448, "uuid": "857c576d-1645-46d2-827a-8efc83f1b1ea", "comment": "Malware payload (Mirai)", "value": "6c00247df7654e6eb037e135ac2659199f5f331b26b99be31ff891f703dc634e9122a71992c04acf2096bd29b14b5e24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024448, "uuid": "c17da232-7a5f-4e06-85a3-66615a50aa23", "value": "T1A25302088B38A7C5C1BD41765FDFBA58C840901EE1854B5F6E8C2DFB5CBA6BE9238611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024448, "uuid": "8262d865-836d-4529-b22f-eb7ff2db5ee3", "value": "1536:F0UqQ7CYHMysa1XBcybPQKMnA8nEOfgU9N769nouy8Hy/:FUijsysaFBFPQKMnA8nEOf7376Fout8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024448, "uuid": "a67001b8-544b-45b0-82ea-625044771c86", "value": 62736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024448, "uuid": "6533d36e-7555-4457-9e93-bded62ca2cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024448, "uuid": "9dbeda9b-f443-4a9e-a895-5955d12a3114", "value": "Orbt.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d110fcf-ae3b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761023043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023043, "uuid": "75af53ea-2610-47a7-b66b-99d089183cb3", "comment": "Malware payload", "value": "14698af415e1df6b8693bf01b0878870", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023043, "uuid": "e82d2fad-e9ab-48ad-8165-4f33477aaacc", "comment": "Malware payload", "value": "90e3cf0c99b2f1c409b58f9bc5bc5fa0dc23b1f118e0440d459a37ff52b76cc5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023043, "uuid": "64bb0684-9b60-4799-b0a3-d1dcb337b748", "comment": "Malware payload", "value": "2b8649e0bdc136f0614ef26c40ec1dbe89052132", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023043, "uuid": "5abf4d92-4655-44e4-88ab-c0b01d3be296", "comment": "Malware payload", "value": "b804cac3822663691d281c06290149de9bc80dccea8a6aa4e1e5f7b18606780abba84465ba46fc67ab5c8c0481a653e9", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023043, "uuid": "aa05bf50-60af-4a3d-a0f5-00bf216cb8cb", "value": "T11021FB0919E70762C2B3CA3B0077E200E572F652AD636F9C40A006CB3811515FD7989F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023043, "uuid": "2d95994d-d5e1-42a3-852c-a9e53ffe127c", "value": "24:80CJHHoNzgmQAwpj+/vefNut2IrXQaR3+VU1cLAntoV36N+/xm:8BFklSuXXv3YUGAny36NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023043, "uuid": "b9fb83d3-feed-4604-b4e7-6c9926f2b3c0", "value": 1372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023043, "uuid": "1dbe7434-1031-4523-9c76-4d5baff6558e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023043, "uuid": "ba63aef1-ddb7-4981-a5ce-c89dd5dcb127", "value": "msiexec.exe.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73bf323-aea5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761068748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761068748, "uuid": "e4c90930-c348-4337-9473-212f756226d2", "comment": "Malware payload (Mirai)", "value": "dc9bc36fb8198ba5cc3a918c1dacb330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761068748, "uuid": "759664e2-ae8f-4922-aade-71fe710e7844", "comment": "Malware payload (Mirai)", "value": "90f76ae1ac716ee53723573780385fd77c510318694d87e092c7bedbb5dc7f70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761068748, "uuid": "18e36076-6e8d-4b7c-b004-149dcd589a81", "comment": "Malware payload (Mirai)", "value": "1a69ef32ba711daf819eb8abb4efb4e2c7158663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761068748, "uuid": "7f1a83a0-742f-4259-b159-f932fd81e910", "comment": "Malware payload (Mirai)", "value": "af9adcb38f5bb17f42faf753da5f486467a3a7c0c760bcba839e5a1d8344c249bc8a098016c63b6ff0c7ead6bad3cc33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761068748, "uuid": "711bc6f0-0c04-464f-a9d3-fb59bee27f06", "value": "T1A6633A22B27C1B27D0F09A7551B6732376E92A8415B4D78FBD250E1EAE633D0091BBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761068748, "uuid": "9bbfa4c1-ec63-482f-979c-3640dc33cded", "value": "1536:30Tuhk/u8jOCwLyHLw0TLKwFBxVCWE0Hf2+uV0UpXWAc50Hkibqa:ky6/lHwLyAw7Lm/0UI1Gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761068748, "uuid": "c7117a5a-ce55-4c3c-a8ec-df69738a9bc1", "value": 72604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761068748, "uuid": "2129cfb7-6ef4-4ed4-98f9-bc6ab45f184f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761068748, "uuid": "ab562817-d386-454a-9d58-15a80d8af832", "value": "Orbt.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538e309e-aea7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761069413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069413, "uuid": "b5f2a822-9c40-49ac-833b-ffea5df567ab", "comment": "Malware payload", "value": "4ce4a27a68dae8fff555a1932be8eebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIDDENCLI", "colour": "#9C0634", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069413, "uuid": "d159398f-50c5-4aad-94ef-a4f8744fa222", "comment": "Malware payload", "value": "913431f1d36ee843886bb052bfc89c0e5db903c673b5e6894c49aabc19f1e2fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIDDENCLI", "colour": "#9C0634", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069413, "uuid": "96d9831b-3102-4b33-ac7e-220be529949f", "comment": "Malware payload", "value": "96bda9fbee1bb4080651ec4dd062374077ca9e3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIDDENCLI", "colour": "#9C0634", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069413, "uuid": "369c95a3-00c4-479c-8908-78d0367f52b6", "comment": "Malware payload", "value": "804d7eeaaf38de8c94a7db98d6ef38e740ac4a79c3c983ac0d8d0d1804dc3ee31b3e776391f293db405f1c1e3386d5a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIDDENCLI", "colour": "#9C0634", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069413, "uuid": "bf6cd433-9648-4178-9c93-f8845137ea25", "value": "T169846C46F7A904F8E1B7913889668901EBB27C5E0770D7DF13A4865A1F336E09D3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069413, "uuid": "cf6ffef4-8423-49b6-ba6d-53fe9bd379a0", "value": "d47b12365c299f7dce7f4af693effb3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069413, "uuid": "d60b8681-93e2-452b-bc3d-a88a09241101", "value": "6144:tdRmnObyanWLvzQsAc83KriYfekn0bsXohyiQR2R/UNt:tdRmayoEvzecI2iGtssXoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761069413, "uuid": "a3f6daa4-4fc2-4340-8235-e9a14e7397e8", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761069413, "uuid": "c7c2941c-9cc5-4bdc-bb16-eeb291f9f777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069413, "uuid": "d88afb98-c55e-4f7d-8e0a-99e6c7f182ba", "value": "WingtbCLI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d13193b-aea7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761069482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069482, "uuid": "6c8c38e9-4150-48b7-bda2-06f62325aa01", "comment": "Malware payload", "value": "69678a750bb857589b64d58a4e1195ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TOLLBOOTH", "colour": "#759DB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069482, "uuid": "55ed917c-8a81-4a8b-9ab6-e20beec83880", "comment": "Malware payload", "value": "915441b7d7ddb7d885ecfe75b11eed512079b49875fc288cd65b023ce1e05964", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TOLLBOOTH", "colour": "#759DB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069482, "uuid": "9c0b8257-8d68-4d08-8151-0a5554527ba6", "comment": "Malware payload", "value": "311c828afebc0157724bb391353f28f84e231e75", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TOLLBOOTH", "colour": "#759DB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069482, "uuid": "d801634c-4da3-4452-9c24-a1d33711efaf", "comment": "Malware payload", "value": "9fa7f848ab5d85cbbdd1d82f5991ace88fa8728f3e8070b74dc5a0b60c4fced840f0f417fc4db5532c4ff4d0e3e0ecf8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TOLLBOOTH", "colour": "#759DB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069482, "uuid": "0fd27b58-78cf-431f-ae54-6819b69fa55b", "value": "T103F4232833D94988E3B98F7A5C785008C6767616EE25D75D3E41A0AE44737828F32F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069482, "uuid": "8eaff944-7e90-4515-8bb1-88dffcfa8737", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069482, "uuid": "255bd767-cfb0-408b-b704-cd9ecdfeace1", "value": "12288:ZhZRJBitCmdHJxVMK0yEELx+t2Wsrv07js7JXIRHEluasW4U8h7AUbA2rM8:ZhZQXdHPea+0Hv0nSdUkIaqUZUc8M8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761069482, "uuid": "139a7a73-95ec-4144-90c1-b44a3de641ee", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761069482, "uuid": "da024f5b-96df-4db6-bf2f-e618027a9d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069482, "uuid": "6d6bf837-5982-4064-9891-e739673208fa", "value": "CustomIISModule.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbe0b85-aecd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761085674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085674, "uuid": "af2bd90d-1bd9-4b2e-919f-82b78133dcdf", "comment": "Malware payload (Mirai)", "value": "3c9cb882e9e14e95bd0371225bc68b74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085674, "uuid": "c662802b-3f8d-47f9-bfbc-45ec9111d79b", "comment": "Malware payload (Mirai)", "value": "917092adb01b6ea6c7d4bf402cae44db320c61828e9df21f3e28413bd0a4373d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085674, "uuid": "710cf3a7-5a63-474f-afb3-5d97b0475cfb", "comment": "Malware payload (Mirai)", "value": "8d5c4abf9d0003c66ec51afb9532c0135b4dd4b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085674, "uuid": "165f8aae-732c-42cf-bad9-fe525eacbe43", "comment": "Malware payload (Mirai)", "value": "7134316994d3ebaf579f7054bbc9def56dba6dc88028e75e19bc5547c6ceb8ba7a5bb88df60ad6d27366ea3010a5037e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761085674, "uuid": "cdffd0d4-4801-4fab-94b1-cf3f01ee466a", "value": "T1E8630985BC928A6EC6D0237AF66E268E336177E1D2CB3217CD144F25338624F4E27B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761085674, "uuid": "101a9df3-0b6c-43d9-b2df-2e6a5eea87fc", "value": "1536:WvlP7kjAeShOn0ZOzNJwn6UuguBZp+NEXhnfbOdq:Gl7kEZE0Z76LgmIsiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761085674, "uuid": "38c2bb29-06b0-4d19-bb14-0a56006168ad", "value": 71436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761085674, "uuid": "17a877ac-2bb0-4dcb-b9d3-9d479a2b625d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761085674, "uuid": "e43cf760-685d-40f5-80bc-0ec4ad0a9966", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7723969d-ae66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Hajime)", "timestamp": 1761041555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041555, "uuid": "fbe26019-bbeb-4158-9a8e-85f313990327", "comment": "Malware payload (Hajime)", "value": "4ec4de30ce7396a195f5fc28fd2a67da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041555, "uuid": "3bf9cdfe-1c8b-4ec4-af81-33ea8e7767b4", "comment": "Malware payload (Hajime)", "value": "91a8ac9cef373cd162c9fdf57f08fcd890c52c38313264d1713eba257e554441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041555, "uuid": "c397d2a0-2365-4be4-8f3b-a6344f743604", "comment": "Malware payload (Hajime)", "value": "53b6aa4278c7dbead76dab4af14b3730edfe15fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041555, "uuid": "5162a92d-c3ab-4e8f-be4b-27d4c9e5be89", "comment": "Malware payload (Hajime)", "value": "d04ea5354d8d1dbf976c6173904411223f8b22782da3ca5a952106e4b9c4b217eb5d9cf8917cc00c2b10c51e2018fee6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041555, "uuid": "0ff9f859-f9b4-4c1d-83a5-b397992481d7", "value": "T1CE63120633992972967146F1E7FEAB4CE24D2E698FF16C247C113D6CE8313AE4CC8919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041555, "uuid": "e895e7a1-2543-40ef-971e-c97fbea270f0", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRk0:yYI0ARqw1qAEv7UIFM8oJorFquyjkRk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761041555, "uuid": "67d015f4-905c-4358-b9a7-c5772ebf9464", "value": 68600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761041555, "uuid": "f98d4ac8-a41c-473a-b5dd-3d3a1d6cdf81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041555, "uuid": "f64e7f4d-fced-430e-bf81-914b5b51d075", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a288b7-aed5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761089032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761089032, "uuid": "d8302213-48fe-4800-a5ba-3c1710df1d5a", "comment": "Malware payload (Mirai)", "value": "cede2279e704f48ffa40a7b76d56e11f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761089032, "uuid": "8aba85e6-df02-46e1-92b0-5e5f0b0790b7", "comment": "Malware payload (Mirai)", "value": "91c1033251b4c1f0cfb5458f20576f2b211039c5ee74d83690ed561acb8809f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761089032, "uuid": "5a21a3c9-8142-47e5-a858-952cebb50231", "comment": "Malware payload (Mirai)", "value": "579acc1930e8f18619b7e67e137baf2f9e6cd044", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761089032, "uuid": "06adc971-e240-42e5-8aa3-b5791795964a", "comment": "Malware payload (Mirai)", "value": "954c213cffb7138b96daf9e478550062346ac24905428120a2f460077d54424df65b71d058b4f67d58faf74e4740f4a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761089032, "uuid": "b691d8bd-e2b3-4b9f-ad04-158c980ae838", "value": "T1AA141946F8819B56C5D112BAFE1D228E33131B78E2DE32029D246F31778B9AF0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761089032, "uuid": "32599e97-ac7d-47fd-82f4-4e2bd71f3e74", "value": "3072:r5ntBybkfETcLQw/QnfWozX1kkGOaeN1oRcZwAq63jT9HYak4:r5ntBTmQZEHX1kktazzAqMn9HYH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761089032, "uuid": "f0f1f6e6-288d-4a71-a2d1-9af03f83ba53", "value": 194044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761089032, "uuid": "29d8b4ee-eb84-4d17-baf1-232fa4dce99b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761089032, "uuid": "220584c5-8484-405d-8b3c-135583bff13d", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa8ed2d-ae51-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761032703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032703, "uuid": "4a8ffbf1-c92b-4f08-a4c5-125e925c7942", "comment": "Malware payload (a310Logger)", "value": "b2df4b8e7bf4e70569378fbbbc0e2c1c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032703, "uuid": "b68ecd5a-ca76-4e84-9a4d-3c951f6d6e90", "comment": "Malware payload (a310Logger)", "value": "91e43604c16adaa142ba3a5cb792b25649c41fdf135799f3484cca3724e0ba66", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032703, "uuid": "83850f3c-2e5d-4c51-924f-ee3c35015ca8", "comment": "Malware payload (a310Logger)", "value": "7106f264a830bc434b443f3ddb08e94811b7c723", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761032703, "uuid": "2516c373-24f0-4d38-80f3-463b2cabca2d", "comment": "Malware payload (a310Logger)", "value": "e25e4bb9f05aa093614da55b09a156a29dab2feff04a53f4996a53dd11f538fd13578ea4a19d2adff518f30cc8a27c1e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032703, "uuid": "93f4e560-9211-4b74-868a-645c01382de7", "value": "T1A375D012EE518D3AF02E3539D81BDAD6541D7EE02A25B82E7AFD3E487F382C37416056", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032703, "uuid": "bd09d7ea-a3ee-4f79-aaae-7316d9bb1db6", "value": "1c46483cb5cc22b9cc47e186fc5136c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032703, "uuid": "0a72dfb8-7d3e-43f0-aa39-8d36146a028e", "value": "24576:a1x9k6hSHdKu0IDGgCQEtiABqEs7Do2InuIxlgUpNLJZb2K2p:aZEZEf4Ho2IxxlFN7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761032703, "uuid": "76882942-3f1a-44d3-a71c-53b42b9748ab", "value": 1641472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761032703, "uuid": "5ca7b398-57f4-428e-a7c9-15d25b27c90c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761032703, "uuid": "f832a36b-4fe2-4673-812d-0af69d29d3a3", "value": "Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d196f8a7-ae32-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1761019373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019373, "uuid": "4363cfe1-ed36-4f5b-b455-6c4fafff240c", "comment": "Malware payload (Vidar)", "value": "91fc722b2802baa21de11ca6060077f9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019373, "uuid": "4b492ed0-0b88-40ff-b0f0-f35e73f899d9", "comment": "Malware payload (Vidar)", "value": "924c0c5ec0abae51e9a3d42dfaed4ad6aab0bfaee85563bb5144c3bdc4ae1c6c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019373, "uuid": "de573b48-433f-48d4-a94a-8719ec26c134", "comment": "Malware payload (Vidar)", "value": "6338aaa133a97bed77b35b98973e318e0f68b349", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019373, "uuid": "5cc7d0ef-f2ac-465d-b2e5-b6dda40fbce3", "comment": "Malware payload (Vidar)", "value": "54411eda3784f4127016742df7b903d260dca4ad7afa3174f81090f4a17749781fc28f87815c92083966962bf7d55777", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019373, "uuid": "cb9483a4-f323-442c-b5a9-047cbd6f6d4d", "value": "T15B167C136C904A9CC4BEE27BA4A3918277BE7D904B3336D32B40B27D2E776C425B5749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019373, "uuid": "40e63564-d184-457b-8385-2ef52c4ea463", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019373, "uuid": "4dd3ef6e-76dc-4bb9-b8c0-bdf23daaad94", "value": "49152:0Jdmi/Gdt0efuCsOXdFpjqI6rWLLP1pzRdHnPypZPYFhYV/SmUgmG8wQEFGJm+V:0NwePahYF7mAF4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019373, "uuid": "ae42c96a-9607-454f-b7e7-b1e0cecf8070", "value": 4139136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019373, "uuid": "58e7ffa2-258e-45bc-b7d5-7ed07d22c22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019373, "uuid": "f5920251-4fb0-4545-a554-4b3226585e35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff83c64-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064065, "uuid": "2e82e4f7-36d2-4e78-8069-afc2eecdd48e", "comment": "Malware payload", "value": "473bef29ee9a1d5f24433554e8aa4204", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064065, "uuid": "a2723b0b-2be0-4c27-adc6-c348020ff38f", "comment": "Malware payload", "value": "926d45a82aed9da39560b252bfe259215a3ecb129e1ae1085144783a34559d2c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064065, "uuid": "6799f1a6-851b-4f34-bd17-1cb7bdb85805", "comment": "Malware payload", "value": "22bb0b4429ddbaac429332f4bef9110d376a3970", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064065, "uuid": "bc1a7614-d31a-4f89-9204-ba659ffb7f88", "comment": "Malware payload", "value": "6770f825b464ae487533ce3c82f80d85ffbf5ea9e9b1123329e9f3807e5bb75bfc14319b65ced0d0f396dfdf5dfe19f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064065, "uuid": "f73d9055-8c8c-472d-8130-4af438b47262", "value": "T115B32A66CD332C9800A3624A4ED62DFF380D97D3DA5FDA99C55BF7A418DE62406934C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064065, "uuid": "ba2ed61c-c111-4105-84ba-1a27ac1a8882", "value": "3072:GDB7b0o/tXOA1++XagIcX7NTME2TiasWjJudJNrQ+qQH/9ew5msQJCqbYtrxHQQk:0N/tXOA1++XagIcX7NTME2TiasWjJudM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064065, "uuid": "a1561a66-6c38-468a-a1be-3387e883d1c6", "value": 108745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064065, "uuid": "8dcce50c-522e-4589-bffd-ca7277c1e0d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064065, "uuid": "fedcdfdf-0560-4796-b9de-9195886ad211", "value": "invoice-1637482117.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f945f624-aed4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761089018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761089018, "uuid": "56529b21-b371-4682-8dec-d81601b4e149", "comment": "Malware payload (Mirai)", "value": "83b4296d9b7c2a2305cd4aa4d6db0faa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761089018, "uuid": "d681a4db-a06f-4d40-8a23-78f043edeec7", "comment": "Malware payload (Mirai)", "value": "929ce06684884cf7d4dddf3de3ceb7d2be24e7622864045a7bd8e6846016e1af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761089018, "uuid": "6c1d80b0-777e-4f26-92cf-de6ade0cfcbe", "comment": "Malware payload (Mirai)", "value": "a7bc9941d0c9dfc8f453c9c02d64a9f9424a15b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761089018, "uuid": "b9e75e0e-fd81-4d30-bc4b-74b26c947b4b", "comment": "Malware payload (Mirai)", "value": "72376cb9c52a499ec1a0825117f5bc125c382d8ce7b679ae662be8ec4d8df5dc2e0311d207fe75dee3649e25bdc2af61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761089018, "uuid": "6056d795-5dff-4532-9b37-617e8e264e2a", "value": "T18B731206616BF4E14D31B837FF62005A73C5ECB291566B8F4918C6843DB6ACB11E9DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761089018, "uuid": "e4ccb60c-8ab3-4178-9e96-4f9ece3b9bfb", "value": "1536:FL/ewzAVzacnTsqw/dThImOfZl4qq7yITpISIV49l4+MasoLjALQ:FL/FAVuu8I7fZlGpTKSFKgALQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761089018, "uuid": "77ed488d-cd51-4acf-ae4c-3fc92bbd9dda", "value": 74160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761089018, "uuid": "57a5ca18-0ae3-4377-a545-725b31e9af2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761089018, "uuid": "a154356e-7633-42bd-a785-be836761a5e6", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2888a08d-ae47-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761028109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028109, "uuid": "ae62ef54-07c4-4138-bed7-ad74ef2fd702", "comment": "Malware payload (Formbook)", "value": "6e837d7b5b3ca6421802a8e46a8404a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028109, "uuid": "97ca4837-fad3-4a0e-94e8-c0f9fdfb444b", "comment": "Malware payload (Formbook)", "value": "92ab853ca9a0ebe8e1dd6187c708491cc2c2e9985e3c5063b802cfd389cfbfd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028109, "uuid": "ed4d4117-3f2c-42ef-85eb-075a76f91e2c", "comment": "Malware payload (Formbook)", "value": "9987286c0cc65c8cd272949ea9e2104f851433cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028109, "uuid": "a634856d-0e9e-435c-89c9-2209a18a2806", "comment": "Malware payload (Formbook)", "value": "bf837e42291d024401420d33140fd7461037dbaf98681c4a83c61700bac8685e2a1e02207ef916f48b4d47e70e101e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028109, "uuid": "9a103ac7-ea7b-40d2-bf13-352a6a4d5a4c", "value": "T17CA4DF105A80F857E3456C70E4B0F74E9AA1BF75CD254253AAFEB27C523E77E9928302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028109, "uuid": "b5de4775-5cf3-444c-8823-3f0bac138a01", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028109, "uuid": "b424a7f8-9d00-4a06-b1bf-a51dccfa693d", "value": "12288:ig0uAJI3IZ+Cl0OBgliaWwA2RujUz1sBWsp:4uAJI3++ewDLRwUzyBxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761028109, "uuid": "cbb437b1-7e75-4f62-bdcf-cccd06a4528f", "value": 463376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761028109, "uuid": "7a8dc671-ee04-4343-b9be-b08f986cc25e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028109, "uuid": "51da81e1-f301-434a-9b1c-435ce9b058e1", "value": "JN 4342 & 4343 SSANGYONG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b72c5e-ae36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761020749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020749, "uuid": "2a9ec899-d422-4f0c-bbe2-c93db022f294", "comment": "Malware payload (Mirai)", "value": "f64655346f1a332b34c5be288f78b123", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020749, "uuid": "02f5da68-a86d-42c5-83e5-b96329d001a0", "comment": "Malware payload (Mirai)", "value": "932c003508cb926db5a6fb1db1cf9bc107f2ca0c3a97344f4723316115f297ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020749, "uuid": "00fe6df0-2ed5-424d-96ab-d93b7d515b3d", "comment": "Malware payload (Mirai)", "value": "fe5bfb95f9f4d7790eeb5cbcb7f6e384897793d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020749, "uuid": "1a17ea82-ad46-4567-90fd-38f79091787e", "comment": "Malware payload (Mirai)", "value": "6e14377005afb6871e6f0770f7c806de34a75df3f0f1758ac49954fde8e90147afdb9eea601a6bda2888263714445809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020749, "uuid": "d1855852-1ebc-4031-967a-a72126a69f40", "value": "T1939339CAB401DD7DF40FDBB74463490AB631E2511A934B3B63A7FE63AC321A44867E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020749, "uuid": "cfd5767f-6006-42b6-8f11-86e01d5f5239", "value": "1536:ZE6p3eXx/nqYenjyLT3iWbNDgJWipgrPvTzcDaA7W8dJquGec7Kxnsx/AgTXZhr9:Ztien+LricpUWzvcDV7CNQxsxFJcYhN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020749, "uuid": "a527e5f4-b7f8-4d69-8df8-1b0f229d3d4c", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020749, "uuid": "85f3e15c-4027-4c94-875e-b7d354304abe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020749, "uuid": "05bff8b1-ec8b-4390-9b67-d9867d3ef51a", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e142cd0c-ae63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761040445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040445, "uuid": "0e2e4a1f-dba3-4984-b2ab-0c97650e6df0", "comment": "Malware payload (Mirai)", "value": "199c04ff6212841c78e556cc58fb9269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040445, "uuid": "95f68077-fdfc-4e6a-8d95-ce98b225ef29", "comment": "Malware payload (Mirai)", "value": "94f1f83a407cd1aa39c8abc88082fe71a3d3c0cafe00aa5c88475c124c2e2d0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040445, "uuid": "c24da493-e60a-461c-a2e3-39f3286e5197", "comment": "Malware payload (Mirai)", "value": "693252646f81c922ac778e4009bb771d8d5dde01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761040445, "uuid": "ef00df7b-2312-4920-bc1f-b9c989d50e0c", "comment": "Malware payload (Mirai)", "value": "d71cfb41c65fa67a89b0160e0ffa7f7a2e2559efaecb8a6ea163e0876392b8d679cfb68c84b0737c01d264c4ff5638a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761040445, "uuid": "e5596485-6e2a-44aa-aa24-40ad1145a455", "value": "T1A57302DD51068220EF7FC4FD56E5CBDA1A3087E5AB1289477918A2BFDA99D500C83CCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761040445, "uuid": "5357f6ad-8c6b-4a23-836b-ded9ce95ce96", "value": "1536:njqcLwfiMOzhINeZsVQIL75Qb10qw0JLW5B9d0qsC3Ezt7kQBCRdVJu5:j+aMONIko75o6j0J2+foVQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761040445, "uuid": "34c3afdc-6a4e-4a8a-9bc0-f576161d5395", "value": 76420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761040445, "uuid": "dbe9f69e-5128-43f3-bee1-2f1d9da2deb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761040445, "uuid": "793482e6-c582-4448-9520-5ae766e0cf05", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd7e887-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076784, "uuid": "af641952-f207-4292-9bc7-568d5a76506f", "comment": "Malware payload (Mirai)", "value": "fe21caf55ccbd5a81bfc74dbf72575e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076784, "uuid": "771a1a5e-f40f-4bdf-96cc-db38e63b8120", "comment": "Malware payload (Mirai)", "value": "9880523609637eaa339ab86f3331ef3c87efb7e771add6999aa5af978a590498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076784, "uuid": "b77329de-f222-4ca9-be9b-1683db149c17", "comment": "Malware payload (Mirai)", "value": "a22925e33402f94134ab3ae01d8fa7966211ac18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076784, "uuid": "64d7e6be-1662-49bc-ad4f-8156f81f879b", "comment": "Malware payload (Mirai)", "value": "7e54f4cc7533cc3e6f4a0560de6d533735041057064515988b0d497da401b0daabbeb071bdaaa215da7eca4750649ac3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076784, "uuid": "103e0484-49c8-4535-9916-9ea42c381b2b", "value": "T126042945EA404B13C0D627B9F6DF42453333AB9497EB73069528ABB43F8679E4F12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076784, "uuid": "07b22c6a-1b5a-411d-8e56-224c31914901", "value": "3072:OLe6vhN1QIruCee+asuTuRebU7IVILKZQy38YhTfYo+M/Rvs1tlLn:ee6vhQIr1r+asuTuReAvLK738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076784, "uuid": "be8f970b-260e-4343-adc2-4845cb9d0ad7", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076784, "uuid": "fd82657d-8b4d-4002-bab3-911b6b92d257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076784, "uuid": "0f7d6947-ceab-4289-945f-562a4cec33bb", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017f7393-ae1a-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761008716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761008716, "uuid": "cd02963e-0481-4edd-88b5-085c965b6631", "comment": "Malware payload (XWorm)", "value": "57190b0377e2155334443342c85f404e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761008716, "uuid": "861e0321-818f-437d-bfb8-f9c2a2c9a604", "comment": "Malware payload (XWorm)", "value": "99fa7aa6955981c6018c0da6d71164a00f53b13ae0aa78597aed99524aa7b40d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761008716, "uuid": "0a5e5116-bef2-48e3-9b1b-6ddf4d81cfee", "comment": "Malware payload (XWorm)", "value": "fedb119939e9d541b4438b8066dc10b4a1184235", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761008716, "uuid": "d713e7db-7e80-4611-8c65-32ff741c6670", "comment": "Malware payload (XWorm)", "value": "5dcaf470d026c11ff1760c9e801a7db22f04f64049832bc38760f5e66582b8dc1fd40c360c85055cff28ffac20827aa4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761008716, "uuid": "dda24d71-3bee-44ab-a0db-e512dfb84b4f", "value": "T16004D52EB274B9E4431A23E3E8192986205F8553C37BCDBC9C66B8770CD7148A7267D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761008716, "uuid": "2e901964-fde3-4299-bb58-2697250a4cdb", "value": "3072:veAicjpUjeRclobO8VWrJpOw/tUm0UqQ+zbxrtYT8LQzN:vePCKlobzAFJ+Q+zbxryT8LQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761008716, "uuid": "6f51cef5-4bb6-4c9a-a09d-4835c7e17391", "value": 176311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761008716, "uuid": "27639b18-a7c6-4065-a4ec-6fffc66af5ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761008716, "uuid": "cb499a72-acbb-4370-9378-58f2f93fdc90", "value": "Purchase list and specificationJPEG File.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148820c3-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761025498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025498, "uuid": "43fd937d-54ff-49c2-8bf1-96ebe691045a", "comment": "Malware payload (Mirai)", "value": "15ecf1b0946d658320139481547f8788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025498, "uuid": "06b2ca47-eb98-4f41-8f35-ac4ab677b10f", "comment": "Malware payload (Mirai)", "value": "9a7936bade2bd373011606f438a82cb9f6845921e3dbd6beb479b62210e86f48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025498, "uuid": "5b253eb7-c25a-4576-89ca-fdc8cb7dd87e", "comment": "Malware payload (Mirai)", "value": "2fa28f71a1e1ae719a15d9451dad91e61aeaef37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025498, "uuid": "c6485617-a41a-4d76-b6cb-dab000ed9a7f", "comment": "Malware payload (Mirai)", "value": "1c2df09848c1b70189fb5b2f73cb1e8b7e5add4a8a0d8003b0bd1f412090ca3869ebbad83c51a33360701577f51860bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025498, "uuid": "220f5aad-275f-4a17-a1b8-43638724b54b", "value": "T1E3931262478F58531A122D33E9D6728E661B0CB8EDB7C8630B16C67C27D2DC66CCC48B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025498, "uuid": "47d4f9b6-5359-4ceb-9995-a5fa10d30e9b", "value": "1536:ST34m/98olEsUV84ha9lYA7zgoYu6XhDlKQAAwfrQbf56VVaJGm+wPLFY9epgISs:SjllUsKa9lJQoYRxMmB6VgRPLPm728/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025498, "uuid": "fa031d62-d8a8-40d7-9654-8240a9122f0a", "value": 95436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025498, "uuid": "cb960a7a-fd5a-444f-a274-b88cf0c21f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025498, "uuid": "5333af95-4977-4c32-848e-18828e013df1", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5eb459-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761024918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024918, "uuid": "c068a94b-1dab-4440-bf95-3cef94277842", "comment": "Malware payload (XWorm)", "value": "6be1b43de838888ec8c35475a801252c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024918, "uuid": "db1535c0-2e46-4b27-be28-d425ab672c04", "comment": "Malware payload (XWorm)", "value": "9ab5785d2966c09766c5f83b04c9f36eae000d6926c59a9318df4bed546a6291", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024918, "uuid": "a6f8e562-0a5f-484d-9564-8007c3ecc898", "comment": "Malware payload (XWorm)", "value": "153854279763d61cbadd2ae01175aec8cc785716", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024918, "uuid": "9543bf87-3a99-44e2-b710-64a9dffa29dc", "comment": "Malware payload (XWorm)", "value": "74adb2abaf499fa957823c2491096343e49ffce927e6d83e01aad914a752af94f2053b75c775f44f6b8ee267af79acec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024918, "uuid": "be5dbe9d-c040-4c24-988b-591efbee4577", "value": "T120067205FAF29D88F7A1DE994A07BFC5C5141BE725080DA274BCADDC6FBA1B0619013E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024918, "uuid": "019acd8e-44d2-4381-b08c-f233b2743050", "value": "24576:RrgHCaLALbnrgHCaLALbacCw1t05lnRUsCdLwcsxgHrGxC87dkrgHCaLALbrrgHe:T1acCi+5l+dLwc2gHAKh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024918, "uuid": "b4e26d22-4a7e-46e8-819d-e801e66282a7", "value": 3725965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024918, "uuid": "e05450a0-1a67-4928-87f2-96a51511efb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024918, "uuid": "5a2aa793-5ddf-416a-85d7-5e8f1b9796bf", "value": "IMG-2025010-WA001310.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a94b82-ae6b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761043563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043563, "uuid": "cf3236fb-ac87-485e-94af-4c586508bd31", "comment": "Malware payload", "value": "32cd32b4287ffa28e92a5163fe847565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043563, "uuid": "15695bc1-36bd-4e96-acb0-54db7855651f", "comment": "Malware payload", "value": "9acd0901461dd314c6c2eb2d5f4e9dd8867d3bdadd50cd696a4ee809e346ca71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043563, "uuid": "ea0fb176-49b6-4221-b26a-be4136416b1f", "comment": "Malware payload", "value": "6b59290c2f443a58f3b3f5b8d3428fd58656bdd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043563, "uuid": "85422db2-2751-49bc-9993-43351850a5b7", "comment": "Malware payload", "value": "39262c0c0728f289cc6b2f1fc59e567831ffbf8dc18ff712746cacb8ea24866dc909aaa49fd32e4cbd29d1a7e10335ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043563, "uuid": "cc15b5b3-0604-4985-9271-ab0b4ac7cebb", "value": "T1744512442B6DEE12EDA21BF509A1E3710B748E4CE521E3174EE8BCDB74B9F452A58343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043563, "uuid": "64b104af-c524-479e-a07a-7ba916178a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043563, "uuid": "401bbdf1-b170-4443-93f2-abebe2650e1b", "value": "24576:Euf7/UKl+zzrZu3ZJYslBAxnLAhFjRXKp5urgNrOLfxD8eyNRYr4gTGsyAP:zf7fYz/ZuJJYsH6LAncWrpxD89YrZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761043563, "uuid": "30998587-c420-4e23-9703-6a6c56d54714", "value": 1259520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761043563, "uuid": "84777418-9fe9-486d-88f2-d5b8e50b64f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043563, "uuid": "12fd27f1-5964-411d-bdb5-90822841f1b2", "value": "e-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1544a5-aecd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761085666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085666, "uuid": "56cacd15-26e9-4772-9294-9af79a35efcd", "comment": "Malware payload (Mirai)", "value": "240332443fba53a5f7fd6c0a34503842", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085666, "uuid": "be218d0e-918b-4e44-821c-101b8dc6f321", "comment": "Malware payload (Mirai)", "value": "9aeb5db85cc349fde2c19cf9b03b08e61f5a0973569fbfc1ced81ffa2336cb62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085666, "uuid": "e639eeb0-5839-45c8-8d1b-e5a44e06e66f", "comment": "Malware payload (Mirai)", "value": "b6ed580c3cc66f4ce37377163d949f98d213be51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085666, "uuid": "a0953bb2-d934-4486-98cb-e9a53644995a", "comment": "Malware payload (Mirai)", "value": "9837f113ffe1b7a694d9e7dd8ec481638d88ed8cd4db37dcd48ec71af9785cd257fa1fe89536c825e4210f9b3b54332d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761085666, "uuid": "14058a68-0846-4f01-b012-2715ed0fb9d7", "value": "T139E2E17420E4FDF6D2B0327DBEEC0690DB5A43B4A3F8792205D52F38AC858515A5968B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761085666, "uuid": "c8197fec-c03c-4425-8b9d-8ea5255582ed", "value": "768:lHZsVoGu6Xc3BwO8ZiJD7aAEmzqUDPpYNp8IPy91s3Uozw8:G5cHTJiAE4xPpbIPyqzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761085666, "uuid": "d449073a-5eba-44fb-90a9-c5a7cb38e0b5", "value": 31252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761085666, "uuid": "40621912-963b-4bef-a430-e36b043eae61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761085666, "uuid": "58de4804-d019-44b8-a6d2-7a999edb5975", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a185d42f-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063960, "uuid": "8364f827-1838-4b4a-ab9a-6d82238b6d76", "comment": "Malware payload", "value": "d3f767d6be4143ac71415896b387daef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063960, "uuid": "86d33e88-685e-4931-8aea-55ba9f0fd310", "comment": "Malware payload", "value": "9b76c2924ff0d433dc1bb6a550418d5c51bc06fb3cd694b2ef3264d313b36ef5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063960, "uuid": "5420bf0e-70d5-4cc6-b077-010c33b867b4", "comment": "Malware payload", "value": "d711ea0984db953cbe4897ab4ffb896061c529dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063960, "uuid": "a2767ef3-2847-495c-b8a2-6e91a0ae0f5c", "comment": "Malware payload", "value": "0c27eb5f680865fd58f630fc8e7638ed6ab8000aca0360baabeaab80d5db04289651eb9304c9eab2d80c0163aa18d787", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063960, "uuid": "6af6ccd0-c316-4b35-954d-783339e17057", "value": "T10EA319462EE7C7B86E52709A486E23F89C5C1350DF0519256443B7EB827CC690ADEF8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063960, "uuid": "74f78faf-4ad9-44ed-be98-06db38aad5dc", "value": "768:GDhd0i7J4sYKgY/CMNfWd85UYH0dSst0rXL3rw4cjH3nAwoCDoSLAuAAroQW+FFP:GDB7eKg20Grbrw4cTnAwh86BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063960, "uuid": "4757b86b-31ba-4f8f-af8d-175a03ec29aa", "value": 106717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063960, "uuid": "a7431e1c-8171-42f7-bd50-7c1cf18d862d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063960, "uuid": "8b17db9c-88f6-4215-9481-796cca63c78b", "value": "invoice-1637482117.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0945c348-ae4f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761031492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031492, "uuid": "ab5820a8-f88a-42c3-b02c-b9994116eafe", "comment": "Malware payload (Rhadamanthys)", "value": "7e0c40006ddcfea5b5c11421478bf309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031492, "uuid": "efa81dd3-6b99-4563-af41-8e8a413f9019", "comment": "Malware payload (Rhadamanthys)", "value": "9cd2df6531f71945ceee3f3e855b02435a3767c51f62e6587ea8a885208c0b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031492, "uuid": "68873b95-d305-4ab8-bbef-ca28a92c4643", "comment": "Malware payload (Rhadamanthys)", "value": "e11eff5354b2964bcad726f217e942e0602f0918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031492, "uuid": "e3f33def-45ed-4263-8406-b857ffb0a497", "comment": "Malware payload (Rhadamanthys)", "value": "d5e16e869f076fa1444e58b83f6716f67e810a032f7f2529ce253ef142234db8367a6a3096774a2bd745abbc515b21fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031492, "uuid": "906499c4-e37f-4117-b7f0-476c8776b780", "value": "T15BF56C33DC704998E0AFA37499A26682BB747C48073633C72B5077392FB67C4967A749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031492, "uuid": "0380dbb2-dbcd-40c9-8a16-fa01918a194a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031492, "uuid": "f7527d06-a56c-4ee4-b0ae-40a262b7e022", "value": "98304:9HFfdxSoqRb+o1ipHmcDzxGxhShCs+AdjWto4Je/6pzA1:9HFd/H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761031492, "uuid": "151fb11e-0418-497e-b3c9-853204191d93", "value": 3607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761031492, "uuid": "1287e224-5f8e-4b9e-a0a6-b6b80226fdd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031492, "uuid": "959db7d9-c145-4823-a2f4-db80435378ee", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.41834.19409.26653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702bfa9b-aecd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761085782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085782, "uuid": "1158ad57-8fea-46d3-a8da-7cc898dbcc35", "comment": "Malware payload (Mirai)", "value": "edaf80ab2872a8bbb1b1bdb505655854", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085782, "uuid": "bd79281c-11e5-4159-81e5-fdf75838bb51", "comment": "Malware payload (Mirai)", "value": "9ce59a1989b1be0a0eb7f8a6e096cba7cc61e55e8e32c4781270581c3565140c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085782, "uuid": "298cd755-355e-4816-8ab0-728899bd86d5", "comment": "Malware payload (Mirai)", "value": "a9dbc8d594104245b002ea2fc52160c841184d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761085782, "uuid": "ab3d0ec8-6558-48e3-ad60-123bd4f7860b", "comment": "Malware payload (Mirai)", "value": "a675c08ade47fa02aa0b877fce0554457a216409314a69a5354d1f5ee37fa5b198451548ae38563e29e60ffc3bc878f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761085782, "uuid": "55359da7-c9aa-4ea5-ae01-53ab6e71079a", "value": "T1B9F38C23D8656EA8C628D074F134AF7D5753A96082872FFA19ABC6754443DCCFA063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761085782, "uuid": "535dfc59-d161-4af8-ad9e-83bc218c1eae", "value": "3072:IKk9F3DRjmAgyw7nKvjjhb2QjU8VqWPIzhddG:IK6pRSxTKvjl69o3PSdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761085782, "uuid": "14adbcc3-9862-44cc-b8bb-2ab85f68f7d9", "value": 160164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761085782, "uuid": "e1683c9d-668b-48a5-80cd-05a7273112d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761085782, "uuid": "1d7e663b-1737-4b7b-82ec-3af7760696c1", "value": "Orbt.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70a3029-aeb4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1761075271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075271, "uuid": "64c6e92a-12a2-4148-b891-451fc8e57c80", "comment": "Malware payload (Cobalt Strike)", "value": "2d22928ba5e085c7d881f6f1dae3e807", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075271, "uuid": "623eb861-c6cd-44bf-b493-a693d3fbb443", "comment": "Malware payload (Cobalt Strike)", "value": "9e537007069b186eb15cc7134fe60f3d87472e511404ad5143efb58233619f18", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075271, "uuid": "a4470ab8-128f-44a6-add1-d6638b03807e", "comment": "Malware payload (Cobalt Strike)", "value": "c7f85a37fa998ceca5484631d0efa8f0526bab88", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075271, "uuid": "26219882-46e3-47d5-b6b5-88387a12b8a9", "comment": "Malware payload (Cobalt Strike)", "value": "a62b8827a89ce36cc18418cdfc6d66fcb9ef54ee35a8bacfadc810b387ac81dbb7979975ae6e2487d960ac3fe1e9659d", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075271, "uuid": "d60ffd27-5a0a-4917-b69d-1ecf80bb45fc", "value": "T17196BF26AA4948FAD049C87083464A6259E674FB3B35ADFF02C251243EFF5F52F2CE54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075271, "uuid": "0d67b108-4e3e-484e-94c8-cf043962aeda", "value": "5f2cde99aadc21ed6041ed4a92ee788e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075271, "uuid": "0b295e0d-926f-4639-9f67-8dd2119b261a", "value": "12288:IG+c9wL3OJThCZyslQe74tnV5OYaLlupU6HnjtAi7CT7/gl5ps/dEe:FwohCZyXtnV5V5U2njtly7/ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761075271, "uuid": "886363b6-7a6a-42ca-851e-1a6d3fa04ecd", "value": 9447712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761075271, "uuid": "ce5ab037-129b-4b3d-b8f3-ba017e55589a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075271, "uuid": "cf980d72-385b-4e22-870d-8dee611a4143", "value": "SecuriteInfo.com.BackDoor.Meterpreter.157.5469.8763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839abd0c-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076795, "uuid": "ef57aff4-f497-43c0-be6a-f48873c45331", "comment": "Malware payload (Mirai)", "value": "46183a42c3f9fd39ddf74069530ad74d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076795, "uuid": "24b6150a-260d-471a-ad55-721c5be4d1c4", "comment": "Malware payload (Mirai)", "value": "9ed21b4a991b343e0cff233d51e664ac60bf3fcf294ecef02de2ffc7420d7263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076795, "uuid": "84f104a4-4f9f-48a6-b868-2cf48838ec8f", "comment": "Malware payload (Mirai)", "value": "ae374630e7748c227c56753e5cf507430c0bd156", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076795, "uuid": "9266b342-7a7e-415a-ba1e-9089fce75aac", "comment": "Malware payload (Mirai)", "value": "5a271b526ed09be3a4063f1d958980a968fd607432364a04bbf20dc64b96a72fc3b74ed2103fb384318476410d78979e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076795, "uuid": "41bc0fe4-dcc6-4a76-a8cb-4ca2c4649085", "value": "T152937CC0F683C4F6E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076795, "uuid": "6af87ea8-ef16-4aae-9cdb-5f0a449ff2c0", "value": "1536:W/QCZaxGdvts3i5JPhoeIxPu++ALtgUIKqI4FrS4LSk:WYCZa8dvm3oJPhTIxP5htSKfUmDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076795, "uuid": "9da14cef-b788-49c3-8143-0819fee6974b", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076795, "uuid": "09d64b79-1b5f-45bf-9113-67d6a7e20f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076795, "uuid": "acdf7be8-757d-4161-a4d4-3c5eb51eaed1", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7cf9b4-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076781, "uuid": "234ab461-9761-4aaa-a840-b6f0688269f1", "comment": "Malware payload (Mirai)", "value": "4a417f8dfe35f03de081713a5567ccb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076781, "uuid": "0f1271c1-6dce-4ca8-bd4f-d34708dd5e19", "comment": "Malware payload (Mirai)", "value": "9f0eb2c9e8fd71a365ad34ca1cc302d5d053f479cf2566a941589fc0ef2d53d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076781, "uuid": "dfaac7e0-1a02-4d0e-bdd9-6392bf198714", "comment": "Malware payload (Mirai)", "value": "13baed60a56962805cf340740d7c6e74a60f7601", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076781, "uuid": "5e3299a8-22d7-4f47-b560-423be52de3fe", "comment": "Malware payload (Mirai)", "value": "1a9e3d0e8ea826396ad51cff3d5daa8e80cb65aa25cb197a4b327b32283ec5a1e879cd2de12f5b0a09ba304e9d130968", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076781, "uuid": "67dfa9b1-4585-4093-98b5-d618b6d927a3", "value": "T154E30B46F8814B12D5D111BAFE1E128E37131BB8E2DE73029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076781, "uuid": "38d49190-57e0-4691-aee0-adeb2e196d5b", "value": "3072:DHea4CHoUjnwJIXMb6Azz1az/AWdYV8P4KLf:zePCHoQ6IXufzhakr8P4KLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076781, "uuid": "ffc32a6a-dbaa-414b-a271-b1d69a38ae55", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076781, "uuid": "0c31bc5d-472f-42f1-8213-5585806aa923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076781, "uuid": "17387a26-babf-456a-8dcf-6788bde79928", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b420a06-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063815, "uuid": "4a020128-d839-4d9b-b04c-ffe48c339117", "comment": "Malware payload", "value": "6f1f9836f0faa79bf54198dd1b57f064", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063815, "uuid": "1ce9820f-2569-4760-83cc-4987a0f77d1d", "comment": "Malware payload", "value": "9fd5f1463b9509fea164da3bf463ad913b5d473ea21440cb35fe4d29f493c1a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063815, "uuid": "4b30fa4b-2a96-4d82-ae9d-1f04d819f823", "comment": "Malware payload", "value": "19408da0d2fafeb8b7ae79080522a31cae0c1a1a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063815, "uuid": "352ad00f-907b-49a6-a10a-6d444a8802c2", "comment": "Malware payload", "value": "5b86d46daf5bb1c4ad46d5bb290cf84496f0b626f8f4dcfa02e4ff3a676c43b9535112f5decb0c8dddf2623f9a7f9be0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063815, "uuid": "da8e99df-1ab1-4702-9cc4-1901e2a75042", "value": "T193A3D9125DF3EC785382E9D1EDDC23E0A9AD9D4C991D5298B81EEBA54340B2878FC1C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063815, "uuid": "273f66bc-b003-42e6-be37-bf5ac14349f5", "value": "3072:GDB7b0e0S0C000W0B0J0b0q0t0K0W07090/0E0I0t070k0J0k0q0t0q0l000Y0Ok:0rvn9IWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063815, "uuid": "c0deeef8-44bd-4a03-8237-c00ed6f03804", "value": 103963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063815, "uuid": "b408588f-9aab-474a-b4db-376b9e005aa8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063815, "uuid": "418ba7d3-3b68-42ce-946b-6f5bd879a59d", "value": "invoice-1637482117.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47dfff2-ae8f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761059268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761059268, "uuid": "5df3fa02-412c-4291-823a-9ba69f2ee2b9", "comment": "Malware payload", "value": "a06521edbd49802e97b216061edf7ac9", "object_relation": "md5", "Tag": [ { "name": "85-239-246-89", "colour": "#1B9C4E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "kapbom-site", "colour": "#015DA4", "exportable": true, "hide_tag": false }, { "name": "petcasalove-site", "colour": "#C9028F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761059268, "uuid": "a6b2a215-9fc5-4fd4-aa7f-3aa19d82b244", "comment": "Malware payload", "value": "a05d6f7aeb91c75ea77b029e69284157c926de99ef30cde3e1de1ecfb8a51414", "object_relation": "sha256", "Tag": [ { "name": "85-239-246-89", "colour": "#1B9C4E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "kapbom-site", "colour": "#015DA4", "exportable": true, "hide_tag": false }, { "name": "petcasalove-site", "colour": "#C9028F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761059268, "uuid": "f1b51469-6875-4c9e-b160-f4ed05444c2c", "comment": "Malware payload", "value": "169ca2a7e6f3d45d1b4a5b660ab03b61d654fe43", "object_relation": "sha1", "Tag": [ { "name": "85-239-246-89", "colour": "#1B9C4E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "kapbom-site", "colour": "#015DA4", "exportable": true, "hide_tag": false }, { "name": "petcasalove-site", "colour": "#C9028F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761059268, "uuid": "5120b659-fa3f-4917-9f9e-ce204193c682", "comment": "Malware payload", "value": "d506f6923c354a7ef898c9eb501b656dd2df67bfc3971f57a98bd10ef170528fb2738e6611dc9a98e530c08233ebc309", "object_relation": "sha3-384", "Tag": [ { "name": "85-239-246-89", "colour": "#1B9C4E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "kapbom-site", "colour": "#015DA4", "exportable": true, "hide_tag": false }, { "name": "petcasalove-site", "colour": "#C9028F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761059268, "uuid": "b04e59a8-24fa-4b89-ae40-685d78e92ef4", "value": "T1CD424A144FC3CB4EB54891156583B566028BF97E60E9378BBD0DFE64899428CF83E37A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761059268, "uuid": "9f9a0a00-600b-4bfa-abd1-2b08720be7cf", "value": "384:4OMBLXES8Y8ES7Q4B8DKzGoVlXZvTkwV83D8c6Bms:4OMBLXES8Y8ES7Q4B8DKzGoVlXZvTkw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761059268, "uuid": "e043f386-2972-4605-b835-43ac6a3187fb", "value": 12896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761059268, "uuid": "6489dc93-79f3-42e0-b574-b074bd276b5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761059268, "uuid": "8b2466f1-f727-4cd0-89fe-93f5d3c930a5", "value": "python.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0ba89f-ae4e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761031071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031071, "uuid": "4ad66507-dfd6-4fb5-8e72-3aab28dc0725", "comment": "Malware payload", "value": "6b04e722ee860f0f816fb537220b5936", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031071, "uuid": "c3adc3c3-4e36-41b2-828a-4cc0d280e53f", "comment": "Malware payload", "value": "a0bacc5d5e507dbdbd51f48e52f85c08f707da79288c5737a79cfc9fd80d4316", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031071, "uuid": "947620ae-1f68-4b9b-ac85-b252acfb25b7", "comment": "Malware payload", "value": "6a20f484c63b4ed4a756e0cf907abff7e938fbf2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031071, "uuid": "d81114f2-91e3-4bda-9840-0297d9817f42", "comment": "Malware payload", "value": "5d0dac95f353a4a81a2d9d5dfa0eba0e994d1822a019b1009d589f1211d2017c4b9265fa137c44cd8bc1e93b4b76c148", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031071, "uuid": "e532495e-1c52-427e-9b96-50cb361a946f", "value": "T14C3122BD8235D209461AA340D4957368DCBB82443D22C463A1CCCFFEA6C1999E0F8BBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031071, "uuid": "e3099c8d-aa01-44b6-acba-2702892d4533", "value": "24:cjRrkErKLEb6pM6N50RPf3w1B5jK2NCQUmBFNyR6HcLLPQEILF8PmGmKivZWw:UrKA0d5wPf6s2NC1iyR6HKkwZZivx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761031071, "uuid": "a7004956-490b-4b1a-b407-010624f13181", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761031071, "uuid": "485b13eb-2e69-4668-a13f-5c2fe003c83f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031071, "uuid": "39481f98-d1f3-4aca-a919-1a69973be99d", "value": "walmart-money-24-6-32-EXE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f29eb1-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076790, "uuid": "ba21a85f-4ab7-4da1-8b77-487ad1068b5e", "comment": "Malware payload (Mirai)", "value": "d493013da2d70e894428d41546665373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076790, "uuid": "37d903da-b998-42bb-9e34-f4d05099bcc9", "comment": "Malware payload (Mirai)", "value": "a2d174475ee70b0aab2d3842f2873b2b118cf7cec871a0a592c487229c220d41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076790, "uuid": "6f4c2a0d-7c3d-404d-babe-592c067ba6a2", "comment": "Malware payload (Mirai)", "value": "2d0cbff203f78bc20012744d34d00095cf41d8d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076790, "uuid": "4b3357d0-9087-4811-86b1-92da868766f0", "comment": "Malware payload (Mirai)", "value": "0059640d51443d319aa4d61e3b334030447e2a7e74c0f28308d9c3f154bd5128eb1cf2e907b931f8e46b7c7037f93041", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076790, "uuid": "67bbb447-0afc-4312-b57d-ef41622854fa", "value": "T18BD30845FC405B23C6D612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076790, "uuid": "743d97b5-a691-4570-85ca-92dd61eb65ea", "value": "1536:VHQeHIjFlGz/r56Qp1/lFcAPWZf4VTyqsTgDFYAvTTu2/oAdmlN8Vwyw2FR40o5A:VHQeF6Qj9FcT4YZMDFYA9gAplNib8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076790, "uuid": "d3d053c8-b579-4ed0-870d-e077828a33d6", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076790, "uuid": "3421b5a3-92cc-4d6a-a40c-d2ab9c22af11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076790, "uuid": "285c001c-7c9e-466c-89e4-e107b19444e2", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70da95c8-ae3a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761022647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022647, "uuid": "bc240637-cf8c-4363-94a0-5901e8b43ebd", "comment": "Malware payload (Mirai)", "value": "77e43f6c3a32d75bc9a7c1aed2d13a9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022647, "uuid": "a547ae2c-4fbc-40ad-89d9-ba5e6c2a04ac", "comment": "Malware payload (Mirai)", "value": "a2ee8855a507124bd599a0255ee2f7d30b5087fe272df9430da1c5e01b813f82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022647, "uuid": "bff3cd91-2600-4303-9fbb-aca08da12862", "comment": "Malware payload (Mirai)", "value": "eb44ebb07a685636570fb691034fb32d1dc4126f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022647, "uuid": "db65a3e5-ddb9-4e19-a076-149f8983b620", "comment": "Malware payload (Mirai)", "value": "71cd1ba6f208b9e14f485c0d6e833d214d0f6e9a8a54785a19696f501de362747a67cc66293238c5d66f5fdd4023e91c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022647, "uuid": "80f98159-9b9a-486d-9379-d61ee5a437d2", "value": "T1D613F1E3642B56D0CA351C39ECF88086B8871DBCF1F2B5665108E6ACD7C99D32F36592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022647, "uuid": "a6daf8a7-1a3d-43f1-891b-94e9a1a869e4", "value": "768:+ozodfbzayULw3VSAmiCC3zZZF7Tr5iBaaAIO4jJaGJzSPiVhKo/8GvR9q3UELE:Z6zrvVyiTzLF5iBRdUPmILE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761022647, "uuid": "91e00ba9-0f60-422e-b665-a1b011219b75", "value": 44180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761022647, "uuid": "01fe9c5a-acd3-478b-8ce7-dcf0c2fbf506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022647, "uuid": "8d72eec9-1135-4f82-887a-5bedb9616f67", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502147b1-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761026028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026028, "uuid": "69832c4d-f30c-4967-a85b-fd715997376c", "comment": "Malware payload (a310Logger)", "value": "909de0b8a1c7057d61b10130c221522e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026028, "uuid": "773e1c90-a56a-47ae-8797-d6eb754406ff", "comment": "Malware payload (a310Logger)", "value": "a42530d23d10ce4fb58b72111a6d09c6122dca4ff9fe56550d8e5acbacaab5f2", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026028, "uuid": "31e85636-ae98-4b42-82d4-fd8e08cbb169", "comment": "Malware payload (a310Logger)", "value": "f21e4bcb1f9006d91fe653300b805c9e3fd228d2", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026028, "uuid": "6d72e624-195e-4984-b237-7a242f72327e", "comment": "Malware payload (a310Logger)", "value": "50c77cc8e779ff1b1eaa351888ad21e5706c98c63a40168c24f00027dc60f8dc2d48af1a921096d1cfa385d7520b3d5f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026028, "uuid": "8b4140c0-d4e6-465a-92e0-5ad867d95619", "value": "T1F8F402682F4DEE02D88527745A21F3752220AD9DDD11D2134FEEBDEFB879B12395C282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026028, "uuid": "310b1b29-70ad-4235-8b25-6bf655635bda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026028, "uuid": "b34d2287-9cc6-4db2-a6c8-59dffc101060", "value": "12288:BO3L/rb8WkKwK1c2vwLXRYaEfdiEDyLOwwv4pO4i/ZgL2JsYN/xrX45NpToxEb0a:u7v+Kv/4XRFAdiZV44pOPZtJsMgeE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026028, "uuid": "3687aac2-a99e-43c5-aab3-e9be20f70f62", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026028, "uuid": "ba623f21-06f7-4ad5-9600-f9c35e912a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026028, "uuid": "348cd62c-d57f-4e1d-8f50-6640bd6fbd7f", "value": "Y\u00eau c\u1ea7u b\u00e1o gi\u00e1 Tan Duc Hai-PONVL2025216-T\u0110H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd336f40-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064060, "uuid": "9559eb67-4908-4a3a-a29d-d8fd885e06bf", "comment": "Malware payload", "value": "b33bd6fd4a694a5f5191f1c2e5c99b1c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064060, "uuid": "75cea908-62de-416c-bbbf-1d18ac24ea36", "comment": "Malware payload", "value": "a534b3c4f5083bc9c6e027755412deed40364a16603550a81abaffd01bd2835c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064060, "uuid": "03a7f75a-0fcf-403c-8110-8f01b43359ed", "comment": "Malware payload", "value": "619e97b76f4c44d60f975507b15895c6dc6ada89", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064060, "uuid": "6dbaf805-b376-4f7b-948a-94379c2b087d", "comment": "Malware payload", "value": "42bd1f60ccc23a1f1f37769118020cae6f353136926062cb93cbf98bbdb3238a3af6a4f27909eeb49c7f1e7fc0a97b57", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064060, "uuid": "dc8b6cb0-d0c8-45f7-a183-1c220ac60266", "value": "T151A3E789AF46ADF49366BFBEEB590AB0C0030D05C84E9ACF150EB675BCF414946DE0D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064060, "uuid": "de6421d0-0585-4aca-8737-cd562a793590", "value": "1536:GDB7eKg200JGrDrtByNaBFuUXAavyVNk6BkQWJ+aY:GDB7b0p/PrANk6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064060, "uuid": "f44ba3e4-63ca-4c4c-a705-defc32563735", "value": 104707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064060, "uuid": "978ed72f-48b3-432a-a922-1076387fead6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064060, "uuid": "14d3dafa-f25d-4005-a62b-6cbb9e00f675", "value": "invoice-1637482117.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a2c315-ae33-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761019486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019486, "uuid": "c2a68512-2c82-46ed-b5dc-36ffaf92901c", "comment": "Malware payload (Mirai)", "value": "1dea26da8bd574fdccd82a9f8dda3e0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019486, "uuid": "e7deae87-6471-4ce5-9e1e-619601b66c29", "comment": "Malware payload (Mirai)", "value": "a552e30759dc66cbc35dc894d48071f4397366cc1658b79efd16d91a81d54b5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019486, "uuid": "07ed1da6-18ee-4d0f-912e-8556e4498405", "comment": "Malware payload (Mirai)", "value": "bb3bc425dcac5591aeb7932d8a8a2bfe304fbc50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019486, "uuid": "589fb750-d360-491e-8d2d-5bfd099b1429", "comment": "Malware payload (Mirai)", "value": "d390df3b1e84049c0eb2fa5a5151bf0715cf1da728c8f0fec235205e596970808a25a584dce69a47744dbaa78747b374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019486, "uuid": "b21184e7-409a-4609-9d4c-e2f596a9e3d7", "value": "T108936C22B9391A3BC4D8D47712F74322F1F6478A24A88B1E7D710E8DBF24690375B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019486, "uuid": "3aa669c7-b9b2-4962-9b09-8af9014e3325", "value": "1536:GyT+JUQCLh7jliK6bWf0Mdcol1teJ4Nm5pD4O7HtVUR:k1tt+u4NOhRUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019486, "uuid": "2209839f-a7e7-4d15-b4be-d2a2396ae72a", "value": 92224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019486, "uuid": "1fbb050d-6cce-4ba3-9a40-fdc2eebd8001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019486, "uuid": "43ff779f-9306-45c6-91be-53cbf5451b40", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb9bf66-aeb7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761076250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076250, "uuid": "d9dbf039-d97b-4a64-8a8a-16b62a772795", "comment": "Malware payload", "value": "1d208769eceeeba859ec05b31f6219ad", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076250, "uuid": "050ea9c8-3f2f-43ef-8aeb-b1397260be27", "comment": "Malware payload", "value": "a5a9c93da8ddd1660fd77a91479e5245b25e4a6ff64a24702c10c7169d6e46cd", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076250, "uuid": "5dca6b2d-c1e1-4cbc-8c84-6f9b0aedac3b", "comment": "Malware payload", "value": "7f44277aef4799f6d31a15f8c08f3068f6a88b0e", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076250, "uuid": "2fe491e0-4ba0-4a30-bad3-cc251e66874a", "comment": "Malware payload", "value": "b79ea3a510555758636dd24a5345366a37fbb064d31fe6af676153d08c066996c923844098411463af9c23e4bac11a57", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076250, "uuid": "7b997fdc-4d4b-4d2f-91c3-c2db527662de", "value": "T145446D4676951CF9EDBBC53DC9424905EB727C5647A0EACF03E00A960F27AE09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076250, "uuid": "111f6680-a478-4fd2-9bb4-8a90c90c50a8", "value": "7a30bacfd7c73383390074276a42a91f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076250, "uuid": "8ce4c17c-cf81-45c2-8d82-663a12e3f3a5", "value": "6144:yRVj/uk8lP+8EBs8qUvULYPggufqEWLphe+dYs:gm0rTvJPgguSEaWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076250, "uuid": "fddef66b-e1c8-4ab3-8a9b-261f8e9325d9", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076250, "uuid": "d455b969-5d0a-4d44-8de9-9f8313cd0432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076250, "uuid": "eb2dea52-4a2b-4c0b-aa9f-8572c360ca67", "value": "2sadSdsa2sad2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f9914f-ae3d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Koadic)", "timestamp": 1761024164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024164, "uuid": "69e36b20-d4ec-46d3-8599-cb425d56c508", "comment": "Malware payload (Koadic)", "value": "59d456494205243b3b0b566de0145456", "object_relation": "md5", "Tag": [ { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024164, "uuid": "db49ae3e-dfa4-4ee7-abb9-98841be8a8c8", "comment": "Malware payload (Koadic)", "value": "a7457af49c136f70eeeb5c3e271ce2278d4eef71153643b9e41a83f7093ebd80", "object_relation": "sha256", "Tag": [ { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024164, "uuid": "5fe63766-8d4e-4f94-bb3f-5e0bc48da145", "comment": "Malware payload (Koadic)", "value": "650fa56c616c5e4144d62bf23a32ff1001079be0", "object_relation": "sha1", "Tag": [ { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024164, "uuid": "839d3442-cb8a-42e5-89d1-aa70baa52b3f", "comment": "Malware payload (Koadic)", "value": "9abd46a653fff8f2a716bd1f7decb107c08ad82141c332bd803cdf93b0da0f513b0a1754a6f5262f718706ea555ff7b5", "object_relation": "sha3-384", "Tag": [ { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024164, "uuid": "86edb885-13c1-4a56-aed5-e8f32f334031", "value": "T1E0356B15F3C7C622C55D02BBF559FE0E1938BEA3473041E7BAE5395F48B08C162BAA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024164, "uuid": "eb5acd46-df7a-48d6-9167-d45172be2ede", "value": "12288:cmd6QLN5WNvEk6Og0UO+HgTFjKaEW5B1Qlc:cmdxLNbCg1O+HmV5B1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024164, "uuid": "dfa3e2df-3945-4f13-bba9-198a6de5eb1b", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024164, "uuid": "f0ba3bcb-1318-4989-a4ee-2afc9194e7c2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024164, "uuid": "5070b5b9-b63f-4bcc-a7a1-9650b3ac3873", "value": "videoconferencia.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c048eb-ae3b-11f0-91c6-42010a9c0006", "comment": "Malware payload (HijackLoader)", "timestamp": 1761023116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023116, "uuid": "64a0f0fc-552c-44c1-8f14-0d5feb30b544", "comment": "Malware payload (HijackLoader)", "value": "98fa1bca9aa27ad3ba7d9770f2dd6d91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023116, "uuid": "e7d38327-0a6c-41d5-b613-1625ac41595c", "comment": "Malware payload (HijackLoader)", "value": "a78ffd85baef5049b36b9e694d41509aa3c9308a1ec5294c0ab5ae97eb95b18d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023116, "uuid": "229582d5-d842-4c67-bff0-dea9ffd5bb5c", "comment": "Malware payload (HijackLoader)", "value": "122d4a0a9433bfc8744624a37fdf2cc70555f6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023116, "uuid": "d6a56aaa-6ca2-470f-9b9a-e6f4618d9a17", "comment": "Malware payload (HijackLoader)", "value": "c718a35d6a843798ac51675ce22ae85a9f2b285280a2dc4dd0d81616b283533929b73c4178afe7ad327b34f1d8e425af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023116, "uuid": "506a5cfe-b551-408b-84e7-8aaab26848ad", "value": "T1C8379E27B7A805A5D077C07CC5979B56DAB2785507308BDB03A18B6E2F27BE00E3B761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023116, "uuid": "8a39abb1-1fac-42dc-acf0-efb9658e7d00", "value": "8b4d0760d426c9138154c52a7dcc4339", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023116, "uuid": "725b4e87-2841-4025-a6b6-0857576c4169", "value": "196608:ZxzGEX79dQtIOcFf/qfeaphlLtI6fWeYTmKq5ES5kG6B6/UyCdiFf7z:Cq79sIOU323lLUHC6SiGRMyCoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023116, "uuid": "e929db38-8e90-43d9-998a-bce3e9e0d660", "value": 23978937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023116, "uuid": "fb0cb179-7b0c-4f7f-83c8-2cd4224111f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023116, "uuid": "03e836bd-f5e6-4a83-a378-f46a3a805600", "value": "a78ffd85baef5049b36b9e694d41509aa3c9308a1ec5294c0ab5ae97eb95b18d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc9b622-ae95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761061588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061588, "uuid": "398c2614-b59b-4fa6-8874-706d9013da50", "comment": "Malware payload (Mirai)", "value": "e65dea447a3f41b64ddfa4e0654f7a1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061588, "uuid": "82aa7fb5-6930-49ec-ada6-4e0c3f00d46a", "comment": "Malware payload (Mirai)", "value": "a7b37644726bd6eec506003f54e4f7b056ecf3ba75042b36fda9430be821bd0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061588, "uuid": "32bc56c0-c7ec-4397-b707-05040f59e9b6", "comment": "Malware payload (Mirai)", "value": "430bea5b7e3b570af9e3c39792c9193e34c08f0c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061588, "uuid": "212d8ed4-5ad3-4893-9928-228104904669", "comment": "Malware payload (Mirai)", "value": "255ffbb273791b9140a083022cb4f785337d9fa92bcfb69174442378ced4314b23dc6cf24602ac62505933279743b7d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061588, "uuid": "27ec1919-4cd1-449e-8793-2c15a52de4a9", "value": "T114E030DF3861335A8CD0AE40B3724C449029C2C93CE46BDEF56AA4B686D45007019F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061588, "uuid": "925bc600-1b93-40d6-b417-78b488859118", "value": "6:SZEPUSExL4ENNNIl5YMYEfFa0LKiHYEANISTElJN5QyEnanIf2Uv:sCo4UNNIl5hY0c0LKuYleSTGNZAfJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761061588, "uuid": "2a70a746-aedb-4d47-8e90-04ef4944b918", "value": 431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761061588, "uuid": "719f492f-f3a6-4448-b9d4-08fd193b1bff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061588, "uuid": "f7b3b670-6e72-4c79-af42-cff0a4fad1b7", "value": "faith.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b85865-ae6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761044774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761044774, "uuid": "27d3ccc3-80e5-446b-9f21-0c4f9e6528d8", "comment": "Malware payload (Mirai)", "value": "d99d8083b89d5b0d2736731ddcce0311", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761044774, "uuid": "fb2ae6ab-ae3d-4ce7-bd3a-e641f6d84ce5", "comment": "Malware payload (Mirai)", "value": "a8abd4b3c947001c27844981406186fe722bbba9c50a09a76adcc69b8ebb663f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761044774, "uuid": "cf106184-7307-49d9-a3b0-ca3623969d10", "comment": "Malware payload (Mirai)", "value": "0766a2cc5f5f1d11ed50862888237ee9f67b597b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761044774, "uuid": "323b6ca9-f18f-4fae-9642-b6537926b79a", "comment": "Malware payload (Mirai)", "value": "5d60f8bc8c3fc9a52b8a8eafec3d57c86cf703211cf0719b8e34e7d538f512ef7170a06f6dcc799c6255affb2fd27634", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761044774, "uuid": "71890134-18aa-45bd-9803-d2ba4bab1ef4", "value": "T134530986B8919A17C5D493BBFA1E42CC332523F8D2DF3217DD216F547A8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761044774, "uuid": "1a1ee62d-69bc-4dc6-b537-43846865405d", "value": "1536:7iiOZgb5NBbIP5WJG6DkHw+VrORqgJnJ8VR:7iiOZ9WFoHrBgJnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761044774, "uuid": "bb8574c2-aded-4223-a154-24a48831cf72", "value": 63568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761044774, "uuid": "d06fd89d-b21e-4b3e-a23d-97dcbae03de5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761044774, "uuid": "f60cfeeb-4791-4eab-a835-6dfccc65a7de", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc068ec-ae76-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761048274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761048274, "uuid": "4afed0a2-137d-4bd7-8a73-37e45c10ac7d", "comment": "Malware payload (Mirai)", "value": "190e5b51340403a6bcb89de391bffdbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761048274, "uuid": "2915aa89-8bc7-4c93-8deb-c7943354a57c", "comment": "Malware payload (Mirai)", "value": "a957a145f85dc7960512d06170701f5690a9e0a09cd656714fdba0f13073af16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761048274, "uuid": "dbd7db94-4ea9-48cf-b2ed-7f7ec590d9a7", "comment": "Malware payload (Mirai)", "value": "0fc18ffc3e718d4811a1caa0765ab05766395062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761048274, "uuid": "4ba5bd17-1a48-445e-9b78-52dada8528a3", "comment": "Malware payload (Mirai)", "value": "bad3a0778964290b1e13dbc583df025e9cecc90aed39e2e8dfa359cba16f6543ef7d83db67240373dcee59df9c1e17f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761048274, "uuid": "29994d16-0067-4029-a17a-77e96724067e", "value": "T13C43AE66C52DAD94D10842F4AC34CAB82F53E610D65A3EFB3A95C1624003EBDF69E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761048274, "uuid": "2736a4da-56a5-45b1-aa42-5fcca0ab52c1", "value": "768:6TaiwtOOW9KJq6UGXC5ADqzgyeqLV7ulT6qCXf5SoqeBC33nJ8VRt:6TaiwtOwHtSKceceFa5lpBC33nJ8VRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761048274, "uuid": "856b14ac-b2c4-4cd1-98c2-95b7baf2768a", "value": 56216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761048274, "uuid": "a866ed0e-3ce6-4c49-9e2f-aecaad655f7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761048274, "uuid": "41885dc6-eec4-4c52-afa6-d4fa944c2114", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661d8e22-ae73-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761047110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047110, "uuid": "f61df226-c1f1-42fe-8610-815c7420478d", "comment": "Malware payload (Mirai)", "value": "99a1dd971daff18f8c2cbf813eb16aa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047110, "uuid": "480ccf72-3944-4e98-9ef2-c48b11acd510", "comment": "Malware payload (Mirai)", "value": "a9e7f26864c2fda083a0eb202d0bf246af7429f28a57efe5c03db44d245a1dc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047110, "uuid": "ee015c95-3d3f-48bf-a683-f963e0ffe578", "comment": "Malware payload (Mirai)", "value": "75a78d8b8e4e0d5cad5d0a7f32b19548e739aca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047110, "uuid": "498f689e-58df-4f66-9db8-80af75e316f6", "comment": "Malware payload (Mirai)", "value": "b9050c149684ce82b4b8d75ecc9796a5bf20f81b2f9fabcccfd2ef291f1b5e765da7f19d8947d4a3a7cdfcafb8c1effa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047110, "uuid": "c9178b23-a2eb-47a4-bfda-42d62c3cdb32", "value": "T1F383E746F9819F15D5D922BAFA1E018D335357A8E3EE7202DE105F143BCA92F0E7B912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047110, "uuid": "e3b2f4d1-0bd4-4af6-8d91-03d0022e8b67", "value": "1536:nBnwJ3Hxpkijyda2V2RIwXslmVJPN6Wkp+YBTn0+qulluRiw+Bqk8JnJ8VRW:iH3kiji2RIGN6zp+YBTn0Zj+Bf8JnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761047110, "uuid": "f61f016b-1a82-4694-9c9e-e299e945c2ff", "value": 87376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761047110, "uuid": "66b85f58-c3b8-43c8-b263-bb0ac5563f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047110, "uuid": "ae9e052b-c880-47d1-ae7e-b8882e521452", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675b4960-aeb0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761073311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073311, "uuid": "d65714a8-d293-49af-929e-840b9734e6b2", "comment": "Malware payload (Mirai)", "value": "5f613eb5dbf610ae61f28d1c73cda88a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073311, "uuid": "31bc0129-f859-433f-a7c2-4bc60193f446", "comment": "Malware payload (Mirai)", "value": "aa7d1475633af60ac52a7c1fd3cf48081184ad7fd3ccc02ea4f9643ec50512ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073311, "uuid": "98922017-a6ec-4bef-bcaa-03290f7b20b6", "comment": "Malware payload (Mirai)", "value": "b0687bb11d40be14c08b49ce6c927e264c822fb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073311, "uuid": "0359d36a-8792-44ad-9267-d796744a3a21", "comment": "Malware payload (Mirai)", "value": "e64731bb1f15ae41d65641ccfc998d860b30f5e2a57c7bba748934e4864c37c7b2cf5cd4600d72825dbf1fb3d08e4e07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073311, "uuid": "66b8a714-3c72-41e3-9c12-7bec36dda761", "value": "T1F9630263E2893933C6D5C8BD45B14B5466A2233493C93636B319FE34B1D34A11AB1FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073311, "uuid": "c8777cfc-abc3-42fa-b116-94fbccae606d", "value": "1536:7gyf7dkY8DgMGW1+JhCV+OuaJO6iyrDLrkcE5zG:U2+Y8DgMzFuaZiyrvr45S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761073311, "uuid": "4d316731-4ae7-42bf-bbb7-03127955bddd", "value": 68552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761073311, "uuid": "2389b655-48e9-41b8-995a-59ff375ffeeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073311, "uuid": "abc3a1c3-a72c-410e-8bcd-2fe47d0b03f4", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070c578c-ae95-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761061554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061554, "uuid": "af7bc46e-43a8-4f7f-8c32-29e735c56a3e", "comment": "Malware payload", "value": "5ac87547074076a728cff3f24877f9ed", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061554, "uuid": "ad97b6e4-7850-4fcd-a696-a1b9997de71f", "comment": "Malware payload", "value": "aacef8dd915afad6ff230073d1742eafb5fc1b4482875c6ba5d2e0c3273f7346", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061554, "uuid": "5cd7cbcb-ef57-4113-a536-c4b31c770455", "comment": "Malware payload", "value": "b54f7dd6f6244284abd56ca72708182edcd167d6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061554, "uuid": "58feee54-ddf8-4a4f-8f87-4844f3b9e080", "comment": "Malware payload", "value": "4de31721a8a77ac826884b80f49d21bb3f5d8399badde4ab56939454ae0cda3c15a5250e27b95aa7ccfde8d2edaee9aa", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061554, "uuid": "4742d718-bd39-418a-9d3a-b089e4392cd1", "value": "T1DD31231876A0DB3D41F2561F8DD796377C2A225531305B44B3BEC358FF4901E8296B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061554, "uuid": "d98d9fdf-ac60-4b26-9978-ecc8a8b23cfa", "value": "24:4et8DaDecMUyZkYkLMhM0H8VAbs9PJ7C1Q9KjaJvKpbDLMh/lahIa5Cf2HLRm:4eDecFy2DghM0H8GkV9Kja0p3ghAWwls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761061554, "uuid": "00315179-bfde-48ea-ba4f-a1ef8155d259", "value": 1571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761061554, "uuid": "3e35d662-65cf-4df3-9a7c-3c7a7943171d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061554, "uuid": "2b4b2967-7214-4209-b079-a479e057c65c", "value": "FhVmkEq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f898b437-aecf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761086870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086870, "uuid": "cf9954e7-de02-43ee-9a34-3dc57c2818ab", "comment": "Malware payload", "value": "6ad4a0bb8f8d76ab7a25b114effdbf49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086870, "uuid": "65b87562-d1cc-40d9-b6bf-a6d53863130b", "comment": "Malware payload", "value": "abe0f7d06af2d2079e236a55327ff36eedf7be52f56138a23b9594fc992fe176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086870, "uuid": "4034c768-51a7-4a1f-8a4d-4cc255ffd45a", "comment": "Malware payload", "value": "047d429751b97e7a1ba69d5a3a197d02615eacf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086870, "uuid": "52fd7cd2-7e89-4a46-8a56-4604a45b06d2", "comment": "Malware payload", "value": "6d38e14317779d53c5bb0bd17adf3785c09f0c92096d4c341a684c99e9596953f56495fde992bf9fa52d582a038956ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086870, "uuid": "632524cf-296c-40a2-afcd-1d3c926266c6", "value": "T1C5E142133B148EB6D8BC097846D3FDA772995E293B3B927299280317296212469A4915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086870, "uuid": "884095e0-8896-446b-8fd3-15affb987699", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086870, "uuid": "a7659f17-72b7-454a-8b7e-9a99c87b12d1", "value": "24:eFGStrJ9u0/6y2ZnZdkBQAV2GkRYKLqnKeNDMSCvOXpmB:is0opkBQlRYqSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761086870, "uuid": "49332192-ebc5-4486-a3ac-5ffcad07dea1", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761086870, "uuid": "bf466adf-1d22-4dec-9728-d40cb011225b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086870, "uuid": "d6e0a68b-f893-4a75-8d88-75e62570bfa7", "value": "thesetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042a2874-ae11-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761004855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761004855, "uuid": "e9fe138e-ef76-4129-a958-561618a6fc51", "comment": "Malware payload (Mirai)", "value": "e659cb452708a52402fdcabf5fb0503d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761004855, "uuid": "d80529df-faa0-48d7-b2d7-4004bf829467", "comment": "Malware payload (Mirai)", "value": "ac826d3294735298526075d1e9b44561854629ac7cf060c2b14cbca4ad5921c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761004855, "uuid": "30c23c38-505e-4487-951f-6415cd2cdc11", "comment": "Malware payload (Mirai)", "value": "f6414216186c1d9638c79ef41a21032f3a88c1a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761004855, "uuid": "32f8e288-1e49-446e-ae53-d8d7cb24bc6a", "comment": "Malware payload (Mirai)", "value": "b4fc84662718834b187d63bc3ec3bd2ecf51be3a7c3e52355cb14a5bf8d59ee890216454225e49348a8b2dfe8687b75d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761004855, "uuid": "f6dc0927-1c83-4625-84af-307a57d516a9", "value": "T13C83F74AFD819B15C5D922BAFA1E128D335357A8E3EE7202DE105F143BCA92F0E7B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761004855, "uuid": "8fc3332b-454c-43fc-8374-111f26637174", "value": "1536:ZRnMzQAYegOAQIf2GmrqmCJx2cvrN7CboWO+bYkwqIllyaicgWEwKJnJ8VR:CQxehm2GmujN7EoWO+bYkdwgW5KJnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761004855, "uuid": "6a59cc9a-3fab-40f6-bd10-c0a6051e0c78", "value": 86192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761004855, "uuid": "4cab544b-f21d-464a-b2d5-993a7b51af94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761004855, "uuid": "750881c0-b153-4965-bf67-1091097e80f5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cff4b7-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063855, "uuid": "e321376e-4fdb-47f6-9b61-9b2198cde9e9", "comment": "Malware payload", "value": "3f464c1dac3ec0f70e9f46e8124a69fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063855, "uuid": "1b898211-ff82-4bdf-820e-2bb5a1ca0c3f", "comment": "Malware payload", "value": "ad06493611e381363209aaff29eda7ba96c116e2b84aa2ab9363a1f80904a137", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063855, "uuid": "e0a3ee7a-430a-47b4-b958-c542b40e91db", "comment": "Malware payload", "value": "4ce9da2d1e5790fecdea56b6b091be94b638389b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063855, "uuid": "9d3a45dd-403a-42eb-9775-373175118505", "comment": "Malware payload", "value": "1197f5b7db590b93e999148123a0bfc9066667acb448ca6cdfbe2c09e70ec37b7df3e97bb21c6e4c2528f977c1c5ab38", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063855, "uuid": "f5a81e1e-60de-40e1-8304-ba664e55de93", "value": "T151B3F51ECD37ED949FD5F2C12B1A65A2BA1B921B42909014CE7C7317A04CB35BE9CCA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063855, "uuid": "0c726b80-9dc4-4039-9c9e-a13d13db9daa", "value": "3072:GDB7b0L2R93LdPQ7c/GDDM0Fw1xrQ78Mfys9QZxAnMMGcbU/HqYTCodIosjj+6fR:0U2R93LdPQ7c/GDDM0Fw1xrQ78Mfys9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063855, "uuid": "6cc6f28a-9df3-4cad-827b-26e70cb3a57a", "value": 108093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063855, "uuid": "c7d26031-e061-446f-bd30-9f8ebf8cfd28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063855, "uuid": "f9ab709d-0577-4f92-9b1a-30d726f7004c", "value": "invoice-1637482117.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59124a24-ae69-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761042793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042793, "uuid": "629b5f19-10c8-4ebd-98d5-569b1293de3a", "comment": "Malware payload (RemcosRAT)", "value": "765cc998c386b0b448c618fd858110df", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042793, "uuid": "dba3ed1a-8cb3-43e2-ba28-edd1cbd45482", "comment": "Malware payload (RemcosRAT)", "value": "adac9865fbb10c53cae9f3d670bf07270274d7f0ba7732a115c4e46f73c48d09", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042793, "uuid": "2e669266-afb7-4223-b642-02f00bd26d9c", "comment": "Malware payload (RemcosRAT)", "value": "d6a42ac875e637a8a974ce40d800368fb1a19a20", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042793, "uuid": "a5227c35-1b12-4380-9f60-4b8c2f65d512", "comment": "Malware payload (RemcosRAT)", "value": "adf306ecdbe47bab09f8b4f44a2ca3447c81c5f038cc30ccf84e13d203edb07be0c74a1a262a10abd0df35efa0fbb037", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042793, "uuid": "167e577e-00e0-4eb3-9ca7-01706e145cda", "value": "T178D5021489C42FB9CFAC5A1880FE161E93E05A8E946A758EFB33BD4ABFF7504410B1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042793, "uuid": "0779012d-290e-4fa1-8f6c-768643e01897", "value": "24576:T+F5W/JBahVpjFmVnzSUhXJM+b4FsyqrNJ60rSCRuZ+jEDQuV56f4NtwwyjG0y85:LqXpKWUpJf9jEQCw2m5910ZNpu/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042793, "uuid": "79fc78eb-e51c-45d2-bfce-861de6f61206", "value": 2959676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042793, "uuid": "f3038131-8737-41f4-83b2-acf369445ea5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042793, "uuid": "ca0ae2e0-3c60-4556-a9b9-e4cb4bee35ff", "value": "secv56fghgh56n67878700hhhkhjvdgfdfg90fgf6555f56656.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3710038-ae3d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761024128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024128, "uuid": "74ceca99-0a4b-47d2-8410-7773bd7bc299", "comment": "Malware payload", "value": "0332495cc90186800bab1a39a7d71f55", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024128, "uuid": "4a9ec97a-f403-413d-a52e-72b6505652b0", "comment": "Malware payload", "value": "ae4917573fc954bf76d515c2908df41782f6d764c27a39adb0f35135bdc4f4c6", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024128, "uuid": "d0a0634f-f649-4fdf-96fe-cdc6c8b5f362", "comment": "Malware payload", "value": "293278646791e3bd34e18447d97962b0e06ee66d", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024128, "uuid": "6e209909-bb20-4400-a90f-b6f4e9642602", "comment": "Malware payload", "value": "52e7fb5618487f955fd2b41e0952a8eac970114c9d3a062df04d3f21b1632317e09cf00be58c71b045bda011499f9cdb", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024128, "uuid": "5cd3c9a5-cd9e-474d-b600-abb8c73de715", "value": "T1F3446303B65686F1C644B733C1D7580023A5E992B6B3D60A388D37DAEE937BF9D0524B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024128, "uuid": "6ddfea59-4606-4870-b7e9-be836a70db4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024128, "uuid": "2820d580-164d-4ee6-8712-249f43166a51", "value": "6144:3blApLq0/LN733gjeQbpQW3ENmxLml6y0XWa:3hM5neCmxKoy0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024128, "uuid": "e2a1d5d5-96ac-4957-83c1-d51d44a54cd7", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024128, "uuid": "c493e965-015a-458e-ae39-0d37130aaf35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024128, "uuid": "16e399a9-f8b7-4269-843a-6c578cff02ff", "value": "ae4917573fc954bf76d515c2908df41782f6d764c27a39adb0f35135bdc4f4c6.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ba1415-ae2b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761016395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761016395, "uuid": "5dd71e92-0fcf-4762-b34a-2397f21697c0", "comment": "Malware payload", "value": "2c13824fb0adecb7cfbec8cc25b62abe", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761016395, "uuid": "2ed9ec47-dcfe-4fb8-91cb-7eab3f547afb", "comment": "Malware payload", "value": "afd62708af41e20b9aaedac23e9097ae47ecb2974eed86209e1204e7b2a70df5", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761016395, "uuid": "55b4114d-23f5-4d20-bf9f-36211c4b6f87", "comment": "Malware payload", "value": "99f9ac788419fd96e9ee66c653e9e54a008b2d4e", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761016395, "uuid": "e91373a1-cdfd-435b-a006-23a44e1f97f6", "comment": "Malware payload", "value": "e63e877a2355e7892235e7ea29b2be089114e25b17505206dfb53dcaf399f52e87816312847ad213f9b33cfe6cc9b546", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761016395, "uuid": "1d3e4f1f-1aec-4b04-b9dd-99d865e01b1e", "value": "T109D7F249D50CD536E9CEF07C6F7A0A27B1353C6842A9C15A6829F109FAF73F046B2B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761016395, "uuid": "6bc01cfa-858a-4c50-994c-95c5254d5ccc", "value": "786432:RLPTHGz4qHYiWpNgkInkK8rkivKiu8xyUhlJkGtCy2vdwhE:NPSzRYxNgkInk3VWJUhltCyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761016395, "uuid": "9b6139de-3409-45c8-a429-6a89dc1bac73", "value": 61011068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761016395, "uuid": "a3f1a14b-54ab-4877-a419-ca24cd506d91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761016395, "uuid": "31f0b89d-fe35-491a-a774-42f5e713b21b", "value": "Drama+Shorts_3.0.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b1f8c0-aea2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761067534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067534, "uuid": "68d68f38-c8e6-4e5d-9267-c0e5c49aa0dc", "comment": "Malware payload", "value": "1d3440a69478457d4f8f176ecd826988", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067534, "uuid": "7d303044-50de-4e69-80f2-e0ec2e0d041b", "comment": "Malware payload", "value": "b2d456e43794b41056b523a63405691da0a09adfbe99eccc84ec2afc9cb3d275", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067534, "uuid": "d7f0fa33-40ea-4b5a-bf30-d7074126e096", "comment": "Malware payload", "value": "157cd9e7f708e6a149dc13b006044415abdc8cf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067534, "uuid": "98b8da3b-28a3-44aa-a2a9-cda72549a921", "comment": "Malware payload", "value": "1652e4431858eaf47c89e50c133f47df737e0dbd9370976208ae94092ac4c0f93da2d705208bb08198947bb1d2b8b596", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067534, "uuid": "8ab21698-816e-40f9-8ace-f2a29f699cb5", "value": "T1C934738ABFA03FFFD81ECD3302959A09129C491A52D8AF762B34D518B64B14E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067534, "uuid": "cb01956e-d2ec-4b9b-b95c-f0fe0c438cba", "value": "6144:TA6CVgAjYE6K7HeXA/93HUQHVwpeKk5CnvbWVRkJXb:ww4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761067534, "uuid": "9ae4ad0b-f2bd-4a3d-9b9e-7ef6fa7a3f6d", "value": 231536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761067534, "uuid": "827acd4f-22bc-42a8-b9c9-729627a74291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067534, "uuid": "4e5204cc-0bf0-4a59-839e-1bca09d09e04", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9def0a38-aeb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761073403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073403, "uuid": "10b8c016-b183-4e17-8c16-6e1a69aeaf05", "comment": "Malware payload", "value": "1ee97c17d2bb95441fd836f60616729f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073403, "uuid": "9c234b71-4652-4f65-8245-5fa310b86edb", "comment": "Malware payload", "value": "b36a0c0fee4f14ca2440825cd6c93578b8572c28a2cf817ee9b795a2091a52a0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073403, "uuid": "ee260ed8-0255-493c-992c-397ce3e03940", "comment": "Malware payload", "value": "48db924c26490c154d863b39c77321aa23edefed", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073403, "uuid": "bc88802e-4706-4f9d-9898-c2ee090bddd9", "comment": "Malware payload", "value": "853c5cfd86c1b8c14512adc42b96a3aa7f3a6306dbcf2ddb0fa04c14e42243663af53e3bf2e4195331f6a22e86ddbef2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073403, "uuid": "057ff9a4-70b9-4467-b33b-bb3774c7659e", "value": "T13A66E177A6A4051B05E2076AF00A62B3BE3FC463874D42B5D89DE22935CB4EFC17E5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073403, "uuid": "d07a9130-ac32-405b-af70-c9e046e14338", "value": "49152:42NH8PlcMxD6IOlIyvg9qXpaHy8R+jzzbvmMeGz03r9Pv0TMn/a9xU5F3c/vc3wv:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761073403, "uuid": "3f6dcc47-ff96-4792-b023-30ef9617d64e", "value": 6765959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761073403, "uuid": "78adb0b4-1649-47ce-a22b-174cf3c3067c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073403, "uuid": "2353156a-ab3c-47ba-9213-b906e9e189a0", "value": "37619_-Vis0ER6ualizar_076803218VH41.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a9cd30-ae95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761061585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061585, "uuid": "740eb192-8a71-4225-9650-835ebf361636", "comment": "Malware payload (Mirai)", "value": "c1d258b9e14c9c2d0b7fe90c8db518b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061585, "uuid": "b79de2f9-195b-40e9-b6f8-8a49de81cbfb", "comment": "Malware payload (Mirai)", "value": "b4f99fb1aa34446d9a212fef85b747e1e69bd394e88665b76942d79dee1ac7ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061585, "uuid": "3b8e92a6-0450-4c03-b453-3a8b359f0772", "comment": "Malware payload (Mirai)", "value": "b961c0a7bb80d9862061a24d2672da554efd01e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061585, "uuid": "325e2c33-d9a7-4ec9-b521-7e6b4e0d891d", "comment": "Malware payload (Mirai)", "value": "63ca74da80b5e04fd071f0f3ebde77f2ce68f3902e9df9347c5288ef3eab58a93efa29bd451faa86d4c99c1feb24136b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061585, "uuid": "df3aad09-d7ba-4811-8ceb-71f5adc1f79c", "value": "T191F0F68FE16027478DD4FE8AF1734D885019E3CA28D25BDAFDDCA0BD41A8580F052B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061585, "uuid": "1c6b4ffe-2195-40a1-8913-18a758f24edd", "value": "12:tzwcKLHVoYkklUNNIl5KH0c0LKVHkvsle4pGNYVvGrA4aX:tSHeY76NNI7KUfKRbe48NG4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761061585, "uuid": "c8d5b18b-0fbd-40ea-9ba2-cf1fdafb2be3", "value": 586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761061585, "uuid": "d0afd6b9-d2b6-4f5d-bbe0-a37bb9bfa9f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061585, "uuid": "21a5c85f-9b75-4b2f-8626-281471e2bce1", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f15267-ae5a-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761036317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761036317, "uuid": "22345940-b805-407a-9557-7ae8a146097b", "comment": "Malware payload (XWorm)", "value": "5d00e054ce07323bb9e29967d70f28a0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761036317, "uuid": "de9415e9-42f3-4195-9721-3e957ebd57a4", "comment": "Malware payload (XWorm)", "value": "b51dece1c0b3a6422d16176ce2397cfcdde099be7700cc45b8c79c30d3727489", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761036317, "uuid": "075693f0-26cb-4b77-a1c6-f5442ad5f35f", "comment": "Malware payload (XWorm)", "value": "933480febf71241a3dc55aad7aced78b01a03d59", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761036317, "uuid": "04d9aaf5-cd68-4123-9f01-5831844d9105", "comment": "Malware payload (XWorm)", "value": "85b2e108b6834e4e4225f9a2a2340706e7ee55f7cb2e6ab82259c2c90cd482e5b5ee803e4961b62b5e7777d6de206622", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761036317, "uuid": "4656a1e6-d8fc-4db9-8857-d3b7e89e39df", "value": "T1C6F36E3A97B0B9A7036BED9C4775FE07348893729B203524FC854BE13B136DDA79A058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761036317, "uuid": "26fc78a4-9720-4b91-aede-5865fce5e970", "value": "1536:oFnQSeoOpOfvUj+rk23OdiuReKLWbea2fvX3a0I9/LUfBUXqw+UvUKOwsa0I/PRX:S+d30AlUDwaMqcyiNZeRDof+BaHfPeGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761036317, "uuid": "820982c8-6955-413c-b280-1f687b81c692", "value": 157385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761036317, "uuid": "d3a0f58e-f6e3-4508-ba81-fe84c2648dd2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761036317, "uuid": "41eef984-ed2c-4883-865c-7cd4d13f34fb", "value": "RFQ LIST OF MATERIALS - TEIPH SAIPA.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762d6d29-aed2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761087939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761087939, "uuid": "941298e8-6947-4349-b2c2-761b943972c1", "comment": "Malware payload (Mirai)", "value": "f2b4104e19196438ad1eaeb4cb089dd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761087939, "uuid": "b5f44581-895d-4e2d-8d58-3fb6397c4dd3", "comment": "Malware payload (Mirai)", "value": "b60f4d41cc74fbce5b8d4301dceeaa5dfd482970ac9cd4aa4980bcaf969e43eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761087939, "uuid": "788c72f3-902a-41ed-94ce-87728cce6f58", "comment": "Malware payload (Mirai)", "value": "cdbfe30697dd1395452e9f414ed8c81d00ced0a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761087939, "uuid": "dad34e1b-ac59-48cc-92a8-b2e4b80662b8", "comment": "Malware payload (Mirai)", "value": "3a54f1ce7423305fa4975e00ffae84078465c91d1d28eaa52ff2e88030591b76ba694a0cee8c7d16f2c4549647653801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761087939, "uuid": "273c728c-26bd-4275-a335-1381b5f90242", "value": "T1B8931259CA034804F6B84F71BD96FC46EC2D829944AD396229D05AA9F792D0F0FE05FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761087939, "uuid": "200f0d72-e644-4d2f-8970-31972e1f3802", "value": "1536:7KF6W4tbmMVgqX2I97pFPjKGj5dgiKSAj+klawZlsTpYLES8iw7IrXey2U+/Tum7:7ChhMm9otxV/NQ+QawZlsT2L18iws32L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761087939, "uuid": "01e2bb36-a381-46a8-b518-0901db3ccd40", "value": 93972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761087939, "uuid": "360f1794-3b3e-4ab1-9c78-de71f98a4459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761087939, "uuid": "22d8a083-f476-47bd-a18e-3c2f015b8cbe", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fb4be5-ae47-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761028190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028190, "uuid": "eacf11ab-9951-4982-9d88-6f1e8d53bdd7", "comment": "Malware payload (AgentTesla)", "value": "c10f8e7425a002827558cbcdcd865837", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028190, "uuid": "b566a590-7114-48b5-a668-6ed97ea34e7c", "comment": "Malware payload (AgentTesla)", "value": "b6303d1d53b5d47e74365e0eff2afc20a5447fef8e8e85416b7ea91d164537fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028190, "uuid": "fbf784a6-238c-4e17-9776-830b918a1d8a", "comment": "Malware payload (AgentTesla)", "value": "590e38eff64ca99979ffc82c635bbe4d6b86a723", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028190, "uuid": "cdd5ec29-1787-4bb7-b668-be7e5b1ca908", "comment": "Malware payload (AgentTesla)", "value": "3a388f96859ca8829dea3b2bb9a7c34b21f8c9248a3dafeec4effce4653bcf828031889eb5bf8bd3890a472847292a76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028190, "uuid": "8d362f0f-7cb6-49c0-9c22-4a474dd52346", "value": "T19D86F7B10D9B427182ABD330F267CE355BB15F00504817B6DFF0E8849BBBE6D61DAA58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028190, "uuid": "44426a12-d8dc-47cb-89da-47461106dda4", "value": "74061dd34950419c241b0eff6a45d61a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028190, "uuid": "945dfad8-4f60-4cac-987d-a333849ef25e", "value": "49152:ZgD5qSN8MjTptyO8d5O7Cs7HjTpeZ4VVSBmDwXlyWftX7bVqkADvWkg7L7IHQbX5:ZGq34/JRmH1scnfQKq8fNh5HfDIlZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761028190, "uuid": "9ccdfd1e-a719-4f60-8a1b-3191e8d165dc", "value": 8022528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761028190, "uuid": "a7326780-c89b-43f7-95fb-b532782de63a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028190, "uuid": "ee8320bb-9975-4db4-99a5-06471fb15222", "value": "libcef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec239eb7-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761025001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025001, "uuid": "82920e04-01f1-43cb-9f65-67caa2f0b507", "comment": "Malware payload (AgentTesla)", "value": "f5dd55e62a0d87cee84757ef639d6823", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025001, "uuid": "f492123e-ade4-4548-a38c-50a5d618207e", "comment": "Malware payload (AgentTesla)", "value": "b7f07c11eaee6f6803a40ca8c7fac1282baedc820cdd92a6db80f759a3f2d0e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025001, "uuid": "1c8ded87-5e9c-4f75-a040-4fe0bed609bb", "comment": "Malware payload (AgentTesla)", "value": "70d907e63862ebf8703f74c38b99300e75c78337", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025001, "uuid": "f711a67f-0dca-4064-9641-93f76e3015a1", "comment": "Malware payload (AgentTesla)", "value": "757633fb0fb08e428f24977acc5bfb7aaab2815d905cafc824f6574ecfcb2481abccbaa97c5df650dd30bac6331a254b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025001, "uuid": "4f192b58-49a7-464b-af7c-1704ce0803bc", "value": "T13145F11489C46FB9CFBC591890FE170EA3E0468B5456B94AFF3BBD4AAFF79044207189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025001, "uuid": "23be7b32-0a4a-4965-9f61-bdd4304fcac5", "value": "24576:a5mAzz6jZ+/iTOS7C6sgnSMUzUF5DREGsWbImnvw2Xyt:/jaiT/7C6sghDKvmbnv2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025001, "uuid": "796667d7-36fa-47a9-891b-c3ee05c2f6ff", "value": 1265425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025001, "uuid": "068d123d-ba57-4a33-9062-d3e8d8fa48ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025001, "uuid": "7f826c35-227d-4e0b-8490-d9b7046129d8", "value": "Cotizacion pdf.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d019d2d5-ae15-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761006915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761006915, "uuid": "f1e3238a-e01a-438a-aeb5-d749250efce6", "comment": "Malware payload (ValleyRAT)", "value": "cb12ca8de93c8603dc48600ce004aaeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761006915, "uuid": "0bdfbb65-d645-4e38-88da-99062278a2e3", "comment": "Malware payload (ValleyRAT)", "value": "b83cfdc56662be5032e76c02a8b94a414cd1b6878acde92b09e2983204028901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761006915, "uuid": "c589e032-bd69-4e6b-b0d6-c0b781d74b0b", "comment": "Malware payload (ValleyRAT)", "value": "beae3413c6a7648c663c68fd8606179f197b576b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761006915, "uuid": "b653b731-6e7e-4757-a373-3906a059a692", "comment": "Malware payload (ValleyRAT)", "value": "dd4b6536b468d1de3a94016b3bbe8e6730aea482fdb5ff256976f8e3a38086c54815d0243e16f927b22517e4ab51e1e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761006915, "uuid": "beef4c2c-405b-400f-b96b-c2b9667538f9", "value": "T1D9325C47FE854ED3CBE8CEB4267347BDDE7BA1715B00658223F7C8194926651F00189E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761006915, "uuid": "9d0a65e1-bfd4-4618-83de-5e178d26da49", "value": "0fe64c635c0beb1e0b389b476b920ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761006915, "uuid": "6d4293f1-ae51-40c3-9f8f-42f7e5fa0c04", "value": "192:Z6P84dstT/jGsdDFZhjOHDZ7E5pz6j7p9tSXrWTSY/K/:EPLsBjTDFZhju7l907WTHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761006915, "uuid": "38b6887b-3298-4d6a-9dfe-6ea666ab12dd", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761006915, "uuid": "0a4bb746-b8b5-44b6-b2c5-12ae837eb607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761006915, "uuid": "0289a342-ba49-4467-9afc-5b2de0ef3fb3", "value": "CB12CA8DE93C8603DC48600CE004AAEB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe41875-ae49-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761029215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761029215, "uuid": "a55adf43-b3a2-4e2c-8050-64ba918b1b6b", "comment": "Malware payload", "value": "725037496b3e195b5f3f4823e6f839f0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761029215, "uuid": "5f2f8319-2019-4b2f-93fb-0d3ddb57d941", "comment": "Malware payload", "value": "b899673b927792615d4583738de9f4f07176d74c7591b38d58183c206dc0f127", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761029215, "uuid": "7bf241aa-7ff8-43d1-bfcb-f0996492a7ea", "comment": "Malware payload", "value": "325eba8d540c666d16dd50cc53d5f98ba1378412", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761029215, "uuid": "126a7f36-4c35-45d0-8b96-f4b61fdefa6a", "comment": "Malware payload", "value": "53b064b8ddff2b4b84f42d79914e71ebc11bbbd6ae76975acf37b5312e94b792b7c6829137eb941a2cfb9fd00f69d7db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761029215, "uuid": "c0f0af2e-2d3c-4178-922a-fde5e918b16b", "value": "T1CA734A1263EF4218B6B7138D966F02385BB77E56153D815E029CB20A8FF39049D9A7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761029215, "uuid": "0bfa47ed-2516-4897-8133-4af80bfa3c70", "value": "768:RhjU3+FpOCvB9+Qikaux/ux/ux/ux/ux/ucux/ux/ux/ux/ux/ux/t:RhIOFpOCvJvammmmmjmmmmmmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761029215, "uuid": "c50eef93-8c7a-4234-ae26-27b79f28ca2d", "value": 74934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761029215, "uuid": "9e8c3ad6-05e3-4b84-aa3a-1cdd963b976f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761029215, "uuid": "02e18d06-1229-41c0-974c-89b0341a9073", "value": "List of Items Needed.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d3e46e-ae1b-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1761009156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761009156, "uuid": "ae4a8d94-e4d8-4774-abb4-75f9ac744d31", "comment": "Malware payload (GuLoader)", "value": "16d5a40ce5517e26a63d387bc1b0371b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761009156, "uuid": "9e87fcba-caf6-4b91-acde-417a202fc600", "comment": "Malware payload (GuLoader)", "value": "b8f225189e10b6eba893191bda9b633b5ae42302aa74323c51373c8069c381fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761009156, "uuid": "6f4a5502-bef2-48b8-bf54-f14a96e6edd5", "comment": "Malware payload (GuLoader)", "value": "ce6158b63a0e6ed9e5db7b572e9c6d07235b80c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761009156, "uuid": "e98ef465-1ffa-413f-8eb2-56d44682344b", "comment": "Malware payload (GuLoader)", "value": "e2ed3d664bdd044c6892c2d82c18d0030da0d8c0256821c2030312e678dc8a7fd456f0fd0337cb89ffcc82df5be9b020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761009156, "uuid": "dda70dbd-2c55-4b95-9606-afb54b747f41", "value": "T170052250FB42C8A7DC7253700A7F6B7529E3ED6E6E70030E530D76A6B772AC42419A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761009156, "uuid": "1d36fd23-7320-4756-97ce-43031f1ac348", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761009156, "uuid": "7c6a5502-532f-41b9-a9da-8316c0d807c8", "value": "24576:+3vs71o2D/xY3qUDFRFuN5hUI5iD1AG5nME5qv:+3QjGqUDFRFuN071r5MEYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761009156, "uuid": "c002dfbb-2969-44f4-971d-d7737f8dab2b", "value": 868584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761009156, "uuid": "118b94a5-b655-4f7e-bd00-08e8d0a7f275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761009156, "uuid": "2d1692f8-7f94-4487-9e52-27990554499e", "value": "scan10022025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535f131a-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761025604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025604, "uuid": "fdcefae7-c075-4471-a80c-f640797d530e", "comment": "Malware payload (Mirai)", "value": "40cafe2acf2e74680f7a51acfe971a2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025604, "uuid": "04e4a1d6-a045-467c-9512-564e8c44de4c", "comment": "Malware payload (Mirai)", "value": "b920a3c875f24e13c7a3782d043c5bdc0ebfd93e55fc3d8b3f654d3a70574f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025604, "uuid": "d8f4535b-b354-415c-909d-4453a686d82e", "comment": "Malware payload (Mirai)", "value": "c0853300d4516deedcafd75e799748c307ac1f94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025604, "uuid": "b2958be9-6c64-4239-b2ec-dba03c781d84", "comment": "Malware payload (Mirai)", "value": "98152d260f00afa15003da2b2a0f2b889867b38060fb6f126844f7dcd53b204b4bf83a3c43287efc64969db40a5b447a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025604, "uuid": "5e67d276-25d1-429a-a739-57e2be90873a", "value": "T177443A46EB404E13C4D627B9F69F424533339B64D3EB73069928AFB43B8779E4E62502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025604, "uuid": "f4eff14c-0407-44df-9176-a6a964644176", "value": "6144:xOal6LWUXxjDh4T/avB5/8v+xEprIhPHPidrV/G6wtIkAV:xORXJuT/aJ5/8v+aNkM/UO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025604, "uuid": "8331422d-7335-4dea-81c0-f02790df32ee", "value": 262189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025604, "uuid": "ab3bdf3d-37f4-4dd0-98bf-1b6c82a98817", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025604, "uuid": "44d02f12-00d9-42bc-9ed8-d40a7efc621c", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfe1f75-ae3b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761023125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023125, "uuid": "8f776d80-3f31-489c-8eec-523792be6067", "comment": "Malware payload (Rhadamanthys)", "value": "966948ff4c4070a8227184e63e29f2d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023125, "uuid": "2799e0a0-e99f-404b-9956-8af4a915d0e5", "comment": "Malware payload (Rhadamanthys)", "value": "ba0186773d07e89bc4d59ea5269555f25f0577f7f5bb9b18e4e46910f7320a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023125, "uuid": "bba2e0e3-b7f4-421a-a664-1b095f4a9ebf", "comment": "Malware payload (Rhadamanthys)", "value": "5c0cb3caba0380c9c21e005a9c63744cfc4d11c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023125, "uuid": "c6c71ff5-b0f3-4fde-a43a-0783aa9acbc2", "comment": "Malware payload (Rhadamanthys)", "value": "7daed332e77b48b2c545121d29500cdc7b411a7340e48f9cf99bbcf89ca248161d9ea2907de07fad5cf240549785c1bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023125, "uuid": "b0b3f53d-f980-402c-95e0-b247c106d019", "value": "T17AE533017FDB4A7AE48146B781C59BE798B8EB2C1F140ED75BC10E011C646DBAFB91D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023125, "uuid": "f7d210aa-e795-4f0a-929b-08369b349474", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023125, "uuid": "e2efffde-a013-41cb-96c4-b4c4fb63d30a", "value": "49152:Mz5EkldQrp5ziLQskyWyM3HDDQZAaIariQzU9c5z4hjLsjUTECHQu5vo2f7M:Mz5EQGYvW131Q95CL7TdHQuZo2fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023125, "uuid": "1f6b1a80-4aaa-442a-86df-53f6a1994c69", "value": 3102256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023125, "uuid": "9085a97c-3f0e-4973-8bf6-945b44200d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023125, "uuid": "3491f31a-36fd-4d6c-8955-0e47b1e86f77", "value": "966948ff4c4070a8227184e63e29f2d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b20a02-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761026143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026143, "uuid": "5c5c8c5a-13a8-4f0e-b018-35b34feddeaa", "comment": "Malware payload", "value": "8a76d43b7373b7ed9efdfd0821abf9c9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026143, "uuid": "017f3b2f-ecd8-45ab-9777-aabb7f975caf", "comment": "Malware payload", "value": "ba2a2c97aa6063219a193955655bfacf086832a83bbf711826396ecd60c8d0ad", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026143, "uuid": "8de8b01d-a44c-4a8a-9b42-d07d157cb2cf", "comment": "Malware payload", "value": "6b594650d677ffe56c38a8e4aa5523064f67eb70", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026143, "uuid": "c11a3e37-67af-4f5b-8ede-067dd60de6c3", "comment": "Malware payload", "value": "7170100cc546afbe859a2c106e064d68b3d342cf00963155c24580e147db8175c2f79b6b0dc79845b7f8681956ed5427", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026143, "uuid": "9d5f674a-f848-42cf-aba1-f71944ed2804", "value": "T1632522AE5781BC73E0AB1936E4F23399C731D4104BA7E3021C8953E94E7EBE215D3666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026143, "uuid": "ff68895b-e956-4994-a903-a4a249a68e08", "value": "24576:nfYUEGMryp4A+CbK8OSbl1nqTFaYAQ5VOg6yUQX:fYpJ26AffOit6aWiTyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026143, "uuid": "f32d2bfd-3ca7-4066-97eb-e9fb9af3fa67", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026143, "uuid": "25c0d65f-2eda-4e39-b421-d108fa79a3fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026143, "uuid": "7f8267d0-62b9-422d-9d26-a4810bcf3aca", "value": "Reciept DHL-GESU24680399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa30b8f-ae65-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761041194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041194, "uuid": "8606aa25-afee-4aee-960a-1e92255ebbcb", "comment": "Malware payload (Mirai)", "value": "3054b6924c26901aa3557b0c18510859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041194, "uuid": "2e4ad12b-ea5f-4be7-ac6b-0d3531b7261f", "comment": "Malware payload (Mirai)", "value": "bb39ba5a99f379033b013c97486ba3e6d6a798b192a4008963df1c06887f10dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041194, "uuid": "2d696c1c-132f-4eb3-a6a8-9f7808ff3e5a", "comment": "Malware payload (Mirai)", "value": "4de358e4c160585f00cdfc982bdcc9a7f816ae46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761041194, "uuid": "af2120ad-f33c-4c5b-aa37-1b37d84f0485", "comment": "Malware payload (Mirai)", "value": "e197ab1a59710b6d39cb101c590c2bd4f61ed9f12d4e2e31c221b5f62b84d879b6afd9c8188a75472f3dda974e3cf5d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041194, "uuid": "e5bf6cea-9c56-4296-bf0e-e53f5eea5df3", "value": "T16073E886B881CA56C5D552BAFA1E11CD331227B8D3DF7313DE106F147B8A92B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041194, "uuid": "1060d713-a006-453d-b770-3830d44379ab", "value": "1536:yBnQPiA0RYnysD4YttkF1TWkhxdNeNRqYjb63dM8id7D/zdC9JnJ8VR:+AOYnMYttkXaE+NRn7D/zdC9JnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761041194, "uuid": "0d44b3a4-689d-4ae8-bfbd-8b4163ce61f2", "value": 74920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761041194, "uuid": "db84608a-9654-46e1-8ef9-a4b0248698eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761041194, "uuid": "9a60d0a4-9a9a-40d9-9a8f-32733c2475de", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03adb15d-ae40-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761025041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025041, "uuid": "92ebb82e-e47b-40d0-b731-8ac810ba6bf0", "comment": "Malware payload (XWorm)", "value": "cd567f3d6ac0f3c0923ad1cca55e347c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025041, "uuid": "0d712551-7557-48a4-b48a-3b833547d5e1", "comment": "Malware payload (XWorm)", "value": "bc4a510046a3fe5f115e3087cb40fd0789f0f0cec4eef02d9c0e6d4930753ed7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025041, "uuid": "bb41e91c-816b-4a72-84ea-34694eb04875", "comment": "Malware payload (XWorm)", "value": "5dd21a37b0689c1bf90c817b9752105ab9245ac5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025041, "uuid": "1e4f3b12-01d1-4e0c-b57a-46a8963a9b9e", "comment": "Malware payload (XWorm)", "value": "bb3a9d683933ee8c4be20babb58a2ad2ec305a4e735c075e04e70e291102ae86c2c5cb21408604d0971a2985cc5f4457", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025041, "uuid": "47288304-5b7f-422e-a286-baeb9cfca1d0", "value": "T165D30B2DAD64A8DC336A30BFF5EA1643C16B0AD2D2A3C6ECAF9044601C2F57577951F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025041, "uuid": "8c743f07-3446-4c8e-9eee-856e4c0f7799", "value": "1536:HQ3C5+hBcUEpS++XTiU2R6lzc2GAyQ9s6NYLfZce/vqch64v5fg/9Bqdko1:Hh/UEpt+XTiNRSXfPs6NYjv5rdf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025041, "uuid": "a952813a-0a56-44fc-9f03-fcd34061ec3e", "value": 136190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025041, "uuid": "69932dcc-5a31-4b89-ba5a-f043d82da7d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025041, "uuid": "c75b8a05-c074-4d36-a418-a4c351b43659", "value": "New Order-18295_xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9dd8d8-ae8f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761059098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761059098, "uuid": "d37926f3-40c6-4c19-b6b2-a1c1c3b8851d", "comment": "Malware payload", "value": "37ed6b57d45d4620837ead9fe3010bb7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761059098, "uuid": "bc15bdee-4d24-4bee-8d75-f74094b7669c", "comment": "Malware payload", "value": "bc858ccedadeae5b01de26a73aeadffe631b72653b6a762c4492a7923edad259", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761059098, "uuid": "82e11428-e051-4923-80bf-ea70db3df4b0", "comment": "Malware payload", "value": "58936c06dcefc82f943e1ce5652a64deaf35556b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761059098, "uuid": "03105262-3e21-41bd-a495-5d64bbf75ada", "comment": "Malware payload", "value": "bf24efb904620ac6ab87199cfe56edc9bf0f3261806d34f4f4837a91dd9c6b97b58f5e4f0aaedcfc03ccdb5954259ab0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761059098, "uuid": "d1a33ee6-f2ae-483b-a2b1-37484d7f9060", "value": "T10F33BD4DD78F80A5CF44A63703664A8942FCB73EB70142B9346C837437EEA2E496997C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761059098, "uuid": "e8ae6953-129a-42f6-beab-f3fdd0c342ad", "value": "384:g6t7taM4i8nKgOkWOV/cPOd6PCNsjUqaVpbqC4TsTamJAkOf5MNi3ow3sk:g2ULi8KUBUPOdRNsjUqazuCOmNkvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761059098, "uuid": "3cf2e5d9-60ad-4d57-a7c8-dadd802daae5", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761059098, "uuid": "5234ed98-cc86-410b-b164-fc0337d84c4a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761059098, "uuid": "ac2ba562-5eef-4df2-97f1-fc4d34592dfe", "value": "ssdf0wejir23090dfg909cvbbre00dfg00g009d0fg0cvkbj009g004300dfg4309dg0f90.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9febe74-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064028, "uuid": "d420ccef-fa57-4dbf-a383-f6fbce575cf2", "comment": "Malware payload", "value": "9db0667e5d90a55a278d2fbb0500658d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064028, "uuid": "b1e93e91-25b8-48ca-bf0a-95c6ada0d8c5", "comment": "Malware payload", "value": "bd674db9fee34cedfc14326633d43a5d2414c867768d632d87d5dfd0958b48d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064028, "uuid": "ad5272cd-ef99-46fc-be1a-3a1784e9c4b3", "comment": "Malware payload", "value": "35efa12d4690bc72042f345e6e125461feecd588", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064028, "uuid": "ba780908-90f1-403e-a35b-1340706c6fcc", "comment": "Malware payload", "value": "1af01f6af09a8d4042502fc7982cd48afabfaffec6bb4c48b96259f7fead892616366e7d5a8c92269dc4ad93481557ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064028, "uuid": "a9962ed1-22aa-4eb2-9350-50183272c3d1", "value": "T1EBA30994586AF19631E1B2F06F2BBEFE8A0C45F1412E45DEC4A87663B81150F5FA13E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064028, "uuid": "e4587732-68fa-44fb-9fe2-7f02b86c56d5", "value": "1536:GDB7eKg201Kts5cpq/3XLPMSKtfw9zmqmm3w4m2ADhxpDz2xRydRNIq9KmQrg54c:GDB7b0XtNQKsy6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064028, "uuid": "a56575c8-6150-4a70-90ca-56212786f710", "value": 101461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064028, "uuid": "53ddf163-40e3-4807-8292-fdbe8def7deb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064028, "uuid": "609798a3-c572-453f-97e4-a37d3a3ca1c5", "value": "invoice-1637482117.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a2dc9c-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761026094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026094, "uuid": "9bc40476-f52b-4870-8d66-0b200363a8c7", "comment": "Malware payload (AgentTesla)", "value": "886b631945d235789db69511abd76d99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026094, "uuid": "52fe5471-d475-44f5-8372-eb65a8cfda54", "comment": "Malware payload (AgentTesla)", "value": "bdb77fb15a71d15824003e2baca520124dab19ec99a1cd90e12769be216e1541", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026094, "uuid": "00269989-cba0-4c52-9ceb-86474f38165b", "comment": "Malware payload (AgentTesla)", "value": "5b74ac76b42210cdab8e73ad49e8cf3abd1ba026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026094, "uuid": "15849854-dfc0-4214-92a2-90f09b9c296a", "comment": "Malware payload (AgentTesla)", "value": "2e16a555fd5115981a9b4c362a55fe44f074a75e1658ccf7a0a545fa7d85ffe3dcdc05b8239eec098a21cf711e6da32d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026094, "uuid": "bb059a38-a1a3-4e76-936f-8b2146c63862", "value": "T154F412486B1BDD12DCC51FB14CA0E37612349E5CE420C61B8BEDADEBB47AF6539192C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026094, "uuid": "aad86592-0c42-4cbe-abf2-094ea07a6998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026094, "uuid": "f479419d-14f1-4323-a1b4-58923bb8fe0a", "value": "12288:+BBf7Wr2/j5EGEScyesTfzx/aeB6HNI2wwbnaLhk2TXIrKIT:+vf7WcuYcoZ5BWJwSnaLhkQFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026094, "uuid": "1ee4759c-5ed2-4cab-bd60-18a92cb9c722", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026094, "uuid": "a873b43a-d072-440c-9672-2252c7ddd73f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026094, "uuid": "8e2f3314-eda0-4275-a6e6-0d83797bd744", "value": "Dekont_21102025------pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76474a47-ae3a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761022656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022656, "uuid": "36327b5b-f912-495d-b1f1-73f83c7a0f8a", "comment": "Malware payload (Mirai)", "value": "9859221170d4b8c1c1a6e7c9fe99fa23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022656, "uuid": "dd09b23d-8cee-40c4-8c83-03e21acd1f7b", "comment": "Malware payload (Mirai)", "value": "bdc7c62f81c982fb964335c3c6c8741bae3795a18c386e78ad15d8cbafca1475", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022656, "uuid": "d684b855-bf76-444d-aa01-eba971f82d9c", "comment": "Malware payload (Mirai)", "value": "8fdc68a52341dca1d52910412ae30373e6e6d65c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022656, "uuid": "6c401bf5-62b5-4800-b3ec-f0b33d91e04c", "comment": "Malware payload (Mirai)", "value": "b3f369508e7c55e14f3066ff1ab227c9d34aec86cb8e78466c62111e83bf62945dc1ee2764b836569157fdc62f7f6541", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022656, "uuid": "c01f55e2-9222-4492-a2ba-22e2a5837807", "value": "T11AA33C46B9928E12C5C612BAFB5E114D33136FB8E3EE3212DE24AF6163865DB0D77412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022656, "uuid": "e8624916-4e6c-4e8f-a956-bba89cea9e3b", "value": "1536:pEn1loo8MkJ5DR4MAMX+F759RBcxnWU4aGgaYrHWBXwDniNSZZH5p7c75bYFJT:wluRX+JXcxT4aGgaYcSZZH5pI7ZeJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761022656, "uuid": "fd30c152-3eb9-4a04-b9a1-974561c4b45b", "value": 103164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761022656, "uuid": "ced03dba-3c9d-4234-81fc-cd2a1c5610ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022656, "uuid": "8242e7d7-8208-47bf-ac3d-7922702dd8da", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a913221b-ae74-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761047652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047652, "uuid": "93c07ff2-cc7c-40ad-bc92-6a48aebd9e59", "comment": "Malware payload (Mirai)", "value": "c9ffa970799ddb4ae3f8a5a43df2e9a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047652, "uuid": "64ee6171-493e-440f-b8b2-ad794595be19", "comment": "Malware payload (Mirai)", "value": "be62d2bbe5f0e9b6e03439499b6dc48cd7c50469f2a242371a896109944252cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047652, "uuid": "289bd0d1-6b83-4929-b54a-748c6489a7e1", "comment": "Malware payload (Mirai)", "value": "bac9e99f61268a5b634294ac9023eee2e2034aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047652, "uuid": "5a93b402-49bd-4b0a-b59f-9401105f7501", "comment": "Malware payload (Mirai)", "value": "b01b6c0eea65e9e6decf13b45d336726c1b3255bc4e8ee278cb070937007a04d9f8cc5d3f4b58c349f988688ac46f827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047652, "uuid": "7601eaa9-8a41-4a93-814b-8c2863960d8e", "value": "T1FDE30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047652, "uuid": "7ccda3b2-7f42-4a9e-a9f4-a3a882bf06de", "value": "3072:pUkePnOUPX1JJXJUwbY+a9scgTbOCm3DoVRpL:pUHG4jJXuwbjaPr/3DoVRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761047652, "uuid": "696ab028-9145-4b53-9f7f-f0bee9b1fd6c", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761047652, "uuid": "28d536c7-889f-469c-bdc9-8cb2057ffcf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047652, "uuid": "c63224eb-7f11-4d01-8b67-da2c3dad9ce3", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2326c902-ae98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761062889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761062889, "uuid": "3c4dfebb-446e-443c-8972-ec028570bc66", "comment": "Malware payload", "value": "92f355f8ee65ee935ec967dc8445ff5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761062889, "uuid": "dc6f0d45-86ff-421f-bc6d-e5a1e9ec0f8b", "comment": "Malware payload", "value": "beb2ebe5e8620cfac67848aa1f614abd1d1b060821c31d7752f49cbb9c065737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761062889, "uuid": "5b608c46-ec9c-499c-8d8a-eecbfe0381d3", "comment": "Malware payload", "value": "d48c06a3d6fd918c3745ad0195f91e2349e4d974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761062889, "uuid": "c17c4ec1-4150-4a8b-8925-3866c79b5f9f", "comment": "Malware payload", "value": "9bb17b1ce2d0e05cc7fc15fecf4e6534087cdc552c3d4749c72b6aed71875678237c2f85ea6c7d129e7c24b0f5017c1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761062889, "uuid": "7c9abaef-eb9c-4626-b3f4-5363675e4c8e", "value": "T1562833661E8F381EC6C736F93A50CD3891A0FF9B7E5AC66D22DAD9B0CCD03A546544C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761062889, "uuid": "38a5d603-2853-4c1f-8fa2-df2c9650e060", "value": "6f462fcc6b830b77fb3fef2add9dc570", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761062889, "uuid": "6864d368-0d9d-4c70-8373-83e8ce6fcdab", "value": "1572864:LScvrf7YccO5U/K6NrMaqWATeyo9UzhV2FJZeM7q9kG/msxwylOcCz2HsViP7xWj:XvrscteC6NrlD9vjYz/mIlOpWFpmFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761062889, "uuid": "748124aa-695f-44b6-860c-31c74a8323f6", "value": 94997504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761062889, "uuid": "d0769988-7b1a-4d9b-93d7-9678e6b48c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761062889, "uuid": "77c9c03a-ebec-4239-bd3e-944f604272fd", "value": "Cryptorant Loader Setup 5.2.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1ae835-ae72-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761046634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046634, "uuid": "1163b096-3d0a-457c-9632-ced649a9ce05", "comment": "Malware payload (a310Logger)", "value": "98598520b1b8492b59d5d92225b5b6bf", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046634, "uuid": "f9e82a89-70ca-4342-9cc5-ef93097bb3c6", "comment": "Malware payload (a310Logger)", "value": "bfb08f6e69c9a8702f612f5c0e90599ef48c9d7270cc5a88611ff7555be2d0e1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046634, "uuid": "bcbd8ab8-d6c6-4117-b428-64cc17b829ae", "comment": "Malware payload (a310Logger)", "value": "d809eb31b087e244863bd728c13a4330b11a85b0", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046634, "uuid": "97afe47c-2d7c-4eb2-80e6-5a98c227a47d", "comment": "Malware payload (a310Logger)", "value": "e072f632a1b5b129da2170cf3e39b242a5943da3213b82a3f1fae3a2c6eeb2221a6bae8e00a8ad6c2645499f8f1146ac", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046634, "uuid": "2e5294be-771b-46a6-80fb-2629462f7f1b", "value": "T1FB2502446A6EEF62C8B21BF40972E37113B49D4DA820D3275FE9ACDB70B6F442958743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046634, "uuid": "91baf334-a1fa-41d4-874f-cc2f7ef7093a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046634, "uuid": "6458aacc-bcea-4898-b67a-095f2f7b9a9b", "value": "12288:1bf7UlHjfmiL6rPQAo1KTGZXOYrdpiWdWmutQpnB/8AdYXughs1voOaJzZbBP3a/:1bf7QjfmlQXYmJ2WdTn5ZYeggiNA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761046634, "uuid": "347bb6eb-1c53-4927-990a-f738c96985fa", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761046634, "uuid": "d7d5a2f6-5699-4ab5-b942-3f20d1f51bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046634, "uuid": "ac334f85-226b-4568-b70d-832721f13858", "value": "DS54009000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e8defb-ae47-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761028341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028341, "uuid": "6d163082-bb7f-4866-80ea-174a36cbf550", "comment": "Malware payload", "value": "a020034ea297c12e2d50e4bf044cc44c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028341, "uuid": "3599590e-68bb-49d8-81c4-672822e069c3", "comment": "Malware payload", "value": "c0da5095d431f532daccf457b4b0e0b7b075439944b76e36066afc4d22bf5493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028341, "uuid": "24b5209b-64f9-4c85-8fad-5cb0f1430fcb", "comment": "Malware payload", "value": "196dd973baf790c404054ad85bfae3e53d79e546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761028341, "uuid": "bc3e7607-2b36-480a-90b2-a8033149c8bb", "comment": "Malware payload", "value": "ac553c03acc2aa40a6f37a9a2c202b4be4fb8a91aec328c5dd101133692a808a657175631db49e712250b45b5d04fd5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028341, "uuid": "554b26d9-60c1-4ab3-9743-177ea02f2bf6", "value": "T14396D5B50D8B427582ABD330E3A7CE354BF25F00504817B6DFF0D8949BBBE6D6196A18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028341, "uuid": "1a1c4ee0-500e-4d05-bc7b-6b00e86524cd", "value": "28ded3af9f25dd913552643d2b90eaa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028341, "uuid": "b6e0f875-cb7a-4420-a958-17f056a9ba34", "value": "49152:uof2Zw4JlhlENJN1GPowXp8aiwKzdh+lFMitKer+Dc15vEPcRtbqUThxMgg/1cSx:wjizTC7higg54S2Q+ktkxlzajCg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761028341, "uuid": "4d7904e2-39cb-44f5-adc9-ecd6c15464ca", "value": 8940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761028341, "uuid": "0af2979a-a342-4b64-8684-0d3fb5d6393d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761028341, "uuid": "055b1aa3-37f2-43ae-b932-87588e72de13", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b8d4ee-ae27-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761014412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761014412, "uuid": "ba20374c-17da-462d-ba94-2ac8009899af", "comment": "Malware payload (ValleyRAT)", "value": "24842bbb42ed31096ea5bc27189b1b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761014412, "uuid": "4ce35e37-2e58-4aaa-8fba-e9d243f050db", "comment": "Malware payload (ValleyRAT)", "value": "c16ba051fe48b6f157f2bd2fe580ded19982122b56b55b1342163f064db7dedb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761014412, "uuid": "b6884121-6b76-4d0d-b707-103d085a4fdf", "comment": "Malware payload (ValleyRAT)", "value": "d0fd5e826a955ae81af66f6266870497919b62bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761014412, "uuid": "7753cd37-fadf-404a-aa5f-61bdbdd32b2c", "comment": "Malware payload (ValleyRAT)", "value": "cc5ee9e94639c784af810870da9a4a8f261df71f5907c080024085af050c667df4eef1a82ff1e54a1b352d10639e3884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761014412, "uuid": "e0760725-4a6f-4c78-8603-699e9544b945", "value": "T1E3B46C16B3E800F9E9778239C953890AEB737C550720DB9F17A4466A6F237D0AD3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761014412, "uuid": "ea44c12c-12fe-4b5c-8985-376bc168af63", "value": "02e48d68f6ecdd5e746e392c3513bbbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761014412, "uuid": "03e168a3-5fb7-4904-a438-5bfec9ebd24b", "value": "6144:ZCs3DkYlzQmcjoNwgvZjuUIKmrOwgw+xQol0XAD35m0ampO83rvdcVA:I0kY2LjoeuuUQqdjeKQG5+YV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761014412, "uuid": "09f4daed-2eb1-4f53-9058-56f7a42d3041", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761014412, "uuid": "9187c5c9-3ea5-4a61-9714-5cdc3a492636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761014412, "uuid": "46d5021f-2e45-4b13-a8c9-06ba6f6bb300", "value": "c16ba051fe48b6f157f2bd2fe580ded19982122b56b55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f0a23a-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761024835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024835, "uuid": "cedd891b-a637-4d4b-8d59-46178cfaeed7", "comment": "Malware payload", "value": "3b9d33d48c1d5ec4e5222af864677dd9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024835, "uuid": "5f8b9231-ec52-4eef-9206-22ed3922a073", "comment": "Malware payload", "value": "c18c41bbbbecf1c2f48f9fd6fb5bbac173872e03780275072e742e9fc4de676d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024835, "uuid": "e412e314-a3b2-4bda-9fad-8d979a97588e", "comment": "Malware payload", "value": "f2ce18977eb669d8ed32d5dafdee666f7a7960cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024835, "uuid": "409f45d2-bb64-4bd4-8da1-97d62c05b5dd", "comment": "Malware payload", "value": "9667d321c474fa1e2a08fc42ca5be8a8148d77fe1cd62b8d263861e2d9fa475083e6a6e66841fce4a44a830d43103d9c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024835, "uuid": "10919f8b-c142-4cc2-9685-125c59d89ae8", "value": "T1A32252A6324C403F6356731AAC359F0EFC7CC4616167E0F6F8EEA484B9A091A1736DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024835, "uuid": "11916afe-d41e-40e8-b2da-0138a560be0a", "value": "192:BVO9p8xQxy6brwy2fCt2tSHuv8bjuLobgwlMsPlXpj+H:BVyp8t6Pztj1l2oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024835, "uuid": "048797bb-7905-479f-abb5-0af2ce4eb53e", "value": 10251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024835, "uuid": "497a774c-60b7-4278-8102-9c737509462b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024835, "uuid": "2ba6fe1f-be0c-4be6-afec-10f7f601fd68", "value": "aldfaergraphic.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4fdb1c-aea7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761069456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069456, "uuid": "9984c8ad-dd9e-4bdf-9133-971db27d2716", "comment": "Malware payload", "value": "57c05f9e3270b8543d60f73a08aded99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TOLLBOOTH", "colour": "#759DB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069456, "uuid": "302bf125-5f7b-4ff5-8da0-640c71e4c03c", "comment": "Malware payload", "value": "c1ca053e3c346513bac332b5740848ed9c496895201abc734f2de131ec1b9fb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TOLLBOOTH", "colour": "#759DB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069456, "uuid": "caa3de78-c6aa-4646-b9ae-31bf9ab1b5af", "comment": "Malware payload", "value": "14a09fd7495dbf4a345461c8c1d718f0cf28c109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TOLLBOOTH", "colour": "#759DB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069456, "uuid": "b519568f-095e-44b0-a105-5368abd18747", "comment": "Malware payload", "value": "6538dbff09945622b2264fad8076b4eeaad3202b9767b71e2ffd17e3e9e14b244fcd232b5167e37c69b78caea8e08edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TOLLBOOTH", "colour": "#759DB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069456, "uuid": "bb42b60b-88de-4e91-bce0-771d21925831", "value": "T1E0156B166E5801AAD0B7D23CDAA78A12F675B84603759EEF07D04A623F073E15F3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069456, "uuid": "2b094777-4847-4e73-8d5c-686d42ecb328", "value": "dcf8cb0ce0e83bbdb1e58ef502c7661d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069456, "uuid": "40d1283f-b703-4165-bfab-f0729abc480b", "value": "12288:/bNeG5LLraYblgsgVF5liGvrcYHnu/QR6hjYDxQBT3oClotUR8X:/bNH5LLrVZM5jDDHu/QcxTBT3T7R8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761069456, "uuid": "36a41ff8-41bf-44a1-aea1-a28b092c5428", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761069456, "uuid": "34a8b059-3c35-44e8-aa1d-ea034c4864a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069456, "uuid": "4f3aabed-2abf-4fca-93bc-ee3576935b0d", "value": "caches.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52d54e5-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064047, "uuid": "80fe0b3d-97ff-4778-9f15-b7be4467a01a", "comment": "Malware payload", "value": "2ae683cf8ba041f13d2d222791524303", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064047, "uuid": "07e75b63-c868-4ef9-b34e-6c66b54152d0", "comment": "Malware payload", "value": "c1d3c8fd21ba07adb0c94c54dd916dddba8f4aa8e2735e88a2abc91da0970709", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064047, "uuid": "51bc19b0-492e-4b0a-a86d-26ed956d32b9", "comment": "Malware payload", "value": "9434e206aff3fb5216e9055281ed2b3428f5b9b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064047, "uuid": "5d55587b-a2f0-44a5-8730-41d99d3abbfb", "comment": "Malware payload", "value": "14d065ae39a77c72b96cdfece83cebf3b3927adc55555097aa4b59c9fa8614d90cd6d8a5957483962073b4c658f87ee2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064047, "uuid": "c6c2d9c4-e6e6-45c7-89cc-3dbd519de61e", "value": "T157A3F6E50829E5BD0BC1715EFEC611FB3623DF2A0B95730DA41A3BB1543CE8A95648CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064047, "uuid": "7164a074-203c-4af8-8a78-d5154201045c", "value": "1536:GDB7eKg20UvpvXrRro4yvhUv8iv9vevBAKvbvEvrSn6BkQWJ+aY:GDB7b0Eh7N9a28KFG1D0rSn6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064047, "uuid": "113495f5-9b1d-4405-af58-e90a7bc418c1", "value": 103349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064047, "uuid": "b2dbfe24-2548-419c-a8d9-2162d6955608", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064047, "uuid": "4777cbe3-7bb7-4f5d-a296-1f7347cc44be", "value": "invoice-1637482117.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff0fb54-aecf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761086855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086855, "uuid": "16fd7037-ac1d-4efc-860d-278dbb996cc5", "comment": "Malware payload", "value": "641eee0258de91e977b10ea923ff0597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086855, "uuid": "8d5ca027-addf-445d-af11-a3893ecaa8ed", "comment": "Malware payload", "value": "c2de388352f8948a1b233318f2428e64dba5ec7692b353b8f9ea5a9ffff3ee08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086855, "uuid": "ae8466e6-7ef1-4da9-b508-6bb0edf104f3", "comment": "Malware payload", "value": "de228e4a88d528d6c17253631555705116327c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761086855, "uuid": "67e4e58d-1096-4be2-b967-915ccacc6cd1", "comment": "Malware payload", "value": "b8e3800a85fc20dd508ced97c50186da63c996a153ccdae85f7c83414c2590682018a222aba27c44e5bd3f10d9514827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086855, "uuid": "71c95ecf-cd7a-48b7-b8a4-359d2316507a", "value": "T1AE73BF42DAC41525D1A622BD17713FB59A70F1BB3701C2DA3A8CDCE6DFD19B0922A3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086855, "uuid": "488e5b14-793f-4c6c-b26e-53a41ee3e8e1", "value": "fb6bd8ebf4e6421b53c55dfe7d3c43af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086855, "uuid": "1ad25f64-2256-4f9d-8321-a228724ec99c", "value": "1536:Iz8tqaMVd0ErDAmj9U3VBGIMb+KR0Nc8QsJq39:tV8hU3/GIe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761086855, "uuid": "2dd6952a-a2d5-45e3-852c-bc02a42214f6", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761086855, "uuid": "3b6280b4-293e-437f-a6ad-fc225545c395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761086855, "uuid": "8630aba1-c38e-451a-bb61-c47ded7b3f0e", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d2ce30-ae68-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761042229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042229, "uuid": "a29869b4-ed30-49a5-bf38-5ff280c529e0", "comment": "Malware payload (Formbook)", "value": "93ff293158acf400698bd07c71cecf43", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042229, "uuid": "9abed1e8-a7e2-456e-8f9d-82f05f0f88f0", "comment": "Malware payload (Formbook)", "value": "c33867dc949047da5312c05389f6b550e951543f7c82a55b240628cfad2a94df", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042229, "uuid": "3ec7e638-ef6d-4b6d-8077-3a1cb02954fb", "comment": "Malware payload (Formbook)", "value": "e26cb0e6afd7303c687385541f9dd3fded764045", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042229, "uuid": "e2e32ebb-8b66-415f-bf69-4a56ac49b52e", "comment": "Malware payload (Formbook)", "value": "c348483e52dcb8d262d180e6a583e92558d941f84a66cea854bd1af7ae847fed17d41860d9dc0642fb5b328b77ef0880", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042229, "uuid": "17728402-9c73-4b03-b473-56af16a0a4fe", "value": "T1AF652311C443649C149CB32E76A97BB427D1CF6201B20B9FBBC6B959D14EB1A720F4BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042229, "uuid": "bfef2479-f006-46d7-a4c1-c3c7cc4666b8", "value": "24576:/fcU+ccjh6bX0MrOPEXPeUI8gohKoBIdpXLJ3nOX8SuQdQ2ifbRzP2tzD10v:/Pl59FG7nOX8L7RbozDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042229, "uuid": "6950740b-8635-468a-9f3e-e64cf18528ac", "value": 1453428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042229, "uuid": "ff3462c4-286a-4ab8-b7d8-7572e2649b89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042229, "uuid": "5b147af9-1a1a-4f7d-89bd-4f46c8bbd1c2", "value": "sea.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea70615-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761025676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025676, "uuid": "6c002ae3-dada-4e42-b236-ac62840241a3", "comment": "Malware payload (RemcosRAT)", "value": "4cfe59591a7403c15fbac3d2a64f9ebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025676, "uuid": "5996b71e-823e-4aa1-9a6e-77cb6c35ab73", "comment": "Malware payload (RemcosRAT)", "value": "c3522c969c29c162a1b67b62b26510edfe67c8c163cbd9addea347dd229090af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025676, "uuid": "9987055f-2f74-457b-9e66-1248d4a147d4", "comment": "Malware payload (RemcosRAT)", "value": "4684c13f8cb09fc2145bbf5b39b69e4d15112474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025676, "uuid": "5bfeaa4a-cd9e-43f7-9890-031fb11395f9", "comment": "Malware payload (RemcosRAT)", "value": "052a7c0b0bfbcaafa54e1e35d6c5b0d513a9f5ee5385d34e2f093c07c08bb9965332ba946dd4e023e2733872c4809a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025676, "uuid": "91ce2cbb-7855-4efb-b590-2b18e6b75df1", "value": "T1EB152211BB00DC56DCB28770067F56393173BD5B9EB4424F130E72AA7BB2B853819AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025676, "uuid": "1af1273c-d901-46b8-aa00-4b1219db18cb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025676, "uuid": "59f7c9e2-bba5-44a3-bce1-14691429fb57", "value": "24576:b3vYXoZoe1iIgSAecVawQAIxTy7AuN5hUI5iD1AG5nME5q0:b3JVNQVawQAYTy7AuN071r5MEY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025676, "uuid": "8b694342-74fe-4451-b043-849d64782d7d", "value": 930544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025676, "uuid": "29c0690b-0f58-444a-8dcf-5fc99634bd72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025676, "uuid": "728eb304-e4dc-45f3-a0d0-203396e41026", "value": "scan10125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d67353f-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063792, "uuid": "86471fac-dfdf-45c4-ad1b-bf6cfd2562ea", "comment": "Malware payload", "value": "e28ee6fb1b0eddac7f2c309d8ce7c33e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063792, "uuid": "e255f427-136a-4caa-a511-596c071ae993", "comment": "Malware payload", "value": "c54133aa116b5586f03c3c4ff6bb86f5acb2638c53f590a2cc3c041efbb8dc8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063792, "uuid": "5679aad6-5c4f-4908-b1cc-18ff9d63c913", "comment": "Malware payload", "value": "d2d7d3953ca4dfbe80f92b284afc312e6c6002dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063792, "uuid": "294d2041-93b3-4d91-8fea-080fb00f504e", "comment": "Malware payload", "value": "f6137b58e7dd2e647c9aace2e8a33fe2411728a022c7103883c3d9252ad3402ee22679a2bb242be8d0573e59a3088f8b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063792, "uuid": "902c52cb-2364-46d1-b1d5-9b84831a8a31", "value": "T1CCA30A805E1374E42733AD74BD1FFFFD8D4A409BE5618824398FB6724C8ADC99849AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063792, "uuid": "5e7bc56e-0a54-473d-a527-c68eda8ff06e", "value": "1536:GDB7eKg20BVvWa6SxZQdvJDwyIWaaO8e6JSho5KI3kXXddL589r8IBuPiwrDwwT5:GDB7b0LKEsTUG6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063792, "uuid": "e75e1c01-a50e-4536-a4a8-ef9b1711c77b", "value": 107310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063792, "uuid": "2e5187fe-994e-41f2-a621-e2170204c35e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063792, "uuid": "8953b4ae-a62f-4b1b-a183-f60859484f51", "value": "invoice-1637482117.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53af4f5-ae4c-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761030519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030519, "uuid": "a865f7ac-83f1-4d01-8723-788d5d6012d5", "comment": "Malware payload (RemcosRAT)", "value": "323ac449e186a684bb9b155922799b50", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030519, "uuid": "b2b828fd-0c05-40ed-a233-949a8b6d660d", "comment": "Malware payload (RemcosRAT)", "value": "c66a637de988bf2aed02f67714ee12324a70605256582ccd277a0a9eb74854dd", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030519, "uuid": "185f24a0-d3ba-4853-a205-a06aba192f57", "comment": "Malware payload (RemcosRAT)", "value": "a4c46174dba0932f99ae238f823a4c2ea7628ebe", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030519, "uuid": "f8f67cdf-5268-4c62-8d59-8b78e5627ed9", "comment": "Malware payload (RemcosRAT)", "value": "ba165c8b84f18d7a5d457fe7ee1243f9bc6400edace71ba6c04484525f65930bb8cfaeeb998296c34badbcdbb0716226", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030519, "uuid": "1cb5d8d5-60af-4d29-b6a9-e97f114730b5", "value": "T1CE0533281F92AE420DBBD95903FB723D7053AA87DEECA5C5817E523362A1BCC34605F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030519, "uuid": "53809d25-3793-49d8-8e00-a3d065cf753e", "value": "24576:pJ8p/hoZoe1WIgSAEcrk+Q+AV5ynuuNrhIA5KDZYs5nUE2:pJnFNQrk+Q+I5ynuuNyPZD5UE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761030519, "uuid": "84228b4e-ed47-4043-a131-9990f5447786", "value": 846428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761030519, "uuid": "9299b8f2-4be9-414a-83d2-7d91c7c12aaf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030519, "uuid": "e1ecf76c-b83f-4b53-ba50-c738b78d0686", "value": "scan0010125pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adbd1d8-ae75-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761047950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047950, "uuid": "6afee2b2-bd29-4180-b18c-aa7ca581b12a", "comment": "Malware payload (Mirai)", "value": "e015846865c08463749cadfe5f74e331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047950, "uuid": "25d797ce-33cb-46a9-be69-ba0f1ef05c43", "comment": "Malware payload (Mirai)", "value": "c71aafb30b692220ce9a7e9ae68bb68e028ae7bad3478a956653bc92175bd272", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047950, "uuid": "1569abf7-955c-42e3-a72d-4d43239dc01f", "comment": "Malware payload (Mirai)", "value": "b78d89c93fdd1368106a2b0200ebf70c0d183a49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761047950, "uuid": "5840cf25-6a62-466b-a2b4-deaf06e0ca69", "comment": "Malware payload (Mirai)", "value": "8daf2c307d468390e65798dbf2b2c9685d27b116dfa4bcd1401d826adbe9a8ee0819fc0c6c6ff60cfc986381391f104b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047950, "uuid": "48b0bda6-bf31-4912-bb31-b582d19254ce", "value": "T14283A51E3A359FADFB6C833587B78B21964873922BE4C581D16CF9016E6034D741FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047950, "uuid": "aa018cdf-c9c7-49f4-bd9f-20a4f7d9cf50", "value": "1536:pNUCIp/S6ZJNWiwmjZVDKoXk4/nZPqBvAVHVATCI/WnJ8VRdb:Yhp/HZ2AG0ZP4vqVATCYWnJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761047950, "uuid": "a5d7b05e-c710-4737-98ec-2b743c8db720", "value": 81400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761047950, "uuid": "0cf8abab-0423-4beb-b1b7-aa785fc4fa9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761047950, "uuid": "cb37f3c7-5104-401d-8d4c-1998ba4bc2a5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d6cff5-aebe-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761079240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079240, "uuid": "e6d4a8a2-b8e5-4d80-913f-dc42668d7099", "comment": "Malware payload", "value": "7ecf4249d81f667d7f20fa91fc623d62", "object_relation": "md5", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079240, "uuid": "7a6fdba2-167e-4e24-8d04-e4d235bc00ba", "comment": "Malware payload", "value": "c770ce33df10a24e61cc42214f78235aaf8c06e4ecc1b9cd99fe84ca669f1c81", "object_relation": "sha256", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079240, "uuid": "7a5f5940-aec5-4d26-99de-2057e45a0726", "comment": "Malware payload", "value": "855b2532b34fbc892239023887385c2891bc8554", "object_relation": "sha1", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079240, "uuid": "42d4ad49-d7b0-44ed-98a3-59da164270ac", "comment": "Malware payload", "value": "c39020d2c176638555d4998d5d76320425ecc40f3752063686fa2ac54c87d0b8ade6637b27e2b05feb5eebd9e7df6f39", "object_relation": "sha3-384", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079240, "uuid": "dc862bd3-24b7-4385-a1ca-e67c8941295d", "value": "T1C0B4BF017580B331E1AB1B38093796644ABE7D604F71CB4AE778B61D0E706DF9721AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079240, "uuid": "fb044cbf-aa0b-48a6-898a-a98dc768147c", "value": "6144:HArptraBqLlAGXNZXxWaAb8s8K1aVo4uJ+6sai0jR4kQJJOHUoV:gFBaimCHxWbJeSJFsaFR4QHZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761079240, "uuid": "809e840c-0c3e-4c92-b43a-72e9b617bb9c", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761079240, "uuid": "c36c6b70-4b61-4344-82fb-6c861de51731", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079240, "uuid": "2a8ebfac-04ee-4b5b-8d40-eee7284663e1", "value": "LuksoDesktop.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7441643-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064023, "uuid": "92a42225-e53a-4794-aadc-c19740d5b8ed", "comment": "Malware payload", "value": "672bc7ab2d69c25ef1549f25b046216a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064023, "uuid": "ec7e948e-7823-4efe-8001-cc5851e00a59", "comment": "Malware payload", "value": "c77cb3d4da6a4208d4575516056afe68c7b89a2e7614c072a8df77c167ce9d11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064023, "uuid": "fa5e51ab-b4c0-44c6-ae29-6d7916b50b94", "comment": "Malware payload", "value": "95ec4fa5a212dd1b255cabda079fc4f3aa2b7617", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064023, "uuid": "864c1504-4fbf-496b-82e0-46fcd1df335a", "comment": "Malware payload", "value": "5c9e48dd3163eab4df6a098adf80bffc40dd9c2f4222ee548b3f242bdfacbf1265bf88650d45c8e4dc6e11d71b870492", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064023, "uuid": "692d662e-e840-44b4-9dad-6af92f64d5a1", "value": "T1B5A308D88A536FE1021812D63DEF63BCCD19F82A5785A0D9270B7EB210D4939DB186DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064023, "uuid": "0ccf9335-eb76-4cbd-97c6-e38a43ba6c1d", "value": "768:GDhd0i7J4sYKgY/CMNfWd7imW1SvSQ2P5y8SP5Ue8QAiSv2PqETmWQiSyUsijV2c:GDB7eKg20UrZrcgOhpAngV6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064023, "uuid": "f67f5348-bf1d-448a-a6d4-4e9894fc64c4", "value": 106009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064023, "uuid": "bf8d7d56-da33-4477-8a7b-c18a2c98118e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064023, "uuid": "3f48f07b-3a94-4d43-8b3f-b1d349d2fcec", "value": "invoice-1637482117.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976d96a8-ae32-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761019276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019276, "uuid": "7a3a191b-1324-4703-bf0f-045629d54517", "comment": "Malware payload (Rhadamanthys)", "value": "b1092c096888f0eebab834ba4b3abb09", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019276, "uuid": "6da26c99-959e-4ddb-ad52-585f208e08ee", "comment": "Malware payload (Rhadamanthys)", "value": "c7ded01427c2e2392d215fbac5b819664dfe287774fbe4ce3cb4bcaa0b286a50", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019276, "uuid": "d004c79d-dba8-41ea-ba89-581f57d17da3", "comment": "Malware payload (Rhadamanthys)", "value": "e1ff0b6d45ec48bd2bd28f140fa43c3d8fe7b470", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019276, "uuid": "bedf25c1-0121-43b9-9007-c3336e4bc663", "comment": "Malware payload (Rhadamanthys)", "value": "4d1026ef3d3f07b33f2240d3026681abb25e5b92dc43ec7500f73847c9c0be9d25a33bb70f0757b127c43fb481c761a7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019276, "uuid": "4822023e-a3c4-4ff3-ab12-286608f0fa22", "value": "T14275232B97E656A2F4BF97B560F102174371BDA227BA57EB12CD80B90E633D04A30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019276, "uuid": "9ef26049-e633-46f1-909d-6cc63de5ea02", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019276, "uuid": "26d88f53-abc2-469a-887b-944b53988bcb", "value": "49152:H4R8+B0K9mEc5joHWY38GZzD2SXfToeqV+piFH:H4m++K9mD5joHW+HZzCSroXVD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019276, "uuid": "30aad0c7-45e8-4d76-a379-773b0b9c9c00", "value": 1692088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019276, "uuid": "f8548f6b-ed0c-48f7-bfa9-4257df180d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019276, "uuid": "f4ae155b-6341-4ef4-bd0e-6dc3a5e991d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003b20dd-ae68-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761042215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042215, "uuid": "5c422f7f-2f3f-4847-8baa-dbab7e408bc1", "comment": "Malware payload", "value": "1bd7aad381f3b671e08b6072bec83ece", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042215, "uuid": "1d3bac4e-456a-4d73-91bb-b452ee6e9886", "comment": "Malware payload", "value": "c84092c6bd0b4e592988d95f893d8db18f9945cd2b62d8aa975b9de6ad72dc15", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042215, "uuid": "ccd66240-e5c1-4bbd-9068-7bc435aa4e64", "comment": "Malware payload", "value": "7ecd6ec5decd6d4cc79a5a862cecd8d35cb0039f", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042215, "uuid": "2ad3a35c-ff5e-4633-b808-8a858733860e", "comment": "Malware payload", "value": "a43c702369ad98ce94c1d5c7e8ac5805e975fea21601c8cf3b573536b84b6c5ac98fba9753ecb8820291ccb028ebdc63", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042215, "uuid": "501b9809-95b6-46c0-ba26-f7aff735e35f", "value": "T14B16BFB876047DE6266F576BDE96ADDC03B617239ACBA4CC8064B7C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042215, "uuid": "11e2a767-9f54-4444-b92a-ac296d081d61", "value": "24576:O+uBa6yB0Vv/xutaa+A8gQGaxMBdL3LGL7D6X27mJrX72knXUY7GPufo//wAlLOv:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042215, "uuid": "3a07aabd-cf74-44fc-a563-c9191953bc60", "value": 4032184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042215, "uuid": "0c675972-a094-457b-9590-77e91334099a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042215, "uuid": "4546f5a7-5121-4742-bbf4-590928906b07", "value": "power.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b346f11-ae4f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761031496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031496, "uuid": "b9f036a3-b445-4f4a-a85a-e06583f2bcfc", "comment": "Malware payload", "value": "a9139940bd7ef1933aaf44f7d9dd7e2f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031496, "uuid": "a7293a00-5aa4-4108-a788-fed706279798", "comment": "Malware payload", "value": "c9e0faefff9d87be4c7ba41c39cfe02ee49146f88cd90a7ba6877b65f25fc46b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031496, "uuid": "60109e86-f639-461f-8713-67692662b5df", "comment": "Malware payload", "value": "2b19e8b93d3035beaf94ad0859b241f935687321", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031496, "uuid": "742fab60-fc3a-4ca0-9979-9cca6bff3057", "comment": "Malware payload", "value": "35739c4d9cd0d4c4a22fe26dc0f0751b9b004008883c4fe48ab298d5594a24a51fdad9162ec43619a3f04dde789f989d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031496, "uuid": "4e578f31-b6cf-41ab-b020-11760911d751", "value": "T1334700C13754C127C86B08364E53D7AD631CEEA1BE24B847B3A9F71E163AAE34E61744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031496, "uuid": "76d8fcae-6b97-4490-9ae1-3901f9420f24", "value": "393216:eVmyzqVEFiEcGj6WGpi/DsW9HcbPuTojw8Lf1OfbRXj2RZK9R:dy+VEdc86WT/9tKPucjf1QxaRZKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761031496, "uuid": "d571c6bf-aa82-4658-8431-ac889e21e7ec", "value": 24592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761031496, "uuid": "bfc1b999-2280-47d8-80e4-5145816cc307", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031496, "uuid": "1be2b81f-fdcf-44b9-ade6-593c880061f3", "value": "SecuriteInfo.com.FileRepMalware.29162423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945cc9fd-ae3b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761023136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023136, "uuid": "2aa54770-f22b-4e31-9743-6f25e5247d83", "comment": "Malware payload (Rhadamanthys)", "value": "55d629b11be784b518f5253e8e2f4b53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023136, "uuid": "b054c489-9104-4ad9-becc-e1ac1afa9031", "comment": "Malware payload (Rhadamanthys)", "value": "ca479a93803b3967353f8c5ded93d11d7081df0d246dea41c869651a07ebe539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023136, "uuid": "f9853b1d-16a2-4a4b-b3af-3e4092614bb9", "comment": "Malware payload (Rhadamanthys)", "value": "57d6dfc2ef8c66c8c8c9b4ba7567e666c7dd9c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023136, "uuid": "8bf6e3e2-5909-47f2-9d96-57dcd04ce1c5", "comment": "Malware payload (Rhadamanthys)", "value": "beceb06d107dde84e7e0305fbceb742899725f72d3b5c3f9e18a1d8d1d9c9d68a60e38d38553836a244f22beb37b1144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023136, "uuid": "ea34dd7d-5b4e-4167-9049-e0bd7e345c58", "value": "T1FB563434211CF4E19A31000FFAF7D193576AA537A01B51DCE9CCE4AE32A6166D92E73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023136, "uuid": "a64d6d81-2d79-45b8-b8ae-3dc3a7d4023a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023136, "uuid": "67dd35ec-b897-4508-9ccd-beb14a904ea1", "value": "49152:HhwrImlSo2ORuEaMhHLpVCEf8NaWUu1Q/vJXm7O:HOcmlSUuEaMhrPffiaWUu18h2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023136, "uuid": "59aed46c-7c4d-4cf7-97c2-129fc82c7324", "value": 6302457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023136, "uuid": "e6fcdb05-f2ae-4f04-b3fa-acc7488fc5e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023136, "uuid": "d4921fd0-cbfe-4d78-9d88-3b13eea3d150", "value": "S1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3551e8-ae3a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761022481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022481, "uuid": "aa609ac8-953d-40e8-a5ac-1fbf53ec10bb", "comment": "Malware payload (Mirai)", "value": "b5d597dad632d03d3f54d52f064d6371", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022481, "uuid": "2dbaa485-72bb-437b-b9c2-ec954080caea", "comment": "Malware payload (Mirai)", "value": "ca5ec854ae9153fba917353c5b5d992aa5c7659d68b2b6db0e1dcf96f9bef750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022481, "uuid": "e88debc4-d73b-430b-af73-796a8626fe05", "comment": "Malware payload (Mirai)", "value": "a325921cb61b89829ea9fb094271c8b6b03b9801", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022481, "uuid": "f9102de1-a369-4fb8-80c3-68f6590639d8", "comment": "Malware payload (Mirai)", "value": "e16b529499b9f890b7be3d4eb196848f200edf438eaefbc187155a247c10605a38dc2e0c62b6ab19fde44ef8db9dafb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022481, "uuid": "7b4a5a2a-d294-4181-aba2-376cfa1b5394", "value": "T11A931946BD828F13C5C622F6FBAE018D3B126BA9D2EA3103DD25BF9133865DB0D67511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022481, "uuid": "9e5bc876-5a3f-4fdd-852f-b70eec7c0b2e", "value": "1536:XPKceD5bcrFYeQWEHLtwuMcBMLHMJx+AV0+LKpdl9vIfb:XycedcBYeQWXQBMLstGhIfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761022481, "uuid": "1fb5b826-7e71-4d81-8d2e-b3b46ed3a60a", "value": 94808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761022481, "uuid": "cfddebc1-153a-4488-ab74-3e64c916e8a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022481, "uuid": "1d870faa-6bdd-478d-b757-f27034d7d882", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9408a17b-ae3c-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761023565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023565, "uuid": "7a43b013-a7bc-4aa3-8bb7-970735497a28", "comment": "Malware payload (RemcosRAT)", "value": "1bf4401d8781547259ced7137f33de65", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023565, "uuid": "9eb3dd91-10de-42f8-bd01-c42177460bf3", "comment": "Malware payload (RemcosRAT)", "value": "cb989e4fdf9c4b22e13f3d308eed92711a441e8323d08f395f41a76e03a97dcf", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023565, "uuid": "e87fdeeb-2a50-4bb3-b6f2-0250491119fe", "comment": "Malware payload (RemcosRAT)", "value": "035f2a05721b99c4e57dbfff72c0d62b3f9b8044", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023565, "uuid": "2e8cbd85-d416-4f4d-bd1f-fd24426314fa", "comment": "Malware payload (RemcosRAT)", "value": "fa0c760743568a55f35e176bc2462fdfd03d94724214d6c2390fdb577bd78a701f99c9e8fd1aca73cbda1a8bc3f262fe", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023565, "uuid": "9d176f98-eb0a-4fcf-a788-4e35c817d958", "value": "T144059C3D9DF5B88EE2AC619124F52A1700ECCE839A3215DC9086D876BCDCDE5579A30F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023565, "uuid": "2d6543ba-fda0-4e03-8df7-9d4074a787ef", "value": "12288:atKiHLbauJGMBl5vi63lsY8NKR+m6ydKtdrw7KvrqsaRcJBfwjqGJE1u3FxxFxhO:atKir2qRBlNflJs6IwqGmJlmJEeJ7R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023565, "uuid": "5423be35-06f7-4389-b4ce-6c435a296dcb", "value": 823004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023565, "uuid": "33e1c23f-d293-4983-bfd3-666cebf22309", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023565, "uuid": "ed8294cc-1db1-4699-af1b-3ffdef3c1e22", "value": "Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17e4af5-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761064014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064014, "uuid": "ac4183ef-8370-4d4d-85d6-04952f9ccd34", "comment": "Malware payload (Rhadamanthys)", "value": "7ee482fdf5f1e568a2dd5ecd79a06ce1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064014, "uuid": "218592ce-12a6-4c92-84b7-f86e44193adf", "comment": "Malware payload (Rhadamanthys)", "value": "cc1e3834d4a287b6f6654fa4892ebe3fac4df5b77f2105b9f4fa6c20da7f9904", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064014, "uuid": "794c01b4-f5e3-4912-b9da-e8dd22eab946", "comment": "Malware payload (Rhadamanthys)", "value": "3457e60e2ae78f78fcf142c194def130d3d9e6b7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064014, "uuid": "c77a13dd-a852-4add-91f5-dd7cc5f29de7", "comment": "Malware payload (Rhadamanthys)", "value": "7b116b3b37c00517560e446b08dcb92a4bb9d8303f687126e87960951ac3d54ab2618c3a53d66d045a07f78710e67aa9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064014, "uuid": "351a3977-e0ab-49a3-8d3b-2554b522e146", "value": "T139A3F8627716ACB8062161FD6D6886F93C0BE743196BD3D320C7F63E10BD271B6AC649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064014, "uuid": "2d48e1b9-4ecd-4b7f-95fe-90c424236c53", "value": "1536:GDB7eKg20jzieMqtES42wV34dspznOCnbIxggr9OvwzrQH9yIoGbS+cokWXUvTAC:GDB7b0R/EWEwG6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064014, "uuid": "a14c7071-0545-435d-8964-491f456151f8", "value": 98703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064014, "uuid": "b204d7ab-78a0-46a0-b757-2fafdc3cec8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064014, "uuid": "eaa4ee97-ce0c-4cc2-aba2-5f8e5b9e7ba6", "value": "invoice-1637482117.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de97645a-ae81-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1761053325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053325, "uuid": "a07042e2-6197-46af-ab49-79071d18e74f", "comment": "Malware payload (GuLoader)", "value": "af1f8cb100e1fbefa91f7e3bc91e4e93", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053325, "uuid": "5c4846f3-d7b2-49b3-9388-9d7be85b7a68", "comment": "Malware payload (GuLoader)", "value": "cc668198e2c986567da51def3d214b9b9278863298af4fff95f4898d70b82f2d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053325, "uuid": "a9ced15b-9907-40d7-ab6d-4b340f6945fb", "comment": "Malware payload (GuLoader)", "value": "38833b1277417f079092a8516569ab1e1c0afbf0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761053325, "uuid": "ecfd57af-809c-406e-96e2-e07a332f8838", "comment": "Malware payload (GuLoader)", "value": "63cb29e1c7086f5c5e46e828b1293179adbda3e8b08665be23b9fa8f87426b4c3e99eec9e769f24c8a3c90a7fb0a7496", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053325, "uuid": "8fd57e0d-5e4e-48e0-b2fa-2d14e3490b3d", "value": "T11E32C22E452E88648EAD3E0AE1221497DF78438E0F17F4C503B2DEF96897A2DF4DE055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053325, "uuid": "5978e454-fefb-46a2-b52c-aec98cbb5405", "value": "192:oIQhStmKCeEzT3/wX7GANxaTKMcIZuT15fiCYYfsJ39HNDuKxWLOW0pkRDZB:o9SUKG3eyTVcL14FYkJ3ZZuz0yRVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761053325, "uuid": "6a465711-22c0-4cb9-ba94-d1223a134087", "value": 11228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761053325, "uuid": "e059eb9e-f04b-4a29-91ca-172559149492", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761053325, "uuid": "40eb5ab0-611e-4492-ab6b-374b393ef58f", "value": "IMAGE_012344554_001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913acef2-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761025708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025708, "uuid": "99f0aabe-f7d0-49be-856c-cd0627e70836", "comment": "Malware payload (Formbook)", "value": "abaac3711feaf738016d483ae8b07dc8", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025708, "uuid": "750891d9-a4d8-487f-8cd9-3971d92889ce", "comment": "Malware payload (Formbook)", "value": "cccd4d072383aef7450faf4f64bb44717ea8270a61f40657b36484283448b7b4", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025708, "uuid": "b511b73f-de14-4182-8d05-763c27baae79", "comment": "Malware payload (Formbook)", "value": "5f9bd657e51e0eae86a353d5c1ba5f5663a9db06", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025708, "uuid": "52d4e8a6-cadf-4115-a72f-86bcd838717d", "comment": "Malware payload (Formbook)", "value": "07fd120a90954af52d052532f142a790878be12f2f2f507b6fef12a4931f55bebdff0b6a4ba365e4a1d7da83db948868", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025708, "uuid": "019a45a2-f97c-455b-8eec-07435bb53625", "value": "T1A4052336EA92BF3CEAB974E3B5533578B4D9AE4541357176200B53C85C0062ECAA42FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025708, "uuid": "b006e12e-3124-46f1-8f78-5520ec72a787", "value": "12288:nCOPkUDDgQmrr5cRP9u3e1SN94oYX3d3fKwVShB3r36yy5ueNe92VlkvOWh/2pJg:CT2sN2OfN94oGNDUb3ZUueA9OMOU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025708, "uuid": "8d9a879b-7ea2-48b8-aa08-97d7d144fb77", "value": 854752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025708, "uuid": "66a3b67e-1f05-4568-9b15-1875bbf9852b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025708, "uuid": "4693922d-e221-48cd-be6c-c1be8ec4d438", "value": "order_20251020.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d9337d-ae93-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761061068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061068, "uuid": "9999738e-1b41-4181-bed5-dbf8b6163553", "comment": "Malware payload", "value": "530896cc0d8f071a4d1a01456a1d9a7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061068, "uuid": "b3e99f90-53a4-4d8b-9e2b-d32e0d35424b", "comment": "Malware payload", "value": "cda011f0113ef232e7ae1dd38bf4f471b4b7bd1dba97dc9647028ef3e46bda8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061068, "uuid": "fb791826-cc61-48ec-a74c-0547fa6a1881", "comment": "Malware payload", "value": "42763577527364ef785ed571825cfae14c83fa2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061068, "uuid": "6b455b5e-a587-4e2f-8cc3-b04cef5b7d81", "comment": "Malware payload", "value": "faf47c001874e9b7f051048887424f0240d05ad37b7621a824838b25c76b32b9bd51e643060c547edc757b9235196b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061068, "uuid": "a4c24911-d19c-4cb6-8bbf-0e120da975bd", "value": "T1AF862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061068, "uuid": "03586bef-b273-42a5-a587-6cc8253173e8", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPXV:glRJXp8L/KyZcCb7uEew+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761061068, "uuid": "2236804d-2264-47ef-90cf-dbdf90c62b1a", "value": 7864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761061068, "uuid": "1d8f33a2-70c2-47b8-a174-45063f28b83b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061068, "uuid": "f319fb6a-a5b6-4a10-a7bd-d40c83ad1ae1", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51cb169-aec4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761082086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082086, "uuid": "a9d6070c-353e-4476-9bae-6a393a333148", "comment": "Malware payload", "value": "170d1b28b43747ea0144efea9cce5811", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082086, "uuid": "9750e303-7fc2-4be4-9597-e95a2709020f", "comment": "Malware payload", "value": "cedb31216ad795ea25c1a76df0b358d4297ece51e4ffb727a3aa967f6d782f21", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082086, "uuid": "0f08ebdd-ba0b-48d6-bc66-bdbf90d40082", "comment": "Malware payload", "value": "8140053ef7f5de4298f24b5d8daf49c5a04c9119", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761082086, "uuid": "e47df3ec-0578-483d-ae05-c311c0f42931", "comment": "Malware payload", "value": "2158302f84d16e1e0179247817387e3d56a3c8083b8078b2b90f15c4a0981f0523a8a3cb8490597445b879368582503a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082086, "uuid": "bf4255ad-fb2e-4796-b364-0be520a2798c", "value": "T1FA43A5D5F97328394FE4D056CE51E4C1007EFB8EEA75A408EB602179EF3D964C38266A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082086, "uuid": "d4f970c8-c9b9-4a75-baa9-0ddc6fff563d", "value": "1536:6fgpSMx7exP+Fxpc76oDT0WfUX8nziZ7RI1OXKfpD8m3P+6bWZexhLI4Z/R9iwb:6Yp3x7exWm7NDT0WfUX8nzihRI1OXKfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761082086, "uuid": "1e3cca4e-31a3-44e0-9439-8bb06d92f41a", "value": 58546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761082086, "uuid": "5e904cfc-cb23-4372-8081-28af66930f52", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761082086, "uuid": "12a6fb15-95f2-4503-9076-ac9169bae8e8", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f4edfb-ae75-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761048026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761048026, "uuid": "6125e10e-e1f8-4f68-8caa-6b0937d43df0", "comment": "Malware payload (Formbook)", "value": "9c385e94f5e705d56612f69873ff0566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761048026, "uuid": "e37d6265-e778-4437-95cd-e076767df741", "comment": "Malware payload (Formbook)", "value": "cee3ad80393d6f7f61734717cbd140f584a467a28f39ae08c07e15c40b3b3125", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761048026, "uuid": "9fa12a12-893a-44a9-a7be-57fe43e5079e", "comment": "Malware payload (Formbook)", "value": "48e4de2e3c78960c87a69514b9fb1c5a8afdc388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761048026, "uuid": "8e928d1a-6310-42dc-97d6-cda71b4f6fbe", "comment": "Malware payload (Formbook)", "value": "56611f8c48443360fa4101d02bd8753e82b321961c67f3a831d0bea303b083b058dda7b8fbbb4c00c49422062898674a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761048026, "uuid": "aab7b1e5-570f-4e15-8e49-f801852998cc", "value": "T162F40155376AEF22E9A22BF019A1D37113B49E0EB810D3074FEA7CCB746AF052959743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761048026, "uuid": "03f794ce-1083-4ca7-ac46-e4a1e9a0cfa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761048026, "uuid": "f57a09c2-3ee3-4d38-b495-609ec8dda38d", "value": "24576:m8f7bTDXeF4dOyvAFTlM3E9N8SZP0z51Jexk/rl:lf7OcvR3S9P0zLJea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761048026, "uuid": "0bfa1eca-1ef1-4089-86f2-c859a92dff71", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761048026, "uuid": "deb76d1a-839e-4970-a7e6-3be7b4e6d6a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761048026, "uuid": "67c1ec50-6da2-4e67-ad9c-930d21310dc9", "value": "PO-071924677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71559f7-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063969, "uuid": "c12778c5-c340-4763-a55e-d86c308f1759", "comment": "Malware payload", "value": "59bf1f06796437750feea6e44bfb4827", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063969, "uuid": "65067d40-c2fa-494c-907e-05dd0fbc3cfb", "comment": "Malware payload", "value": "cf7c678d5da527aadd78d524ef19618366f9af2e0cc1c547d11d3986ce00d141", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063969, "uuid": "abe6eb06-1738-4fa7-bf4d-5281fe8ef3ae", "comment": "Malware payload", "value": "4a9cf924a8986c5059450fa16aa1cddff4c07284", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063969, "uuid": "3d4904bd-d154-4691-bb98-87507ca2af97", "comment": "Malware payload", "value": "cb81df34479408712496ecabd115799becd5e2acfead9c339dac5774c673600edef4c162c016ec4e8b399f8fbf5aec2b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063969, "uuid": "70c64dd4-07dd-48ab-8e46-fe211d36db9b", "value": "T15FA32AD96B0BFCB00173350E44A536FD9143260FDA19B2012769FB7D6093BB1BA6D9A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063969, "uuid": "5e56a51a-5f40-4302-b2bd-5dcd5c0f7c24", "value": "1536:GDB7eKg20W4vrurx4mK8jmoIDAejaJ9B6BkQWJ+aY:GDB7b0W4D0mmZjmoIhjaJ9B6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063969, "uuid": "da8ad640-48af-4994-a121-fd74c779d804", "value": 103349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063969, "uuid": "cbd55d9b-335c-4452-b394-508aac3f3569", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063969, "uuid": "29e7a972-f416-4278-a4a8-83b715f560d5", "value": "invoice-1637482117.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0c91a8-ae5b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761037002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037002, "uuid": "50e184ab-d238-4037-ab98-0e567c82df94", "comment": "Malware payload", "value": "94f44fcfd5e6eb44aaaed4549c95ea5c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037002, "uuid": "d799f8ae-a87d-42d1-9122-ddb07c396720", "comment": "Malware payload", "value": "d155f2bdb03cdec2ec5f16910bf1900caf758e75c30cd48c9cfe31a1367fb1b9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037002, "uuid": "11ca8a17-1696-4ec3-aa5e-4faed7c5dab6", "comment": "Malware payload", "value": "0f257cc31c6ee3a3e3ff47e7829beca0576392c8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761037002, "uuid": "c4f64f10-d84d-4522-a728-8cd0135c9a82", "comment": "Malware payload", "value": "0af418a223ff32949503dd5bfb882eb80797c27ee9a17a3afc4beb03788813033c5821e4e09523deda92e7801f880224", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037002, "uuid": "fb8c9bb6-3a18-4f6e-abf9-25037eccfbaf", "value": "T197B25B163BF5050CF5F29A38B6B3A221847B7A19DE314B8C0180DA586831E11D555F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037002, "uuid": "b0c897ed-d3ba-4477-8fdf-b2c31e6a462f", "value": "12:8d/is0oNJfVUWX4SNJo6Cs8XILDBniTXSOI+4219kTetIyxWkjBd1d/N+a/SB4AU:8d/lf9fCAhiTaZ2vkRyxWahdXvGOUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761037002, "uuid": "3f10865a-a2b5-456c-b6da-f1bd8668f488", "value": 23769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761037002, "uuid": "30fdef83-4441-4877-a627-072ddff3ab84", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761037002, "uuid": "fc2d5ab2-55a8-48e5-96a2-bf227f67a767", "value": "\u0420\u043e\u0437\u043f\u043e\u0440\u044f\u0434\u0436\u0435\u043d\u043d\u044f.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b13ebe8-ae32-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761019067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019067, "uuid": "94da6c5a-504e-4fa5-87db-383a81abbcdd", "comment": "Malware payload (Mirai)", "value": "53d9cfbb9b6db7c31f47546437b0a82b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019067, "uuid": "e25ce138-4c69-483c-add1-4aabf502ea3a", "comment": "Malware payload (Mirai)", "value": "d1e58c0ebdaa127241347464c793d45c0db1d2536e341695a004f3214312347a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019067, "uuid": "0a946fe4-f5b3-4b3f-83f6-6b7661d7c841", "comment": "Malware payload (Mirai)", "value": "50b84beadb68abf0b0cc301ac7845e808c4adace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761019067, "uuid": "6f529c45-8b2b-4b86-ae7e-640d820e540c", "comment": "Malware payload (Mirai)", "value": "b79ae3083a910ddf35a2ea88b317db59d56f696fba2adf4b07e2334b46d62b6dbf9dc0f2676d83c6911636fdb4f9f2dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019067, "uuid": "d8de5c54-25b5-4970-981e-6f392280693d", "value": "T14AB3E709AF610EFBE8AFDD370AE90B0524CD691B25A83F757534D918B60B24F16E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019067, "uuid": "5ea63369-af5b-4f15-82bc-398beca36957", "value": "1536:olMv9DpxhdoRXIWA7uIdBF+35o1zCVX6vk0VK0Z70cer59eE9gvdL:CMzzdoRXIWT56M0VK0s6xdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761019067, "uuid": "974926df-98b7-4095-8d63-afb7c80b6771", "value": 116524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761019067, "uuid": "1c91085d-1270-48bf-b6f6-eea3395e9cb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761019067, "uuid": "eb7443ce-2fbe-4e18-9d90-ab7d9d9a80d0", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b054cb-ae68-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761042336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042336, "uuid": "51605b8c-c612-4f23-ac0a-29524b159f77", "comment": "Malware payload", "value": "eec1872e53789ff0da3158f8f329b209", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042336, "uuid": "c73cd89e-8a38-49e4-9df5-e871a857dd0f", "comment": "Malware payload", "value": "d3cf84ac9091d29042ab1d9c4c5fee92890bde248aa89ef0457c73c748ac00af", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042336, "uuid": "21f804cc-bebe-43c5-bde0-55678b415cd1", "comment": "Malware payload", "value": "f7856026caa4377ca726744952472790e2ed392c", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042336, "uuid": "7382403e-74f9-419b-96d8-fb681146fa70", "comment": "Malware payload", "value": "1e5362caf340e0e15de10f99904a96e2c65f4b51de60dffcd5db6c7ca5aefc23293cbdd17f71056958e215776b3ad8b3", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042336, "uuid": "cac03856-63f6-472f-855b-8d82a66ef885", "value": "T190C533540DF9BE7B0E58827C22AF274C2FC05FE151A9B9EFD28061C70A6F79114539AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042336, "uuid": "2239ee22-3205-40cd-8a0f-308183f17ee2", "value": "24576:Xau8GnAejz7UmeYmWOzjO0tBf39tQL2hljgzafLokmu7DQZw/fF/du8oITPCa8dr:RAeSLHE2h5TZ/D8wiITlz8qsZ9a32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042336, "uuid": "10116c03-3706-4dc6-a648-f0922344b0ee", "value": 2688516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042336, "uuid": "9e9db067-c1b3-42ea-8fcd-d1a5ce81fdc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042336, "uuid": "a93fb06f-26a6-40c6-bb07-be6b5473192d", "value": "ttv.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac7d731-ae3c-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761023549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023549, "uuid": "2fcb2537-4834-4790-9d5e-7c301e9ad3be", "comment": "Malware payload (RemcosRAT)", "value": "df256834a12817bcfffe280b4bee1cd9", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023549, "uuid": "d5d67924-638d-48f9-a723-d011b2f34460", "comment": "Malware payload (RemcosRAT)", "value": "d416e266233c918414e743cf4ecb4c5c5f9129316fff75267820181c06cfbfe3", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023549, "uuid": "283f6972-558f-4488-919c-8e39c6927406", "comment": "Malware payload (RemcosRAT)", "value": "edcbc8827e68f7b875dbe34e918adad56e76c5a9", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023549, "uuid": "2abb07e4-871d-4a3e-bbc5-609d181bcd35", "comment": "Malware payload (RemcosRAT)", "value": "10db587b514f60e5a473209dba9e56c1b5730e8664292d2066011e2b382b5f59932332a4f234adff5bd0b3be752cf762", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023549, "uuid": "c48da833-4d32-4fd7-9e3a-4a9caf671e69", "value": "T13DD5021589C42FB9CFAC5A1890FE161E93E04A8E545B758AFB37BD4BAFFB504010B1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023549, "uuid": "e8180976-0a75-480a-a168-841d209df120", "value": "24576:Fz4x56E3/6cF+r0b3zx4EfYaFfAJNAyhHPF+Z+HdFkoZNGR2xr2qUXsJRC/fbcyE:gvFyCYaVKF+QTk86BT1KNb7C6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023549, "uuid": "cc70bae2-fab1-4d41-a329-95277477c613", "value": 2892700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023549, "uuid": "36dc88cf-c7bb-4393-af06-a1dc3acca7a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023549, "uuid": "5e967c1a-9d4a-4449-96fb-5788cdeaab92", "value": "TT WIRE INSTRUCTION FORM.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074cbdf3-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761024617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024617, "uuid": "07c76f10-241a-49ff-9e34-f06007cff4ed", "comment": "Malware payload (XWorm)", "value": "8773646a502672ffab5d1ee749f7476c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024617, "uuid": "92f2edbf-3adc-4b37-9d3d-ad5be10d2440", "comment": "Malware payload (XWorm)", "value": "d465b1cfbb937e54f19ce771f360c02bc534c813b1c8acf7d9c640ce68cc8396", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024617, "uuid": "38a64e6b-aaa9-4b2f-8ff3-2378dffd152b", "comment": "Malware payload (XWorm)", "value": "0edf4b44deb3bc932752608ce9d73f07c1d72768", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024617, "uuid": "a4b901cc-06cf-4e31-85c6-516c589249b9", "comment": "Malware payload (XWorm)", "value": "12a963fccaf7d88d955b15b914e696fac2c0ef17b4f3ad50d96e6cf27ece64e1b5a75611eb02dc702c12a9a193b87174", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024617, "uuid": "40e86c6a-16a9-4410-a1bf-24e7d804aca5", "value": "T186F30B3C9FF4BEAFF239E1A945F53A2240CCC6529175C8DE9094C8665C2CCB8B69614F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024617, "uuid": "ee2386d8-a16a-4276-99af-24850ca0e37b", "value": "1536:gcwZhmit56/VAOuuopmhnUaQyfz99Zso5yyGKyfdkLlo/XhbzGdVgnhp4MhXDZhy:gcwZhmit59wnUax9ToyAFmY3MVM5XD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024617, "uuid": "1ca9d556-44e1-4ac3-bcfb-80d3e0e89072", "value": 158253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024617, "uuid": "7cfbfe49-8b11-4f10-9284-102f59f0cd9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024617, "uuid": "ccbeb07b-2dad-43d3-8378-5c91ca6a529d", "value": "Purchase Order and Company Profile.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5425e566-ae6a-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761043215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043215, "uuid": "ee87cab6-9463-4ac7-bf6c-db90944ec9c9", "comment": "Malware payload (XWorm)", "value": "d252d16c7e2055ea3e30595362102097", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043215, "uuid": "7ccd0182-f64f-43fd-b870-ee52c54ef059", "comment": "Malware payload (XWorm)", "value": "d47ca2d7afe08e72eb9a9488ed81961275ca1ca1f4d8074abdb0bd22a0d5966f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043215, "uuid": "64f74794-904f-4ddb-bf05-2282ff4a5458", "comment": "Malware payload (XWorm)", "value": "b448b3d39092e128525535b41042e1c7d0e6e844", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761043215, "uuid": "06e42632-35be-4dcf-b76c-ed21b76f1462", "comment": "Malware payload (XWorm)", "value": "b5667c4b475f69296fb21276045650372f1881b9b2f8904987f8c909ac89b71f6560a97c0302ac4a087662b7401221a0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043215, "uuid": "6d5a93dd-c5f0-431a-91b6-bf860f2b1794", "value": "T1B8A59DB28D779EC92F7864CEC5DE7AC03F1C57438568A6906A4FB27F21585007ED88AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043215, "uuid": "9b25e437-d196-40c5-be64-752b18ac56e3", "value": "24576:p9iUFS/f/m5PoR/XufqsKRjxZqiOJReeDtFCk+P+tsPa7LVbieEAOdkjoPIlLnaN:bSe5PoR/ewnHSRvvolIpa+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761043215, "uuid": "65ef12c4-40ff-4ac2-8971-0a81ee92bf84", "value": 2188987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761043215, "uuid": "f1cd68cc-751f-486a-ac26-cfabd2dfa1f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761043215, "uuid": "030174b4-5595-4fcf-b899-3d79f85f35e4", "value": "IMG-2025010-WA001310.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833ab60f-ae9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761065627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065627, "uuid": "99b0b7f2-e7f9-4d7b-9647-4d4558292a19", "comment": "Malware payload (RemcosRAT)", "value": "91e57d5811edb4267481be724d9f44e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065627, "uuid": "50d5d136-1cee-4098-93df-a935c0a3e7e6", "comment": "Malware payload (RemcosRAT)", "value": "d5585e80813d521e5be357c55dc940834933e6684a0134f05e4ba4c74000b74a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065627, "uuid": "da6d540c-cea5-483c-bd7c-3dce1a1d7610", "comment": "Malware payload (RemcosRAT)", "value": "9156b50f79f8894ea700378ef8fc5ce283082bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761065627, "uuid": "42b914b3-e894-4d6d-a913-160cbfdd8c20", "comment": "Malware payload (RemcosRAT)", "value": "aead56bf6d4906bad2d7cbf9fa8f8e01c7e04493480a5bb58a4f343a303e8cc2fc620cecc76149439fa022c81fc7853e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "www-blessingsz-com", "colour": "#2C5ADE", "exportable": true, "hide_tag": false }, { "name": "www-chemeclo-com", "colour": "#A5E6AA", "exportable": true, "hide_tag": false }, { "name": "www-foodchenn-com", "colour": "#9E3818", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065627, "uuid": "0e2709af-2281-48f3-9608-ac49f2781041", "value": "T139A4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065627, "uuid": "cc074c57-1961-47be-8535-bee73cd2824a", "value": "e77512f955eaf60ccff45e02d69234de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065627, "uuid": "e3c79503-dd0f-4e6f-8af5-159160bd1686", "value": "12288:/13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQFS:tak/mBXTV/R0nEF76gFZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761065627, "uuid": "5caa17d1-7118-4695-9fb6-b2dc876b92e7", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761065627, "uuid": "daad98a4-067d-438f-ab39-530036cbba5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761065627, "uuid": "d714ab60-7090-4bcd-82ab-79a0d9e671a7", "value": "d5585e80813d521e5be357c55dc940834933e6684a0134f05e4ba4c74000b74a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b45ec8b-aeb9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761077076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077076, "uuid": "8ea7cf3c-6d57-405b-89c1-4f2073a3ebba", "comment": "Malware payload", "value": "56ac8dd94344b5aef373fd95ee6231de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077076, "uuid": "e8c46a9f-a162-4b28-a799-fec7b74d23e4", "comment": "Malware payload", "value": "d57cbf4606caac9916dc84dd02cb85273a15e2d6b2645fe68a34dbcb7c2e5901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077076, "uuid": "dd3fec6e-429d-4cfa-b619-d8bbc1d45171", "comment": "Malware payload", "value": "f817ca5deeeed4988b6134a30275b846443b4112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077076, "uuid": "d7935996-3dc8-4eb0-9c4a-fcc5ba6be1b7", "comment": "Malware payload", "value": "ef19c406b1ebdd053fe63ea24fba25909561d7270c61e9551a0d2396aded29836b0c2e309802c3a810d25a26a8322953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077076, "uuid": "14b28119-ffa2-400b-8295-499b4b26f5f1", "value": "T11C165C136D908A99C05BA23C98E3914637793C500B3773C32B70B67E2FB66D4297A7D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077076, "uuid": "cd6424be-0e9e-46cf-b396-80741e87cab1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077076, "uuid": "e7130e28-d9f3-4b06-aa34-c47ce70a3dee", "value": "49152:Sbevywv61PHP9jkdiZorTiOSuJ+1moHPvr1+9QQ0lveIm+5:SNTUkvew5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761077076, "uuid": "ffb93e14-63d2-4dce-bb68-ec91aa769157", "value": 4145280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761077076, "uuid": "36a37cbb-7e81-4aa0-b367-833fca9d6135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077076, "uuid": "2f4b78ba-0d4a-4853-992e-3af7505f635f", "value": "Release_V2.24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af75dcc8-ae6f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761045515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045515, "uuid": "63489bef-1342-4880-ba55-66ad990be4e1", "comment": "Malware payload (Mirai)", "value": "f8b6ed761a661f9b3b6ef5821c4bd9f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045515, "uuid": "fd7b8b9f-4925-45d3-aef2-954cd2892bcd", "comment": "Malware payload (Mirai)", "value": "d59154660b018cdfcc9b4abd935d53c36ebd832523bab6474dc29f6105a0bc96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045515, "uuid": "13b2c616-f2de-42a4-9b83-c29b3e52bd56", "comment": "Malware payload (Mirai)", "value": "60a9c5968a16c89f9befca775362e1f46c12b339", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761045515, "uuid": "f5ca08df-9ed2-431a-90f0-eed6ddb17d66", "comment": "Malware payload (Mirai)", "value": "9a5f02cb744963bc2bfde7161d2fc70169ef60cbd171d6bf2f548ca974f74c64b9e86765c95922ce4b7ce2d0dc9c5354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761045515, "uuid": "76c5d7fa-fab4-4d43-bbaf-835f9385de39", "value": "T1C034080AAFA10EFBE8AFCD3706E90B0124CC641722A53B797574D518F54E64B5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761045515, "uuid": "751a2de4-3d06-4ad1-9eb1-f7ef95c1a865", "value": "3072:SinjzG3BQkdvwO4YeehLodpFcIjbOLe8Up505m+xDYApxc+6Y:SUAZdvwhYeyKpFypUp/+ycxTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761045515, "uuid": "1b65db6c-2c53-4dbc-9dba-5b1b0426057a", "value": 244056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761045515, "uuid": "f5f0f957-3841-49eb-9352-1979b27bfc34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761045515, "uuid": "ab674022-41b2-4346-96ce-ec8224fa4ea5", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d76993-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761024887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024887, "uuid": "2300bd55-c9eb-4fb6-9b83-3977fd86efa0", "comment": "Malware payload (Formbook)", "value": "795c606b1dcf4c066399d2055f00fc4f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024887, "uuid": "ec3cd72e-4499-4c83-b812-0a17e8dca4a4", "comment": "Malware payload (Formbook)", "value": "d91249db46fc549f5cce74441f23c67f154307b4f964f267988964ac278dec7c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024887, "uuid": "5e090738-7dfd-4310-a6df-b8d49ac55b22", "comment": "Malware payload (Formbook)", "value": "f7d5f46c099da7f5f54ddef568079851636fc670", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024887, "uuid": "c9b4a276-4fd9-488c-a51e-663a43bed463", "comment": "Malware payload (Formbook)", "value": "b9c7ff9a6a5560f534da5b72297ab8f1dc40b54c8aecb651b8e4da248d9dc28364e63f0db1bf852d2ef7b2dd26004dc0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024887, "uuid": "bd275d8e-fbdf-4650-9135-ad51a6aab908", "value": "T1D6A142C87ECAB0344772E033272F2956E11BDD815A1E8885F131F6F879A5B40B76E6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024887, "uuid": "a10860d8-2770-40c5-b866-a149160d0b09", "value": "96:J07fRxo7tw8oXmoAQp9MyXtR3tGhBYXVM:MZxwoXr1RdGkXVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024887, "uuid": "5f3ab218-1418-4876-816f-360494105bf2", "value": 4876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024887, "uuid": "46ec9720-e821-4a58-9d4a-02c3cd1607f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024887, "uuid": "b725621b-7af2-4b01-acfd-c868dafb5425", "value": "Outstanding_Balance_SOA_Oct 2025.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039ab66c-ae9c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064554, "uuid": "5d231fbf-1ff5-41f6-8b5e-8365015b988b", "comment": "Malware payload", "value": "d7dd5b42aa70a237cc5ae7bc32feb3ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064554, "uuid": "fd476ee5-dd4d-4ceb-afb5-09cae45476ba", "comment": "Malware payload", "value": "d9b70a254f878ffa43c250ab43b0f7c64d9e0c84c4e38825105c14e04f8de10e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064554, "uuid": "4f14c5c6-68fe-4886-a6b2-ddf5b55a3f44", "comment": "Malware payload", "value": "8fd21e6b80cf4136f20f6917b7ae5d2d34eb6c45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064554, "uuid": "030b1b57-b55f-492a-bbc2-745d2ee94d87", "comment": "Malware payload", "value": "95ac8b76b78e1c97d1cd6fc4aa23740d3720cfb7665028ae869aa82cfc3da421d3348671f3b91be0cec7b46302ecb6bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064554, "uuid": "7b96e4bc-3d27-444e-b682-580aeec45162", "value": "T13884AE03E5A1C0F7E12B153655B7573AAA79A31217268967DBC0DEBB2C729019B3330F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064554, "uuid": "b80159e7-ce88-4a98-b526-cd202e8cd1f5", "value": "72db499e65e4c9b8bb98e86d601e5f90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064554, "uuid": "0c8ef200-777d-4620-86f3-6d3440d5e0ca", "value": "6144:r4Nir5mEb1WbJ/lZy9XZ/fPCe/XwWIOJsK/sroqYX54LzehdT:8w5mEb1WbJNZyJF1/Xwu/sro3X5Azev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064554, "uuid": "6110a5c3-3aff-4fb4-8f8c-503cb2d2a0e3", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064554, "uuid": "6f8c40a2-f338-4de1-8c02-17e1316eeedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064554, "uuid": "89562514-20bb-4175-abde-968cedbe1661", "value": "ijl11.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7feb409c-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761026108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026108, "uuid": "d8f2be7a-a439-4bd3-ba00-520c185fafc2", "comment": "Malware payload (AgentTesla)", "value": "437add06c27777832ce1442b5d4f42eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026108, "uuid": "7b95bf03-3da1-4eb1-8665-6a85b4d8884b", "comment": "Malware payload (AgentTesla)", "value": "d9be66d734fe5c34f17805e4c54fc22862108dc83120fd30ea27679a0b32b442", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026108, "uuid": "1b0e064f-0dd6-4cdb-b709-f24489d633c4", "comment": "Malware payload (AgentTesla)", "value": "4623766f6f3f8bce6a678146da37688a00f7d1c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026108, "uuid": "26c4dc5e-1bf3-4845-94d7-c988544be54c", "comment": "Malware payload (AgentTesla)", "value": "eaad6cb4c424aa9e06ff68b6e65843974efa7722cf34d4a94a2030c82a4b84374ee68f02c7798afc799f8804c0b576eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026108, "uuid": "bd101809-0d48-4351-baef-7f9653da6486", "value": "T19CE402182F1DEE02E9911BB42560D37626309D59E911D2135FFEECCBB4BAF46386C2E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026108, "uuid": "e4c8afc8-5d57-487c-a538-fca8ca438e4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026108, "uuid": "c06c9057-bf62-4681-a8f8-fe9bf716dbdb", "value": "12288:POt3L/rb8WkA8yy9qkNz905P60C4QwzYjbwKLisxn/v0ITU9I0kR:Pc7v+AuYI9uP76w8h/vTTU9Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026108, "uuid": "481a98e2-d3e5-4c25-87d3-53b0431d64f9", "value": 718344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026108, "uuid": "088e4dfc-b5b4-4020-9692-2c389aa018df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026108, "uuid": "d28a895e-906e-45e6-90aa-e7ed6ff29acc", "value": "\u00d6DEME ONAY KOPYASI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d68881-aea2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761067318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067318, "uuid": "1b34ac6f-27d4-45b3-973a-235b33aa3f30", "comment": "Malware payload", "value": "3b54921c91036af15ca283711e3301b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067318, "uuid": "4656f6f0-1725-4cfc-a86c-0680fdbd6ece", "comment": "Malware payload", "value": "da288a72584f8755e6f13dfb2dde61da7246fa615fd5399d184209fe2b6e6b79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067318, "uuid": "0be87637-4783-415e-8fbf-4cf4a9d3b8d8", "comment": "Malware payload", "value": "92993fee6664e8085d38643db9fa91eb9d5fcc9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761067318, "uuid": "7edcebd9-d3ca-4c64-b136-1b9e628586a0", "comment": "Malware payload", "value": "fe5c6bd911b03bf08909d21c5db2643c221b0423c90654803823924fb154313dc82df7f6af4729de2d16e0f1f0b6fc9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067318, "uuid": "033d767c-2f04-4073-a393-a4cf20aec949", "value": "T12B751265B5D1E471E5BB463506ACDFF0AA29FDA09E308C97538406BF0B78AD0C932877", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067318, "uuid": "2f8d193d-0b17-4e38-8985-9d83eb0e76e7", "value": "e6ec236ca3c349de850e1a33d65dc13c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067318, "uuid": "6cf218fd-ac3b-42ce-be4a-263911b099d7", "value": "12288:+QO2lggdRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHa:VlFndCN/j2GLl3iFSE33b9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761067318, "uuid": "f8b7d3df-cfca-4410-bca9-7e9cbe4139b6", "value": 1669632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761067318, "uuid": "37f368ee-1daf-4104-9787-1ef26c14cc2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761067318, "uuid": "b7c1cd03-3ed7-4b6b-930f-794e6d1b5570", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d3d1d7-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063974, "uuid": "d5601667-6603-4a32-a21b-7ea82cb42a6a", "comment": "Malware payload", "value": "4e74e8b8b113b5f694bbac0a36387223", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063974, "uuid": "c3a7af47-f595-4b1f-a7d7-1e38fc7090fa", "comment": "Malware payload", "value": "da8085203e56e5d6f894e3b20b3b3de99a8e858893b4115b75425c7101dc5d9a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063974, "uuid": "c6b9c8b6-a982-4f81-817e-54cd7f21a552", "comment": "Malware payload", "value": "50a57c907ecca8c2ba6534ff225f6aaab2f6b23b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063974, "uuid": "84cb2231-e878-4195-bf10-091dbd45f043", "comment": "Malware payload", "value": "a84637dde760bfd7fe3b4db4f0e46e08e872447264edb383f69b359eb3260ab81ee76654a69c2af6b51e61ace5fb04c7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063974, "uuid": "b234925d-ee9b-49a1-a5c5-717972d210e2", "value": "T18CA30841BC1379B8F184782D1E8F507B934EE14FD637E281762EB37540E8D266C968AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063974, "uuid": "3f07e414-b6fd-49c1-ad0e-ee91e7491a4a", "value": "768:GDhd0i7J4sYKgY/CMNfWdmTH88VNPULmSrArXgjQCE1r7noLZ+0rClK/3Rm3PUgt:GDB7eKg20Gr3rIckZ1AdWx6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063974, "uuid": "149d12e2-713f-49d4-b30b-55c4840df1bc", "value": 102014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063974, "uuid": "276d8686-b418-4d12-b4e7-310556e65b44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063974, "uuid": "ec63dfc6-49a1-43a0-9f92-58a7f4e52c91", "value": "invoice-1637482117.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c25125e-ae8e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761058609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761058609, "uuid": "c7ea202d-2cf5-4fa5-97ab-f1b4c6345396", "comment": "Malware payload", "value": "358e54bf814e5c420568c0af8cd13df9", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761058609, "uuid": "904d7d43-f06c-42a7-b7fa-6220e02ef01c", "comment": "Malware payload", "value": "dbdab701feecc382b037b61b4268f1f796c28f3c30d77e18506cb1646bf9cb0b", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761058609, "uuid": "3b075aff-62a4-4fcc-b34a-a68d0b6f3e23", "comment": "Malware payload", "value": "f3a403871eee2abf3d4150c3b0dbd878c8c80c31", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761058609, "uuid": "d35948a2-a050-4203-8bcb-9b3e1d4c4a41", "comment": "Malware payload", "value": "cf4883ade6d66636baea83522cea8986940a4a87e9b14943e75fe61a1371baa4e862411e7199f1f234a25061beb6a2b4", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761058609, "uuid": "8b9a58a5-d998-4f32-b191-1752a998dd5e", "value": "T16475232626F13491D4762BF448F64013AA3274602F79BBBF22D9D2D48F131D2AB31B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761058609, "uuid": "f6f3b583-b359-4d84-9cff-7200b750e1b9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761058609, "uuid": "2cd8760e-f721-4113-bb1e-563510699224", "value": "24576:o93UeGL++iSWT6YKQ6VjlMsFrHa9uavXsNjXcv+QRkv8zUK5aIIVjxGwDMOZq7b:m3dg++2DIdQXsNrcv+/BKqjg4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761058609, "uuid": "1451d5be-9d49-4201-a9fb-d90713f52fef", "value": 1666928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761058609, "uuid": "795da758-774b-45e9-83b2-ff6b4fec79b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761058609, "uuid": "13417fbb-cb81-48d7-b3a7-0ecb603f550a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1750fa1-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761025010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025010, "uuid": "0774a450-2492-4bfb-b84c-b70de2525dc7", "comment": "Malware payload (AgentTesla)", "value": "6739fe5a3a016330aafd256c3d67a230", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025010, "uuid": "4c483cca-386b-41a8-b1f8-ed9ad23684d7", "comment": "Malware payload (AgentTesla)", "value": "dc43977f8132d383b66a76f8c1a98b6514652dca76f6fc77273b46d9d0fd46f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025010, "uuid": "69e799f1-80af-4a6f-84c9-1a932d12b7cd", "comment": "Malware payload (AgentTesla)", "value": "129b27d710038357f47c44a63f7c272487357c70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025010, "uuid": "562ed3c3-a7bb-4ba7-865c-09da139abb59", "comment": "Malware payload (AgentTesla)", "value": "b9160ba6d73fab57cc55a8e5464609169ea831f8d0a16c49e8995ecf26a6be05aa7977a8fa594cc4726a8c886f4632e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025010, "uuid": "8d8ac16e-c7a5-48f3-bb54-0f33e140cc74", "value": "T1665502118AC46FB9CFBC5A1C80FE160EA3B05A8F546A658DFB27BE47AFE740441171D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025010, "uuid": "76e96356-0090-42a4-ba0e-0de40f0d2be2", "value": "24576:ei0cKSKJ52GxeLGYXDIHdDgGuqgnwSwlXgVOOjkp:eVlj3xnH5usaVhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025010, "uuid": "8a69bf7a-b5b7-48bc-83be-3a017b4b8e8f", "value": 1289217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025010, "uuid": "cbc8c1c6-6a9a-42cd-b80f-d0b6f716116e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025010, "uuid": "e51575ff-5839-4000-8a76-583497f0ec8d", "value": "BASE.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43e5bfe-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063965, "uuid": "6dea9717-9fdd-4f45-b9f2-1470ca29482f", "comment": "Malware payload", "value": "f7e2dc176408e2b2d260889ac7543d54", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063965, "uuid": "7125188a-c52d-404d-bb8c-ed83e389656c", "comment": "Malware payload", "value": "dc6cc36a018097096e358bcb0e06c097c48404fc51360e5bb6666aaadc0d86e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063965, "uuid": "00f628d0-1f9c-47e2-8d4a-4a4aee2cc011", "comment": "Malware payload", "value": "3a75e1b03fbb5adc7c6d88ea7a43ce88c6f98ee8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063965, "uuid": "81f979ec-5c91-4e22-9670-2a10d2bd97be", "comment": "Malware payload", "value": "13bd46be9552913a69bb435f13f1a9af25f99c66bf02327f130587d24014b2a45827318c7d4b5fb2ac2e825abdd6a426", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063965, "uuid": "6705123a-000b-4255-ad87-f869870ebdcc", "value": "T158A31BD17D087D3461B8E7F29841B5C6CE0F738416CE055D8F1BB752D9A8EEEA4A20A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063965, "uuid": "78193099-c897-4dc0-957b-ee38ff06dc0f", "value": "768:GDhd0i7J4sYKgY/CMNfWd/HQXpV5LorXqKr24s0AOHuiejqA0ifqpO2SLAuAAroU:GDB7eKg207rDr24/+CAqY26BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063965, "uuid": "21dd89a8-0504-4042-a590-7d0589776bb4", "value": 102721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063965, "uuid": "89520dd6-3725-453e-b171-8809da295874", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063965, "uuid": "17a30900-80fd-4cf5-822f-cc597e852043", "value": "invoice-1637482117.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b6739c-ae40-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761025074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025074, "uuid": "da3de03e-48c4-4014-b3cd-415d9f494a0f", "comment": "Malware payload (Mirai)", "value": "9a7b84fdde49ade974290c5a363f8dda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025074, "uuid": "14ab7a51-9f31-4bc6-9294-0cc52649e028", "comment": "Malware payload (Mirai)", "value": "de6ae61741e7318a490da3b5c11ccce0379b9b39057a31380879545df22f72ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025074, "uuid": "32f1544c-aa49-4656-9246-4dc12ff09e66", "comment": "Malware payload (Mirai)", "value": "518fbf982ce953cd831d0f3befcfb66339c2a5b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025074, "uuid": "e1cc27ad-6ff0-4e22-9183-63176d0681f0", "comment": "Malware payload (Mirai)", "value": "24badbf88b27a17f07d14eb8313539ad50de8e79c31ca0a7c481d3898ebf0dec2aecee3942803a477c3a991203db54b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025074, "uuid": "115ffff3-efc7-4ecc-bf1e-8252ebda398f", "value": "T179730845BC918A5FC6D427BABA6E61CD3351A7E1D3CE3203CD155B25378A24F0E36B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025074, "uuid": "7e8ce776-8bb8-4e28-bdba-0c806dbd2717", "value": "1536:w1+Mn70LwPp+a0LwfNhqtjopSvfz3GLSv9kQV1Zb9ddJB:+pn70wPgnL1kpoT1WG9dTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025074, "uuid": "9e27aeff-dceb-4995-b201-100fbfead0f7", "value": 75412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025074, "uuid": "212f7827-e0e3-4e0e-9d91-d69bec11fb0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025074, "uuid": "923446d2-3704-4fbf-a58d-b4a2924850a3", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22c06bd-ae99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761063532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063532, "uuid": "3babb213-0257-4a29-ac91-1ac44c1326c6", "comment": "Malware payload (Mirai)", "value": "643abf87d42149b039841839b3e23f61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063532, "uuid": "551adce5-e035-473f-8b02-66eb7a65e8b0", "comment": "Malware payload (Mirai)", "value": "df6b16e6d52048e393dcd2f0f38c649ee8b3d6fa1ed9593ac5c0a6653cf33583", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063532, "uuid": "d203e675-3c92-4edd-b321-c30ed50ec2a2", "comment": "Malware payload (Mirai)", "value": "fe1682a81cabb12c9ff6084ad687ae60b34b80fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063532, "uuid": "fca5d085-0cb8-4d11-86d2-1fa97ba037f9", "comment": "Malware payload (Mirai)", "value": "f123d2c324f5602e1743e07e1fa2fb452536ea215f772e9c9a7cbda65f16d9ed7e4854ed4651311f9f860e5a6c17d4a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063532, "uuid": "7cc35565-8759-4400-8ba2-2f09dddea690", "value": "T131D30985BD81AB20D6C615BBFE4F018A33135BACE3EE7213DD144F2427CA95B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063532, "uuid": "44b973bd-2c41-4050-9f95-d7122956954b", "value": "3072:v1afftntVKJmp2CejArrVuiTT55IGax/xEH611a2b/qTDZ/n5gnl:v1af1ntVKJmp2CmAr8iTTvIGaxJEH61B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063532, "uuid": "d4e9189b-38cf-495e-abce-7edcdb63934e", "value": 132592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063532, "uuid": "1baec9db-0320-4934-8834-f0e26a79eb40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063532, "uuid": "8dac4ba4-86d6-43fd-a490-4b18b7b4cc54", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92186cf1-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063934, "uuid": "06ece475-bb08-4db7-940b-bb04a843efe4", "comment": "Malware payload", "value": "436fed52aadde81cbb9b20f05e1882b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063934, "uuid": "2642dbab-86c5-4cfe-a1d8-76ba3b1fadd7", "comment": "Malware payload", "value": "df855f28f79f6867f10f9a479a89ab52ff6640e1e6760fd672bbe1d88fd791c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063934, "uuid": "9fabe86d-0b9a-4b08-80a6-7960aa3ed1ef", "comment": "Malware payload", "value": "e73205b6aa7e5aa96e5f3c48b11f3c3a1a87d7bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063934, "uuid": "38186d27-80df-4459-acc4-b6001d6db957", "comment": "Malware payload", "value": "fd221af4e9204fd4d785e2d1f6798e3873252dcb6ea90d87014af755eb5d8da89626e27d978274292cbde3d93f599fd6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063934, "uuid": "32950f12-31a9-4591-8d66-0b47f3f99857", "value": "T130A30AADCCE784B31817D0146BE2987D9F23C75793161292F2DEB62240CE625E4F94BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063934, "uuid": "ff90ac20-31cc-4189-b8c2-c6475cf10aef", "value": "768:GDhd0i7J4sYKgY/CMNfWdeGpd85RyRBrXCxr/4kRC8RiHhnRgRQRJAcR7RyRA1dG:GDB7eKg20zrEr/4ffvAA7d6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063934, "uuid": "c0c91ce5-fdb0-4772-9b20-408fe97584c3", "value": 104721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063934, "uuid": "64f67bae-7f9a-4a94-a40a-c6a41c966240", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063934, "uuid": "b27bb259-9c80-4921-9251-79c446e10697", "value": "invoice-1637482117.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a30596-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076792, "uuid": "9ed21670-a102-4ff9-a841-b486c9497013", "comment": "Malware payload (Mirai)", "value": "503c8b84dbfa521d57ce4810fea26c6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076792, "uuid": "58780a00-2f29-4cf8-9196-5c45e8dd1cda", "comment": "Malware payload (Mirai)", "value": "dfb44c78bcd47fa939fb593f793cb105b3475e1503248d8f1f1bf801bdc2583a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076792, "uuid": "42079821-338b-4daf-b179-1108e5341d9a", "comment": "Malware payload (Mirai)", "value": "a036164c9d79793072ded25b6f13a424b3c4389e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076792, "uuid": "fa0ce67a-74d1-4bcd-954c-b808ba0ad9ad", "comment": "Malware payload (Mirai)", "value": "851597519aad881e41832aff80401676e1631a9e912efd546cb4ece17fb22c1a45015caf39ce449e16676ebf1031e7a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076792, "uuid": "e39b80a9-797d-44fa-b821-e4eba4e0122e", "value": "T1F004881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076792, "uuid": "5ab9e179-2b34-4ad3-946d-cbfff1118f6f", "value": "3072:jg57RM7LHZwbq1YSBan1yvbysxr1uGSxI:jglRM7LHZ0Bqyy1BSxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076792, "uuid": "c033481a-5377-4ca6-a277-684f02efdc8e", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076792, "uuid": "502376d2-dfef-4691-863a-7f22dc16adb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076792, "uuid": "72d2b806-b03a-498e-9b3a-fddcf5add613", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8fa75b-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076788, "uuid": "4ddbd415-39f8-4426-8743-1134e0f6d335", "comment": "Malware payload (Mirai)", "value": "c729a97324384db4f7a8578be8717b26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076788, "uuid": "0b0a22f9-017f-4e76-9452-e3b29c3fbd66", "comment": "Malware payload (Mirai)", "value": "e1e9a4255ec6453a8183f11e013af49453b78a987dcf6004cae015cc1dabf783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076788, "uuid": "db8e0841-71aa-4570-a736-9ee35d8d75d1", "comment": "Malware payload (Mirai)", "value": "2f911b50aeb923444ea26eda604c1b490e4c54b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076788, "uuid": "05bfead5-89dc-4c9c-b110-c06985519132", "comment": "Malware payload (Mirai)", "value": "0558b4962aee4239b42e021aa36d31aa7b84e5c4d663c7e36755070e741d03edd075dfe2a76bb7016f7acd428b023907", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076788, "uuid": "0850091a-3559-4edd-949d-a11a2e031cec", "value": "T14704D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076788, "uuid": "a23ba2ec-948b-486a-951a-b31948c86391", "value": "3072:ueEksFM+wX5OUaVR8H3NaMZOTTMJxt9U+7fKbvE:ueEnO+wXAVWdaMATwJHy+uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076788, "uuid": "51fab793-abec-487a-99aa-0326f8184e9f", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076788, "uuid": "8c599fee-04d9-44c5-abcf-48782a976ea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076788, "uuid": "862e1ba0-d374-4678-aeba-06949e3807e2", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf80f1a-ae34-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761020117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020117, "uuid": "170d3354-d61c-4a0c-b5c3-a968cc5304f7", "comment": "Malware payload (XWorm)", "value": "371479a8e8e31564ee1d125302bc3e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020117, "uuid": "33027061-5f4c-47d5-a25d-34892b642651", "comment": "Malware payload (XWorm)", "value": "e221562b87dd4aa36fe37f435155b30c1f33ea1095eb28e6475f8bf63ee64f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020117, "uuid": "bc6d6d37-7766-4805-a00e-cd38d698013e", "comment": "Malware payload (XWorm)", "value": "0c18ae2e6d2f76cc01a613c1ef90ca216b653fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020117, "uuid": "597ec3a8-22d0-4983-a1c6-7066b8062f3f", "comment": "Malware payload (XWorm)", "value": "64e82b33e2e08e8fc23b3c98524dbd8385284744a4b9ba2b832857566a19dad08aab7c0f3fc18fee5c581a72bcec4378", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020117, "uuid": "5c2a1bff-e948-4e7a-8f18-59d14d8821e3", "value": "T1AE75BE2479BB5049D977FF623EDCBAEADCEF263268059057104503078A22AD0EF5397E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020117, "uuid": "ca0add6a-b8cd-4974-8af2-28b07aa2eebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020117, "uuid": "50f612c2-98c5-460a-a80a-00ef65292e55", "value": "24576:Yiv95QewQGLa3XTIcVKbqU6WeykWxsfXDk1Ha:D5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020117, "uuid": "7402115f-34e0-4b4a-be85-7c1046b27506", "value": 1661952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020117, "uuid": "c5902fe4-ad64-4f1c-bdaf-e8a4a4c455a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020117, "uuid": "8e1575f7-804c-4568-a7dd-11d1e95b42b8", "value": "371479a8e8e31564ee1d125302bc3e4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcbc48d-ae9f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761066098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066098, "uuid": "71e50948-78a2-44f3-8c84-941482819315", "comment": "Malware payload", "value": "5066ab390b803b2f03294f0ed98989ee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066098, "uuid": "8d637335-60c9-46a7-ae0e-9419c39422af", "comment": "Malware payload", "value": "e297cf8cf745792edec532f9086760b85cd7df356f816b46ec972bddc94e26f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066098, "uuid": "05f376f4-d28c-40ec-b418-3fc5a45a9a62", "comment": "Malware payload", "value": "c1fe05df84053464873530f62a407548cb820b70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761066098, "uuid": "807ffcc1-4370-4c2c-8e16-cba4d1d3da1e", "comment": "Malware payload", "value": "2fef79ac228ae265b344b4f35e6b2c358e6c2180ee468094be78f52627f5e84295d7bfaf44d90c2870e7b41175d680ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066098, "uuid": "2d95f38d-b85e-4563-8885-b8ccb9471818", "value": "T18C566D21FB960EBBD6612231CAFE23CB1324D4001FB7AA975F06793CB87315B9935256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066098, "uuid": "38575ca1-2df6-46cd-a12e-f760ed8529e2", "value": "75edcefce1dc69c1f176ffbb1195633f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066098, "uuid": "8058aca1-4ba5-43a0-a06b-cbc1d823942b", "value": "98304:I2Pvy/liV+c1VUgF3mwjRnI1migKXqmQVidpJlpztT:kYV1bRnjRNjKamuidXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761066098, "uuid": "05c8751a-162e-4d6d-9038-0b1692eff1e8", "value": 6405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761066098, "uuid": "831f3730-f20b-4354-aea6-fda7ddf47f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761066098, "uuid": "366dd813-a3f9-4b14-84bf-d6eb830ea80d", "value": "PeachPuff_4.pfx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c673ce-aea7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761069578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069578, "uuid": "f30b1142-536a-47c3-85d1-acba1f45ae1a", "comment": "Malware payload (Mirai)", "value": "550d64c3baa429bddd5fc8280e18335f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069578, "uuid": "92996a95-b614-497d-b9e0-418a60f60e18", "comment": "Malware payload (Mirai)", "value": "e2f456b27230097b9435fc520e72449f1cdf4b5833018e87b8b95dde92968ead", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069578, "uuid": "bf32073d-cc07-46ab-b0e1-f9d46d6412eb", "comment": "Malware payload (Mirai)", "value": "4720defc8eb9bbfdb38d116467b75112c4a2d736", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069578, "uuid": "435e877d-4381-4445-aed1-e0e7a859b405", "comment": "Malware payload (Mirai)", "value": "c5e73972c6f1c300f579e266ca4729dac57013b35c2aeb6da75db7310a91d67995af58c0190e41123f2badd6887ae826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069578, "uuid": "635df82c-fe0f-40cb-af5d-bfcc7d9b6e8a", "value": "T1C853F149D8FD7000CCAEA2B55CFEB15F5952AD09C8D56BBEEAC720F60E0160C6B1C75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069578, "uuid": "8a390ad7-c895-4e37-9214-e79b6c844974", "value": "1536:cf1rZ568P/RaowVIeYEbr3SQzvwnouy8HyG:cr568XRapZ3r3SUwoutZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761069578, "uuid": "65b19784-30e0-4486-81f6-4d1aeb57d0d7", "value": 60912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761069578, "uuid": "5d3c44e0-f712-42ae-a990-592037750bb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069578, "uuid": "56b2e154-cee6-4c31-b2c3-5ed2e4362c45", "value": "Orbt.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a94b023-aeab-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761071089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071089, "uuid": "5b93f778-34fe-49cc-881c-875f4a3fb59b", "comment": "Malware payload", "value": "bd0f005493cc69d58f823162819fd35a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071089, "uuid": "ebbf8647-dd00-4611-86dc-0ca39ea47a79", "comment": "Malware payload", "value": "e42361cac15cb07432780296f8b3470d78ab47921d70c8466cca8bdcac6d0573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071089, "uuid": "1d44053f-01b7-491a-a1a6-54d344d8f3b1", "comment": "Malware payload", "value": "1016f7a5fed4e82be97b29b83625e7dbef794e69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071089, "uuid": "efaa1d53-5ed4-451b-ad98-6648bd36ce5f", "comment": "Malware payload", "value": "e54902bec6951a594ba56a392eab4497412b545d2ef914e29e55fe000aa46f71bcb85b52b2c158224eba76edce09e3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071089, "uuid": "261d32cd-d8bb-4677-be39-bd0c6181c64e", "value": "T18FD31ADBABA4DD97E901433C05EA8315133EF79087874B132D24BA351A13BD5BED628A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071089, "uuid": "8726857e-6562-4907-8f79-08bdad7fa53f", "value": "610c6ec0dc4926d84ed576af5ca1c96b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071089, "uuid": "d3b73af0-bc5d-49be-887c-04c8b3f0437a", "value": "1536:8Y99pcseyH1manLPXRSVHeWJjTcy05HUvMFMQiNwGREUhLo+j7v:8e9pb1nZS5jTcy05DmRThLoQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761071089, "uuid": "f2f7d30f-5ba0-4c5e-9e01-d71b779a294e", "value": 140369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761071089, "uuid": "95963752-91dc-4d46-beb5-99d895fc084e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071089, "uuid": "ef97aca0-1333-46a0-9c0b-93b2e3088ed8", "value": "SecuriteInfo.com.Trojan.GenericKD.77486897.17886.14162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb779af-ae5e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761038078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761038078, "uuid": "bb29eac9-3552-4411-9780-17cd415dac7a", "comment": "Malware payload", "value": "610b2f86fb1c0e63966434d6ee372067", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761038078, "uuid": "d16ef6c1-0c47-4d81-8b47-d6a5cf784ee8", "comment": "Malware payload", "value": "e667ebfd703d140197205b21039ed1cdf340502e379d59b4ae3f0d9c8a151330", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761038078, "uuid": "dd1d2ca9-76ec-48c5-bdae-29a08f4f22df", "comment": "Malware payload", "value": "6687374a25d4e60463abc446af4c2283e9411b3e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761038078, "uuid": "874dbf04-0944-40d8-8e1f-e8841c0ea285", "comment": "Malware payload", "value": "33f49384aa829dea1327caf8d22df8294821f0f3c5658dbbe0d639de9145cabd93772d401b9f242b66e69eb1dedbdb14", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761038078, "uuid": "dedc7f39-1b66-47c3-b826-1fa086c8a8bf", "value": "T1D0A4236CA9443883E95A18BA744FBBE2145CCFFA5BCB01779D54E2248FDF5D2C932806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761038078, "uuid": "17cfe898-6052-49a7-9295-d4a8a24bfe10", "value": "12288:D+F6jMweGJ7cJu14qqOTQJDKuAU3L9YHC4FZpRDprj:DnYc44uQO36HxbVrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761038078, "uuid": "04110130-b0d5-4882-b696-b972616e2dad", "value": 478432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761038078, "uuid": "51dcf453-beea-4a6c-a5c1-364dc3c2e4a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761038078, "uuid": "c4d4c9af-5211-48ec-a411-20430f834358", "value": "ShaderCache.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a57380e-ae3c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761023388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023388, "uuid": "0ee8be48-b5cf-43fc-88f8-0c9e62f301cf", "comment": "Malware payload (Mirai)", "value": "67de3a9f8d14cc6842cbe445050d0b8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023388, "uuid": "7c7ff9f8-0e0c-48be-9cbb-c999c06933dc", "comment": "Malware payload (Mirai)", "value": "e69b26762aabf5ef04292082f83fe30331c48c4dcd2b51d4693e8c492638371c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023388, "uuid": "2d469b53-875d-4781-9e81-c6ca9ca79f0e", "comment": "Malware payload (Mirai)", "value": "119e6849349f1366251135411d6cf88e0c54fce6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023388, "uuid": "d0baad00-31d3-424b-a020-2b8d3496ae56", "comment": "Malware payload (Mirai)", "value": "01f3278b355a0dfed0cf2e42900c36f0bef4d7225766cceecbe9bdf1e3916b5707d503bce32e10bb01d9826ed34439a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023388, "uuid": "1e5c08f2-8b71-4253-8eb2-4e9d5fdea171", "value": "T18A145AC7F801DDBDF80FE73B0813490AB130B7A254535A377257B96BAD3A1A50927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023388, "uuid": "affc644a-8e98-42ba-98d1-da182a4b580c", "value": "3072:sqKmK7azKLMAR6jtBd1ngbCE0yAHaArXHH6u/Fp2wch9XKVajbi1Lx7SB6xm:7KmgazXARMxyA6ArX6uGwi9X8Lxa6xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023388, "uuid": "b0bb353f-ccab-40db-a61e-e0d3916a40bb", "value": 201440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023388, "uuid": "b724fe77-009a-4168-8215-e9b026b12cf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023388, "uuid": "5f791ccb-b21a-4973-a14d-554dd4acf59e", "value": "Orbt.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c233754d-ae41-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761025790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025790, "uuid": "fb59dfcc-881e-4f13-8763-277bf3e1b1a3", "comment": "Malware payload (XWorm)", "value": "1125dce0ce6d302ad80d60bb280710ef", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025790, "uuid": "7fba5d34-0601-4fd5-a273-47916e1f7ebd", "comment": "Malware payload (XWorm)", "value": "e6d70f45ea2b05bb68eecabd4d752af827e593e8ccd3837177d2acd93337d84d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025790, "uuid": "6396f6a7-291a-47a5-aa41-e6aae9bc3ba3", "comment": "Malware payload (XWorm)", "value": "01c3dd0e4045b728461be815656c8af687fbd056", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025790, "uuid": "b3d357c2-6ea0-474c-9195-b6ca78eb0525", "comment": "Malware payload (XWorm)", "value": "e89c56d872240ad7c963f56edaa88d7b37c6ba0e89a89d0c7ebf60b471d60735b24c85cf1adc5b35dbffd28334c27328", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025790, "uuid": "0027437b-7419-48d2-838c-2f83b13774a0", "value": "T11A419412024E470452F28B3346C45B43D22F634B15594AD973BCA2947FBA5ABEBF524B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025790, "uuid": "557ff133-09e0-4b8e-a278-005790c93809", "value": "48:nUl9xxecZCpclpLRJOfx6CiGnRQw1P3hAW+2yXdVKuw1P3qJ7RObs:UjxZTufxdnK2PTJytVV2PU9O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025790, "uuid": "70012d82-f292-4139-9e58-4489c69994e4", "value": 2013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025790, "uuid": "4b5cc109-cc5e-4e69-b487-c7e83a7f3e8a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025790, "uuid": "97a1ca86-21ae-4822-938a-58b001e62b88", "value": "WDAPNC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665e71c6-ae31-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761018764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018764, "uuid": "9f214922-1c75-4ee4-9c39-6e3dd066e924", "comment": "Malware payload (Mirai)", "value": "45ff1b8e9d8786896f9c0e64f85919b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018764, "uuid": "fc1fb9c3-b537-4aa8-9a4e-69a406e03f93", "comment": "Malware payload (Mirai)", "value": "e753540342084b18a4bc10f6820e214ee76549b0d6c5a2a3d20738199ae89930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018764, "uuid": "cdcded08-115e-4d5f-8623-a6be560c9715", "comment": "Malware payload (Mirai)", "value": "3688311de2350a0454ad53ba9a61c9e407571139", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018764, "uuid": "9dd2f4d8-33ef-4934-b760-912e2af0ddef", "comment": "Malware payload (Mirai)", "value": "efbd989b7ba7bed0f12e98a6642e57ab3d5b1f94da8901871ae5ddf122fc29d321525fce92bd7428effb51e11d279521", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761018764, "uuid": "46dce16b-2838-4d4c-abdd-be3a87f76eb1", "value": "T1C2B32A46F9829F11D5D721FAFB5E414933136BB8E3FA3102DD20AF61238699B0EB7512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761018764, "uuid": "1ef6e96d-b17e-4422-9eb0-e45063298dd7", "value": "3072:2VxLLNHdzca1ajA2x4+ZMCac/ikbGNYa+Ho3:2VfRp1ajA2x4+ZBac/NGWaio3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761018764, "uuid": "9b382fb3-5eed-4673-a7ca-d028ca0c78a7", "value": 115608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761018764, "uuid": "bf8494f4-6750-43fb-96c1-1551158942a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761018764, "uuid": "736a7714-27c0-4ac9-9317-5093b1d83626", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0160e498-ae40-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761025037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025037, "uuid": "fdbca168-b678-462e-bb3c-82bdcb445646", "comment": "Malware payload (XWorm)", "value": "51041c1dc2dd503c70ce6342c2457dc4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025037, "uuid": "fc903c24-a447-4a9a-ad99-3e0ffe876d32", "comment": "Malware payload (XWorm)", "value": "e7c60c0cc05617a16a7178aec3e120731814d2f62810dbea204e16e5f39fb29c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025037, "uuid": "4596e705-c6f1-4dca-922e-4d730106e579", "comment": "Malware payload (XWorm)", "value": "b1ec07ec53fa27a3fc29e90c524817adc0f67609", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761025037, "uuid": "8d264576-0d09-409d-aae4-27ab303d2e1d", "comment": "Malware payload (XWorm)", "value": "fa597f46eb84ed0969110ecc76a9d99d703447e3fad4780d4ee206ad02f1a345a96df8051fddd4f470eaaf73a127c32e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025037, "uuid": "6ea20a90-1e33-4809-bd19-6d0c774c70e4", "value": "T1C2E3203FE560D8C48A2922C9286509453C14179FF7D2CE68B6E6C8F3181677CE77E27A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025037, "uuid": "8ee4910d-eb8c-4e00-87bb-24bd67cc1d18", "value": "1536:fUP1QSiuNVnzVy4M/dceoTvyZ8By8fzmJ4axwu4MG8PJaHVwVDR1E8q3e69x:+nzt0dbiXS+eWQaHV2DR17gb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761025037, "uuid": "c80b22b0-c854-40cd-9354-bae0816cf31e", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761025037, "uuid": "612ad148-67d1-4380-9c97-41bb57448974", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761025037, "uuid": "63b85d3e-cfdd-4e97-bb94-bff1c8c8beac", "value": "shipment document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a08d93-ae27-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1761014674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761014674, "uuid": "bd40097e-9e90-4219-b740-1d387367fe2b", "comment": "Malware payload (GuLoader)", "value": "677b1c6b112b446ebd2b18a736ce0226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761014674, "uuid": "a9c8ed4f-0632-471e-8276-3b486ad525ea", "comment": "Malware payload (GuLoader)", "value": "e7e43cba43e64e576650033a0e60080d6d2b6ba01d1777597188d4285f0a3ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761014674, "uuid": "9c2e9713-72df-48c3-a1a3-f05d8daf880c", "comment": "Malware payload (GuLoader)", "value": "cefca98ed2580cdd750ad1fea02839a3d9da3a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761014674, "uuid": "ee061e45-3eb7-462e-b3f3-e29aa6b96f9c", "comment": "Malware payload (GuLoader)", "value": "55ce4a9f75af51890713e85c807a49f17398b445a166848d0171de7906ea81398ac08e5058fc56e346a52c4cf6577df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761014674, "uuid": "9ea66148-03fe-4692-a1dc-930314e7d0ee", "value": "T17CC42330F724D833FC82557039265FB715B75E389BA88ECB2B443A9D2D37A92056D722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761014674, "uuid": "4bd6757a-6a0d-4d0a-83c7-4eb63b4d7a96", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761014674, "uuid": "58ef5e35-6d64-4ac0-8bd6-3a6aa21a9c3e", "value": "12288:9boe/PB7oDaLwuZIuWLoqCgMeqVMdMA+JLXLIZX26pNjIB0U:9bfPB7saL1IuacNSyBJLMZG6p+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761014674, "uuid": "40cb7e0a-e225-432c-827f-4496be302e82", "value": 560192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761014674, "uuid": "d7e7550a-1af4-4cc7-96a7-0f993351493f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761014674, "uuid": "4d86da34-397e-4599-8702-49dbf1547bf0", "value": "DAC25223608-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51eff14e-ae68-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761042352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042352, "uuid": "9a1c4473-9d58-49d2-994d-2d89250e438f", "comment": "Malware payload", "value": "93f2f4a842a7d3c84f83938a8dece1f3", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042352, "uuid": "4fe9abf0-e8df-4a46-a142-16c97a8223f6", "comment": "Malware payload", "value": "e897b63f343eb091a45bf49e72d0be0f7d6a3c5310a08d9d295e63f67f8c53c0", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042352, "uuid": "aba959f0-ad64-4c40-a067-c2b3f43837a2", "comment": "Malware payload", "value": "930fad959d552760c233c43cb17a80c67d4cf06b", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042352, "uuid": "951d4642-e625-4c13-b521-078309b00a90", "comment": "Malware payload", "value": "7f4d55e30a90aeb64a88380dba33eab9d20e2f60bfe2de22dddf410617feb6d57b6294bbd3ccc410ed50535867b239f9", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042352, "uuid": "1db19a3c-2c56-4162-a6a5-021cc5b0609a", "value": "T1794501A1ED259DD0162CD64A64EE2E0927504B630D083E0E37A563DF0F4F60F79B69AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042352, "uuid": "984e3b9e-c757-4a71-ba16-17b4bd22837a", "value": "24576:cuKDs8NTINNkne2PV5Zl4KoHAN83KTkkcY7f4:cuU7NTc0RN83KIa7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042352, "uuid": "2f4a56ff-3201-4ace-9caa-145c36a8dfa1", "value": 1254717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042352, "uuid": "958fc8c3-a646-42a5-8dca-7e1e9540eee8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042352, "uuid": "02923695-74b7-4791-ba6c-70f437499f9d", "value": "vv.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6da6ac6-ae3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761024992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024992, "uuid": "b6a71e9c-f8bc-44fe-bbe4-b7acad3bd20f", "comment": "Malware payload (Mirai)", "value": "04010dfc704df30fdd1c554ad987a88c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024992, "uuid": "93d61b34-0a3c-4595-b669-920dfe0abc6a", "comment": "Malware payload (Mirai)", "value": "e8b7d1eff5247de8d88eab71d3f49fcce7b8904eae26ba02e16e660d47488615", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024992, "uuid": "b6db0ce8-adbe-4518-af2e-86e8193464ea", "comment": "Malware payload (Mirai)", "value": "92ae7cb09cc190b20da8851aefeef1ce4b0ad900", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761024992, "uuid": "58d02162-f152-40f9-9d16-4c219bfac165", "comment": "Malware payload (Mirai)", "value": "942ef2e8dba61a047be3da174452b141c0c84a3ba175a9b814fbf4ad9a5023f35f4abb80cc86111d0b0fbe43d01d4199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024992, "uuid": "5a7eeccf-8ed3-43d6-a47e-6f325d237b05", "value": "T133E2E194518C5771C92028B6BBAE914796424FB6E3FBF623753C135CE7C1818E5BA283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024992, "uuid": "c9c7ed0a-83ad-4a92-b818-4957c7eb511b", "value": "768:K6jO3euDmMG/pv+jw1qTqgPaZ6RMZ45GX31AD2gzb/q0SQ/Zs3UozW0:pO3haMG/lvsOMa0RiblAD2gzDq0SykzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761024992, "uuid": "8fa7eee4-670e-4ccf-98b5-172752e738d4", "value": 32508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761024992, "uuid": "2e9f02b2-2d9b-445a-8764-19805fa35dcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761024992, "uuid": "54e0288c-69c6-4190-934f-78bf56421618", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d885d24-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076785, "uuid": "66a0cb44-d31a-4afe-8986-e3d4efd7450b", "comment": "Malware payload (Mirai)", "value": "4b3bb009ccb785edc8082e09d01b2198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076785, "uuid": "b82b33fb-3432-493b-a060-e72467779c68", "comment": "Malware payload (Mirai)", "value": "e92cc5c8d46c883c2ae96f343888d3ead0f618638b5e15f61336975576b459ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076785, "uuid": "e7a78fc6-8699-4dcc-a810-10145e3edf75", "comment": "Malware payload (Mirai)", "value": "04a22fdb9ddc5c5a4838eb6db45235f530ac7a20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076785, "uuid": "3068c8fd-fec3-4ff2-bc37-f5fdb0b80099", "comment": "Malware payload (Mirai)", "value": "9f169a0430efb5c1611d9e3712bed00f3d22ff90f01ddb51eeb4bbe7293487c5eccd4c1a21d6d27eb897637f660ea56d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076785, "uuid": "cb3e99bd-f54a-4f19-83be-0b0dcd6f8ee1", "value": "T180D32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076785, "uuid": "eafa960d-0648-4175-b8f9-6d18feb58aa6", "value": "1536:9roGHNTUZN0MIBUiCxfytiteQInJ7abwko7lj0JvAhhHr5+5uQfqIcv7J8:nmmUiCx5t26wN7lDhLv98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076785, "uuid": "638aed0c-cfab-4c2d-b3d2-9dcab8056d95", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076785, "uuid": "fc7ee035-8cf1-454e-8d1e-93a84837f203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076785, "uuid": "d0ae06a8-970d-4a81-a38f-2434a9f165c3", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22507902-aebe-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761079209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079209, "uuid": "b3419803-6187-4eea-9b6a-b46202afbfdb", "comment": "Malware payload", "value": "737d886d618128a99750b9cdc4752070", "object_relation": "md5", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079209, "uuid": "16af7ade-7f51-4b36-acb4-36d5fa96bbb1", "comment": "Malware payload", "value": "ea59efc7c19d01f7f53fea783e07482cf1c1bdfd2dfba585027026e0866c830a", "object_relation": "sha256", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079209, "uuid": "c6e714d5-7ab6-4a15-9102-82298cb9f4e2", "comment": "Malware payload", "value": "91cfb7fd210f82e617b3e2117dc14d8a36a8226d", "object_relation": "sha1", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761079209, "uuid": "67776865-ef95-4809-ae84-0980c2c6c7b8", "comment": "Malware payload", "value": "d779da3b4f13a06eab52a1127570210d0517ee2cd2abc9401893063c6b79ac75292ef1186711c1aa333ae09c351e0580", "object_relation": "sha3-384", "Tag": [ { "name": "Miradore-Oy", "colour": "#98AA0A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079209, "uuid": "711f7896-7ca7-4ab9-8c99-ce6dabdbb010", "value": "T146B4BF017580B331E1AB1B38093796644ABE7D604F71CB4AE778B61D0E706DF9721AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079209, "uuid": "12bd621f-f1ea-4c9a-8338-9e5c4a8a030d", "value": "6144:IArptraBqLlAGXNZXxWaAb8s8K1aVo4uJ+6sai0jR4kQJJOHUUV:7FBaimCHxWbJeSJFsaFR4QHRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761079209, "uuid": "d6b4a786-bff4-4af1-b3d6-42180d709cb6", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761079209, "uuid": "08fcddd7-b750-47f5-9e83-fc2e4f7586bc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761079209, "uuid": "1a49ab8b-1d44-4c16-9d21-6b0d0e6a9669", "value": "Statement.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033d146f-ae4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761029335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761029335, "uuid": "327bf32a-a491-4882-a2ea-422cbeb07571", "comment": "Malware payload (RemcosRAT)", "value": "2c3182f4aa16fd3c249557366ac6de37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761029335, "uuid": "45ecd603-8dd4-4a4e-9dbc-5567e4496755", "comment": "Malware payload (RemcosRAT)", "value": "eb27c96a09f6c81ef8baca23b0024fc1c26dd3c9b2fa0a5b728cb56e1e2425af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761029335, "uuid": "b5536b29-6941-488e-8113-1ad415c20e42", "comment": "Malware payload (RemcosRAT)", "value": "4c6f37929cb4777bd0fab2de73cb868c2453b3be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761029335, "uuid": "60ba8e0b-5388-46ac-b913-aa1b12bfea2b", "comment": "Malware payload (RemcosRAT)", "value": "956627904a22164ee88a56e11c8dcf694c2afb4ff99c27e18c72da5a323df6e1f4f9a985e2be371c51159c732bc71882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761029335, "uuid": "7851c32b-891b-477f-8580-30e069cf2f58", "value": "T1B52512056B1AEF52E8A21BF80D71E37117B4AE5CA815D31B4FD93CDBB4B9F142818A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761029335, "uuid": "5c02b79f-c54a-42b8-b78e-5a02f1aa2a61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761029335, "uuid": "ffbfca3c-b335-480b-9f4b-ed64e51cddf8", "value": "24576:s2f7Nh7ETnPPGaPiP/6FN4g6jPh1ElETc:/f7NCTnPeaPVTp6jf/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761029335, "uuid": "cde0dc70-0db8-493c-96ac-e7249fa925b5", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761029335, "uuid": "24700045-8878-4850-8524-517a0b443bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761029335, "uuid": "1676e7b5-a980-4952-b067-cebe36683e42", "value": "Shipper VGM Declaration Form(CFS).pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56afeded-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063835, "uuid": "65130d8b-4173-49ad-8793-78cd4986f1ea", "comment": "Malware payload", "value": "89e9291dde6fc1847a1477434901d49e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063835, "uuid": "350c69c3-6a59-4395-a82a-17892ed7860a", "comment": "Malware payload", "value": "ed0f7c2b5685b62ba7580316d7081e913b70fea6bd371f9e322ea384aa80ce3b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063835, "uuid": "da8299c5-65e2-446b-934e-a0946495c5fa", "comment": "Malware payload", "value": "7b79e14867556cb8f5859ba72733c35d9061e848", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063835, "uuid": "620ab9fd-53d7-4eb2-8659-e61a5db215cd", "comment": "Malware payload", "value": "2d4783a350dae52286271e14f1a4f2cdd369d028186769c366410df350a4b56390d869fbeb529b6602744b6bd3a52e31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063835, "uuid": "05d3615d-edd4-46fe-a0d0-36dfe35ddf0a", "value": "T126A3090F497DF4E46162AEC95E0628F5C50BADCD089B08CA95CB3729702FB9B0E945F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063835, "uuid": "daa34df3-8fcd-4d3a-9800-e42559219d04", "value": "768:GDhd0i7J4sYKgY/CMNfWdN788jEo4rX8+rcea0Y6HAo41gAS2l8XgXSLAuAAroQD:GDB7eKg20WrRrceTmOAQQX6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063835, "uuid": "74f6985f-5919-4053-8025-8536bb84d223", "value": 98744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063835, "uuid": "7fcebb41-b89c-42a8-b50d-a2823f15dbc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063835, "uuid": "ae57d17a-872e-4bf0-a47c-95d7e8868ed0", "value": "invoice-1637482117.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ebf00e-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761026138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026138, "uuid": "2fd3e105-36c8-4252-a351-8ab055a08156", "comment": "Malware payload (Formbook)", "value": "0012550cab298beda1e0090cbe658904", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026138, "uuid": "886cdccf-71fe-428c-9672-5fd473215371", "comment": "Malware payload (Formbook)", "value": "ee935a34aae49f20a073f4682747ba73ac668b8bdac1457a933915d35827d34d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026138, "uuid": "81c0a55f-a930-4f59-8f42-b282144b4ba6", "comment": "Malware payload (Formbook)", "value": "32c25671a82d8876f1d0caef649e19ef52097354", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026138, "uuid": "588e066d-a679-4bcd-8b63-d20cca0d1e6c", "comment": "Malware payload (Formbook)", "value": "f2a504235ac6d97611e955c661713dd785b425fd3e6b2824fb4304a79518cfda8e2c05bbb54c4ec0ef767a691befd650", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026138, "uuid": "9ab3580c-51ca-4cf9-988b-d7f24e9c1e0a", "value": "T11345CF0273C1D062FFAB95334B5AF6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026138, "uuid": "1adea8fc-255a-4f2e-a80e-2ed441475eee", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026138, "uuid": "62330520-4fb7-40a5-8d1f-088ef642122e", "value": "24576:b5EmXFtKaL4/oFe5T9yyXYfP1ijXda25C10NYFt7US8Kyqjwj:bPVt/LZeJbInQRa25Yj7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026138, "uuid": "461d553c-7838-44d6-a69d-fbb133c8d11a", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026138, "uuid": "5227daaa-9e57-40cc-b44e-63803e18610c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026138, "uuid": "eb3fc2cf-caa0-40de-bf1a-2e64f6e75639", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa31c3a-ae4c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761030314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030314, "uuid": "f5cb51c3-7002-4867-bc35-35d6bd9a2d20", "comment": "Malware payload (Formbook)", "value": "d4eaf721f9a79bf95fa082d5e7c87f06", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030314, "uuid": "ac995ac0-da2d-4df1-b9ed-c3d5b0f8fbc2", "comment": "Malware payload (Formbook)", "value": "efb31c5046593824734c971d4c906b68de23c3e8b2d03e9adf6f5510859b2713", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030314, "uuid": "659138f8-8248-4ac3-b509-47989c396bd5", "comment": "Malware payload (Formbook)", "value": "10c1251cd63c6b0e4cd66e2d7d0c8b4b30c29d73", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761030314, "uuid": "b107a2d7-73ed-4c63-9914-7825ec4a96b2", "comment": "Malware payload (Formbook)", "value": "75f05fd1af9db0befdbc5138e12df4410ba436bd5522be37b55a18c16ab3fde2bcebd5fa1093def20c5efc6bcc8c4d78", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030314, "uuid": "5d157a73-4392-4d52-bb92-fecefe0cc253", "value": "T172E4233692002D5654B2E8B74A63EC05326F34723E61674352EB2767BDC94CE183FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030314, "uuid": "2a6c1698-6657-4bc1-af63-cbd9e79ab415", "value": "12288:cgrzqTsMiFE3Xlkf1d/10jpslG0fAvxuOcln8Hm38XuOXCqd2upjfG:jKwMiyHl0d0jirKxuxln8G3uqqwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761030314, "uuid": "49ca390b-5f29-481e-9907-27ac1ffb6345", "value": 701746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761030314, "uuid": "88181d51-eaa8-46c1-a3b5-4a80c3b04af1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761030314, "uuid": "62daf4b3-12d2-4434-b058-1e1439f34eb6", "value": "PURCHASE ORDER", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abc4d48-ae31-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761018825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018825, "uuid": "fe076e1d-fd09-49f4-a585-1c39b963fd0a", "comment": "Malware payload", "value": "9eb775b4c50973a7c304cdfd59769753", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018825, "uuid": "61c9684a-1cd4-4887-baf8-ec869e4a9311", "comment": "Malware payload", "value": "f2f11c4f28495f04200f2551f558924cb96655296bc7eded0596c79513276020", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018825, "uuid": "ce64173f-d697-492a-b162-bdbf1d052ae2", "comment": "Malware payload", "value": "631d11b4c67eae8e82e524c709f33603cdf16c7b", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761018825, "uuid": "ae6ae2b1-949d-49fc-b242-8c53f67bdc48", "comment": "Malware payload", "value": "b80167a849f2aec779a1bb6b7fb35a4557da43ee2e45a0da145b676df2e972da467b9fabbeb6811d2890414e535ed809", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761018825, "uuid": "13ae617e-9405-4b59-9795-b6c749e45e15", "value": "T160A72347EB1DA42FDCE6B17C4D78026165A76C609342EBE36800B27D6A77BC48F58BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761018825, "uuid": "cdb491de-09bd-4a9d-a4cb-3ec1c383c604", "value": "786432:v9fNtzyTi1Ucnr8y43aL9BhFd9ZB8gBJ2hA045kTMgn:v9Lz31UcQbsBh7TBD2hliaM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761018825, "uuid": "d26fbba4-1382-42e1-b4c1-995784f5b5c2", "value": 44013482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761018825, "uuid": "c3b56f04-c773-49ab-be4f-0c1f3d2c13e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761018825, "uuid": "2d9238d2-8234-4b5f-989b-3324364523e4", "value": "Storage+Cleaner_1.0.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ef1956-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761026116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026116, "uuid": "79d50def-92fe-49d9-b5a2-8b75c62b5f04", "comment": "Malware payload (SnakeKeylogger)", "value": "95f0f1c44d7826d59b97c27b70ea01c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026116, "uuid": "dec77e02-32c9-403e-beb0-635f4ed5ba77", "comment": "Malware payload (SnakeKeylogger)", "value": "f3166e3fdf69423ee28b8540be0446fcb5ea412d27b91b94f11a2df187511697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026116, "uuid": "ea360688-734a-4195-9439-6146940c9a50", "comment": "Malware payload (SnakeKeylogger)", "value": "9e73d645503c5436cc3ae0c87d31abe08378cd4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026116, "uuid": "6ef3d189-f6ee-48d7-8cb2-67b3c958be49", "comment": "Malware payload (SnakeKeylogger)", "value": "6f533582f19aeebb32dddfa30401d36a21d41e1bd4e2b6916330dadde5594e0668567571751ddb4885e3e1908a8f10a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026116, "uuid": "4270529e-504a-4563-97ba-3ed860cb450b", "value": "T150B4134C5B9DCA0ACA6A2FB00E72E57013B1BC9DDA22C50B4FDA1D8F7D7B311451A257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026116, "uuid": "dc358a40-15d7-4b33-9eb8-ee8b4fa18b25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026116, "uuid": "801130a4-50c4-4279-8444-f8ee1810aa16", "value": "12288:aHAZVFM964WEC7M9rZ71+HvsqijA41/EmsOlZOV42wm4CVL:aHAl4w0t1srijA1mNlMV4iV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026116, "uuid": "90813a0c-66ae-48f8-acfc-1018fdf5908c", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026116, "uuid": "7300d9c7-dbff-4035-88ef-e7a6259dc636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026116, "uuid": "844fb941-55cd-47a2-aaf0-7936459b0b55", "value": "REVISED INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e72497-aeab-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761071088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071088, "uuid": "6284aa62-b19b-4f35-81cb-327db0739737", "comment": "Malware payload", "value": "8018fd1709f4e0713fc08434d3f1089f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071088, "uuid": "a6ba4e1b-4a2c-45a1-b6df-fb7c3a199d9f", "comment": "Malware payload", "value": "f32d5835088fd978960ee18c01bb993db084537080d60a550529d02ead34d41f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071088, "uuid": "5e61747d-932d-4a3b-97e3-7e824df0d972", "comment": "Malware payload", "value": "020d844540c8af1d41d7357e44fbc862d9004f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071088, "uuid": "b3d8471e-ee72-4896-b1fb-4f8d36597f72", "comment": "Malware payload", "value": "2aa9fae60fce21be1b32f70acf4c5e89d3a2d550ba52172e99ac9564859ab30ca37d6a72cb57717b848e8ce6b6848cee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071088, "uuid": "81f49f26-a876-4530-b282-55768db52bef", "value": "T108D309DBBB94DD97E911433805EA8329133EF7D087874B132D24AA351A13BD07FD668A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071088, "uuid": "68f4a055-4b56-465a-b3f2-f700cc772a39", "value": "aed23327dc9ad311070498396907e896", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071088, "uuid": "480bf5f0-dc5e-4ccd-bd42-cfbcbaf82673", "value": "1536:Rz2ZYsyygmaYXRMOXeWe3d5JztwUvMFMQiNBRlw57MjK:N2ZscML3d5JztYARm57iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761071088, "uuid": "df3226f1-39a2-46ea-9422-66869e2c69d8", "value": 136804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761071088, "uuid": "63e4d5e4-39f2-4f8c-96c8-445ac4d33d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071088, "uuid": "301c8e4e-7fc8-46d4-a17c-699c4a9b66a3", "value": "SecuriteInfo.com.Win64.MalwareX-gen.49157941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d305d5ca-ae68-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761042568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042568, "uuid": "d04c9b33-e3fe-42e4-aa1e-28fe76a7d84d", "comment": "Malware payload (Mirai)", "value": "1229f4c1d7097e810c62eca274e912ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042568, "uuid": "44f9c31f-8373-4f6b-99ed-e5e05f8d7d15", "comment": "Malware payload (Mirai)", "value": "f35a3e39145d4644971b53a04fb33407bda413851f37e332413a56d9d72cd36e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042568, "uuid": "28e32482-fd44-430b-a5bf-ce473399f20b", "comment": "Malware payload (Mirai)", "value": "171c8d5acd4ccfa2ce94dd001a95f1a0c8ad8873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042568, "uuid": "4875fd38-34a8-42bc-88e9-de56f664c4df", "comment": "Malware payload (Mirai)", "value": "0486db6ef4901259700c6feb98f6cbff4ddf2ffa648ab7c7b62e7979ab7b055adc90095d0870ac3ddbfcc9804cc674a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042568, "uuid": "c5c4c3f8-ab77-4113-a922-651ed72f342c", "value": "T1F8534C96A400DD3CF94EEABAC02A8E15F534F3A856530F17F7AAFC935C71095DC1AA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042568, "uuid": "8f0a7fbe-41bf-4ef5-9d6f-24c1df121998", "value": "1536:5r52tLgzlAahj4LCf68fwXCur8u9nryqO7FFTB5fSVTPZ:5t2tL2QCC8fwXdTnEp9Bs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042568, "uuid": "1aaa1465-b787-455b-86e4-9e6315a8dcb1", "value": 63092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042568, "uuid": "ff905f62-31b7-4606-bd51-8df892821eeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042568, "uuid": "03a77df3-2a26-4960-9034-4abaa86f43b3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69442fb-ae94-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761061419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061419, "uuid": "aae052c3-35aa-4841-973c-23cbc6c3a10f", "comment": "Malware payload", "value": "bd99403616e6a5ed9ce71047792426b4", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061419, "uuid": "926944be-8e76-4b7a-a89c-665fe5d1e274", "comment": "Malware payload", "value": "f368861f942abe03fc7b85f1f390f18ff3a03fd7fd6523de5abace5f925964ad", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061419, "uuid": "5c795f6b-7327-49c4-a8e8-3a2b40387646", "comment": "Malware payload", "value": "de5727b02139891f8584a3607977852fa0971f32", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761061419, "uuid": "5b820b7b-d05c-4a36-82eb-2c474156f66e", "comment": "Malware payload", "value": "27aab9fd221d8c2cacfd82358a40dc667f2758f3cebbfed64f8b4af3f2721f7a25ea994bd5c351c88b1983b8c56b41f1", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061419, "uuid": "e8b74110-912d-4349-965b-e8627af55add", "value": "T1DD57E146F60CD92BC9FAB07CED8B47E77411AC165610C29B2925B20CFEB37D49A127E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061419, "uuid": "03636bc4-bcce-4022-8d49-0030fab4b6b6", "value": "393216:ryOCUeif8ZwBX4BDa5Es6H/qb2qeAPEKw2QxCu3gvv016j+4L1gCa6GQX6:rLCUUy+Deh6SlEKwpFUxML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761061419, "uuid": "8d28a8e8-e685-436c-b03a-d1cee77a8109", "value": 28873079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761061419, "uuid": "0579f25d-4697-4a47-9f3e-5560959951b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761061419, "uuid": "df0da7e4-fcef-406a-84ef-dcc899821500", "value": "Text+Messages_1.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cd606a-aed4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761088777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761088777, "uuid": "265a05f2-64cc-4dbc-aa99-238abb503366", "comment": "Malware payload (Mirai)", "value": "574537401db79367c9f1a52dbcf47504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761088777, "uuid": "8f31fad5-ea74-4808-a4df-fa2573e40405", "comment": "Malware payload (Mirai)", "value": "f3baa51ef1b2c72ac659a49a7b8a044d5fc01c0593bce0633ca30a2d6ab06899", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761088777, "uuid": "1e8a8fe6-088a-4ca3-86c1-1612f6d96931", "comment": "Malware payload (Mirai)", "value": "7f25847064b5a7f09c1ced5270a965b7a9f4494a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761088777, "uuid": "c951d1e6-1c04-46a7-bbdd-6da398e78145", "comment": "Malware payload (Mirai)", "value": "61ac848114066d6d81f385bd703b1264a64b59f298659ec24d2e861b2586cb4d2b28d5048bb7a8d01e9c49277e95708a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761088777, "uuid": "22ff2b4c-05f3-416d-b1d3-39d501c8ab29", "value": "T100630280DE521E60EF99EDF0FDE9A252A9964D93B3A28D4E01546F319E3B502F314CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761088777, "uuid": "db45bb0c-c91a-4f00-936d-9f2f30bc0418", "value": "1536:dbdCTGjYpYQg7m+ifNwSbKJ7ldq0DzU4yJz0IvG5q+BfeMopGZiU34u+qgw09s:dQKjMYl7hiKEE7nq0FyJz0Dk+B/oppUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761088777, "uuid": "82d524f6-5872-4141-883b-bca20189ef82", "value": 68420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761088777, "uuid": "9de9dfda-22f8-4c35-9bbb-2e38354d0ab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761088777, "uuid": "5c791bdc-6b77-4340-9975-f3d1f25f05ce", "value": "Orbt.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99558ed-ae3a-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761022823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022823, "uuid": "d45f0b3a-da1c-40f0-b1c1-c77be436f35a", "comment": "Malware payload (XWorm)", "value": "9ed8305fc43c28718c7826409c5a6f7a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022823, "uuid": "1b03f4be-3537-4498-ba62-357eae20c44b", "comment": "Malware payload (XWorm)", "value": "f3da246accb9e31bdb4e51187dada28e4c71a927c56adea2333fb9625b1bf7f5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022823, "uuid": "51f49fe6-df40-45ac-82e0-f9e1c3289d8b", "comment": "Malware payload (XWorm)", "value": "9988eb260e191258154c7db66da48fc05f2fa0af", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761022823, "uuid": "c25f5c22-f8aa-404b-a11f-d943c1584ef2", "comment": "Malware payload (XWorm)", "value": "782cf66a6240d1adb860459e879290659fb1b3eca4f8ed4e44ab64f751137df6001bd61985956f5652371b172eb840e9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022823, "uuid": "20bf05b8-80a1-4ffa-97c7-ce4cdeca0bde", "value": "T149E3B52CF6A29CDD0759F0E6F0BC2701B0DB8652B17A0915D7BB8866C8FF184B76B158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022823, "uuid": "3c4050df-2c28-4bd5-a0ae-d447e9113323", "value": "3072:X0Swn3+VDh41SanCzswh4clpdlh6N8ONQvgs+QmR:fEOV2MzswhB/dj0NMgs+QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761022823, "uuid": "6bef31dd-2866-4199-ba70-974808fdb11d", "value": 148437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761022823, "uuid": "2bf3e27c-2fdd-4a0b-9a9e-d691a47a449e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761022823, "uuid": "67cfb0e9-a433-4337-afd7-d66d19086b60", "value": "ORDER L-GTW-4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c151e98-ae68-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761042315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042315, "uuid": "03ce4f1f-6404-42e9-9c48-4bcf43b54dff", "comment": "Malware payload", "value": "d974b740f202d46c84d73b88fd80c65f", "object_relation": "md5", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042315, "uuid": "97e9a173-8f21-4f6c-be96-5e0a67993571", "comment": "Malware payload", "value": "f3e1b26712f1f3d7a33d347f03107fe29438f8db21439248c957d0ee871f39dd", "object_relation": "sha256", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042315, "uuid": "fd57dff3-33d8-4bac-b006-4c511a128158", "comment": "Malware payload", "value": "71f1c329d9f4bafcee4cee7a7246752b52995a2b", "object_relation": "sha1", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761042315, "uuid": "10516bdb-f3e9-40d4-b6e4-98813e9c9799", "comment": "Malware payload", "value": "b34ca669001c1814e9180b01c21ba4ede1fed10822986cfea9939f9d8eec7886a2f851bda21111337fc910e196d1193b", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-157-234", "colour": "#738F5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042315, "uuid": "82393d56-e68f-46b6-a4b8-ba857ce34961", "value": "T11AC533612EDE3D7D056C803871AF9B250EA79E892A0CF4D272FCA8D2765FF80116B55C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042315, "uuid": "f4d4a69b-a230-413c-9b05-5d3f8f00e455", "value": "24576:6C+Gt+cqfbj0xg+/YLqgidk72x+2igDenXzlIBQwBOohcfCx6zVSqLdZoiEbDH6E:nnzg+mWLAFnXim0dGaY5SiEbkZ1yBAxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761042315, "uuid": "1bba399e-20f7-499e-947c-331a0ebffb21", "value": 2689192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761042315, "uuid": "0fa28d93-c370-4741-833b-903e40af0de3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761042315, "uuid": "85739ba0-d83b-42ae-9d94-bee42cd6af28", "value": "ttesstttttt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac7d20c-aeaf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761073022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073022, "uuid": "8ed3f7dd-c678-452c-8b3a-8f33874b456c", "comment": "Malware payload", "value": "6c758c2e5bd16364661e5d1a3aed6c5f", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073022, "uuid": "aaa3f5b0-999d-4cea-93e4-2fe439c3893e", "comment": "Malware payload", "value": "f3f3507a1ce9a9df054507d74a0a1f2140d8081541910a1cc6d8a16fe7309602", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073022, "uuid": "3729f20a-edfb-4d4f-8d7c-21e297a2a62d", "comment": "Malware payload", "value": "121b381021260f58ca5826027ec66affee78c997", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761073022, "uuid": "38e28dba-12de-4e63-a6c7-3db8b369e926", "comment": "Malware payload", "value": "fffc67ae3b30b1af6aceb0cfcfeae7be7d3587159fcff8c169de2ac3756c6daf97612897b1481e75480762ea9f8feb87", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073022, "uuid": "ac5ce80f-53bc-4fd7-a792-9889126de821", "value": "T15FC106DB98715B61789E21BAC0404EA79C8D05FF1E4697EC72DF326030ED28999A7D0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073022, "uuid": "e0e01a8b-c153-4aed-abf7-6144813bf2c8", "value": "96:J1TzIy5Mk6q6XOoHzIggU22z2SK0y+T7BxbZzLtA9/cWZswfjGSk6:J5luB+mX5zTaS7BHtAVZsRn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761073022, "uuid": "723624a3-50cc-419a-b4e9-b7d371d31351", "value": 5692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761073022, "uuid": "981c2a18-a46e-47dd-8de8-9990e7d24ed5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761073022, "uuid": "c41808ca-b4e4-47ef-bf92-c04f6fc2550b", "value": "Bright Ocean Order-20101610028-docx.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d02aa5-ae72-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761046519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046519, "uuid": "b9586f76-8ae1-4b9f-9f33-be1fed17e4c6", "comment": "Malware payload (Mirai)", "value": "18c81a27934a520821be8da452586757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046519, "uuid": "6aaf74a1-847d-4e6b-b881-1dd74d7c8a58", "comment": "Malware payload (Mirai)", "value": "f418805f80dba4a8bcf0d11fa4df6b4a09b9558af06c420ba3e34161adb9f957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046519, "uuid": "3e3b0c7d-9260-41aa-addc-851f5053279a", "comment": "Malware payload (Mirai)", "value": "0856592399b382d0256f3d95d4309f01e9b97023", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761046519, "uuid": "aea7095c-bbb5-4137-9f7f-a37891dbe978", "comment": "Malware payload (Mirai)", "value": "5c91a1cb1de2a28a2217c5d8f5fec3035d9d450e9402471d1230eec6e0b9117320c615dfbd69bb9857fd1b43b0a4a3fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046519, "uuid": "3167d7ac-c606-472b-b1e3-65272a9298ce", "value": "T114432AC4E913D8F9DD15093525B7F7B25A75F13A1128EAC3DF95EE22BC02E02B94628C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046519, "uuid": "ba395531-5396-463f-bcab-86525f64fb96", "value": "1536:/wHOySlnuc0BTc7552liGMSiMO2XZag9whBtfw5IGOjJ7TXMRR8:/wuBlnuc+YgVniM7ZpwhB6PON3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761046519, "uuid": "4d60d93c-7c95-4cc7-8ede-3596a6387a91", "value": 57984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761046519, "uuid": "27020ff0-11cc-43b5-884f-4304d01ea037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761046519, "uuid": "09192893-d2c0-4831-9a85-71705e138569", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049d4d2a-aeaf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761072716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761072716, "uuid": "aa238ee8-7603-42e6-9305-38d66cd992d3", "comment": "Malware payload", "value": "2ebc802f41547c512f7d6cc18a9ce7a8", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761072716, "uuid": "c50ce378-8807-43f4-996c-f65b167febc7", "comment": "Malware payload", "value": "f4652e66f32ed97c860b2de39665faa7841f3a22688ad77123101c8bc42d5601", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761072716, "uuid": "5cc4a0d5-2b0c-4bc5-8de8-ea1ed7a65744", "comment": "Malware payload", "value": "17821cc208d2bfdbfcc2112d76c46088d39e9045", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761072716, "uuid": "4e51e55d-170d-477d-9437-b9ce585d7c9f", "comment": "Malware payload", "value": "07da033832f38804852e9ce6f09db7501a9929a7f195ce3a9a22e0f1f551a4ba91b5e16976055915cec38cc41a55bd32", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761072716, "uuid": "bf0153f7-e3f1-4f04-aaa9-d42c951674b7", "value": "T1D82163852489379F8E9B8160D8D742672F55D1A7035F4A5730ECAA537C100FAEAB6CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761072716, "uuid": "0eb3b5d3-bfdf-4b35-b446-26c12de1e699", "value": "24:M5v/lHkAO/72TLfkVyD8YJO5AqL6uSseKwCSMhOop2riDQRz52f51Usn/qoQqzlS:MdVHS2TLkUDXJ0ASTEPCM+0Rzgf5p/qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761072716, "uuid": "2b39c6a8-612e-4280-a9e4-e867e3098264", "value": 1154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761072716, "uuid": "64d264c0-6efe-47df-867d-ced20efa448b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761072716, "uuid": "7e8d1da9-ff5f-4e26-a619-6b995689bd44", "value": "XCRM6JV3DmFJ.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f0471d-ae4f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761031494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031494, "uuid": "b9d5f2ad-4c7c-4f17-aa82-1b60c7292fd2", "comment": "Malware payload (Rhadamanthys)", "value": "10446f8e57c40ddd6591bcad9a6667b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031494, "uuid": "ead7db09-c7c0-453a-b31b-654e3faca010", "comment": "Malware payload (Rhadamanthys)", "value": "f652bad50e466bf2f5e350bc0127e31778d6c057a8d60d0d6ba28a76b6797486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031494, "uuid": "0a7aee5b-d0a4-4025-922a-dd16634044f5", "comment": "Malware payload (Rhadamanthys)", "value": "0218d4ca3a6a7786e4699bd3786a7b9cf553d146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761031494, "uuid": "140d333c-b7b9-48f3-aa71-0c9b0208703c", "comment": "Malware payload (Rhadamanthys)", "value": "3d7864faa80d0ae58e86403f99ab4e6beee08ea0cf12f45d3ea626cd90aa87dde7713510d57f338017ce9c3ad7ddec2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031494, "uuid": "9f65beee-bc71-4933-acbe-7e1e874927a4", "value": "T1F1D34A9BB3F530F8D177853985920A05F772B87657616BEF03A4426A1F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031494, "uuid": "a8078be6-cbd3-4ea6-9808-b9fec7a456c2", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031494, "uuid": "51caa853-98b8-47c6-998d-3bfc0558e1fc", "value": "3072:5v+zxFifIup9RzJ3oZBysYCbpPdVTGbbZPGqWDA:LwQRzJFdCbpnsmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761031494, "uuid": "7950038a-f4eb-4227-a10f-d1ff5e351146", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761031494, "uuid": "0838a84a-49a9-4610-be58-3279f0b0cb7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761031494, "uuid": "d6c95880-cec9-404e-b92e-7f4758c6733f", "value": "SecuriteInfo.com.Trojan.Siggen31.64782.30664.324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ee2a13-ae42-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761026145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026145, "uuid": "2d259b18-3f70-4a08-b271-a8b51ffea455", "comment": "Malware payload (Formbook)", "value": "4f446b9b74c91b6f59ce851ec54c13d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026145, "uuid": "fe3f42d8-8feb-4a87-b983-af34024b90af", "comment": "Malware payload (Formbook)", "value": "f65f249aeadaff0c12cf0ef987831e2e7c18389e17dec1240d008bc26f2371ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026145, "uuid": "71f61beb-369b-4779-acef-7e1ed0d62b8b", "comment": "Malware payload (Formbook)", "value": "f0b15be533479f8335bb20c25b6612c728b9ef34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761026145, "uuid": "86b209ce-b150-4962-9331-8f04cedc6afe", "comment": "Malware payload (Formbook)", "value": "595d3eb324d2e4e5bddcd498c0c973e8e25e92885748977c1a4dd63c67d2903037df649477b819d147eb4fc2bd6dda53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026145, "uuid": "f439f689-e4ca-4009-834f-89e720e60bcd", "value": "T16E45CF1273DDC361C3B25273BA26B741AEBF782506A1F96B2FD4093DE920122525E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026145, "uuid": "6ecdae78-6f71-4826-823a-0a136eb6f691", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026145, "uuid": "66f02f9a-9183-46a0-8e67-6ae43be84ab4", "value": "24576:vtb20pkaCqT5TBWgNQ7algm7kbESttVL6qtFiVmPlEV6A:sVg5tQ7alhQbEatVX0m9w5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761026145, "uuid": "dc671373-c638-4550-b0f9-cceef77f4280", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761026145, "uuid": "a333cdb2-d22f-4fd6-9337-baf26a3ef583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761026145, "uuid": "0dfdbe4d-0c47-4ba6-9a0e-ed81584a5531", "value": "00098765432221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c269b91-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076782, "uuid": "73b25387-a146-436a-a3e6-2dabe1481f1a", "comment": "Malware payload (Mirai)", "value": "b7536dec83037942e91db4f6bfc73d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076782, "uuid": "5bc6ea52-348d-44d3-a72b-450f1778f50d", "comment": "Malware payload (Mirai)", "value": "f76012118f35eecbbd722e22a26ff6f22ebcfa39506813afba586dd42f180d5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076782, "uuid": "47b03de7-5f82-469f-9ace-6b32a5c8273d", "comment": "Malware payload (Mirai)", "value": "682e8c33f1b26af33b756993d40795cfd831ac0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076782, "uuid": "ff3e3e0b-db31-4850-890c-8f35e9dccdd4", "comment": "Malware payload (Mirai)", "value": "ebbf2676895bec897a84168a31c408ece998c7d36086e26bbcd225403d6b3a983dc9d6ef843769b39f8415e4a3aead6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076782, "uuid": "459086a4-6f57-4af9-ab5c-7f3301951b78", "value": "T1B0E329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076782, "uuid": "4facfc8f-0fc3-4a9c-9ccf-dd448a06d7e3", "value": "3072:KmzTDH86Jn78rCdV5jAti2id2ow9+aVvjbitLLxGyMYEmj:K2TDH86J5fjAtiHde9+3L4yMPmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076782, "uuid": "f44e8032-4a88-4ce9-826e-5bd303da8225", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076782, "uuid": "e3d15c2f-d3dd-44c5-a341-7d3f29520a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076782, "uuid": "267f9456-99a5-46b8-af7a-228899c312fc", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61180233-aea7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761069436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069436, "uuid": "0dbea192-9559-4623-b890-fa595ab3c994", "comment": "Malware payload", "value": "2965ddbcd11a08a3ca159af187ef754c", "object_relation": "md5", "Tag": [ { "name": "HIDDENDRIVER", "colour": "#D91034", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069436, "uuid": "f2f555f1-1b68-4444-bfd0-8e31b6d5738f", "comment": "Malware payload", "value": "f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1", "object_relation": "sha256", "Tag": [ { "name": "HIDDENDRIVER", "colour": "#D91034", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069436, "uuid": "a9627b9c-5a9e-4e4c-80f6-315c54ec75dc", "comment": "Malware payload", "value": "1c85aa9f61d92cfb9107b8ec5303ed60990509b1", "object_relation": "sha1", "Tag": [ { "name": "HIDDENDRIVER", "colour": "#D91034", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761069436, "uuid": "5e057cfb-c739-4a24-8998-f7f5ff75a41d", "comment": "Malware payload", "value": "59c7ee6378bb005037cc76aedfb453303b0633165d924ead87ea430ba8b30c91d2cfe4aa7218ffb24fd373d2fd9cbe7f", "object_relation": "sha3-384", "Tag": [ { "name": "HIDDENDRIVER", "colour": "#D91034", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069436, "uuid": "36929427-254b-4c77-8da0-5d48351ae32f", "value": "T192A4E6A3850394FBD9345434CAA787296276A0938762C78B2B59727D7E873C11F32F8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069436, "uuid": "149d02c6-7229-4236-a7e4-8bf5b54ece36", "value": "a14155a11f37dc2513b76efc0538c421", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069436, "uuid": "ca3e981c-a381-43a1-b2eb-94e45a2955ad", "value": "6144:EtU6GoTb7nvjKePpzcOgky5JZH+RzleFeorqrldqMrq0+:KXRH7aOgky8Rzrqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761069436, "uuid": "d21c225f-1c47-4ca6-9077-baad1c3b8c89", "value": 456896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761069436, "uuid": "f7083e85-db64-4b5b-b7a1-900a4e83bacc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761069436, "uuid": "87bc5911-8b83-4f3c-bc96-45b3d6316346", "value": "Winkbj.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afec277-ae3c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761023389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023389, "uuid": "eef915c1-2f43-473d-920c-bac77f631e2c", "comment": "Malware payload (Mirai)", "value": "50c106d950f171f32612f452c9701ec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023389, "uuid": "69db06bb-f0ac-4e63-8b43-b3c9b20a540b", "comment": "Malware payload (Mirai)", "value": "fb8050dc9cf8eb9e7f94b326c64c7155d35779b82f35b6996f8d835052976fce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023389, "uuid": "4b867952-82d9-4a13-ae74-2800e0815943", "comment": "Malware payload (Mirai)", "value": "e74e457f8599762c09d848b16a0e8e11e48ff17d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761023389, "uuid": "f5caee20-8ebe-402a-87d4-c66e8d8e67d9", "comment": "Malware payload (Mirai)", "value": "ef5f9ca9058616cdf14c67dadbfabedee0cce942c7417fa167ada7f4056e5636a7570abf50229eb28f495ae2aab25de7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023389, "uuid": "ea39fc73-a511-404d-b2de-467ee4a7fe33", "value": "T13E63026F0B8EA238D0FA75BB152666E11AB43C3A51DF4B1F0CD0B3682DABB546150653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023389, "uuid": "9f94df0e-3458-45e4-8100-2905f169dc88", "value": "1536:V5D87BMpulz2EUqi7qCRfB7uEckTMqbittvQW/s+CbTpB+qzk//1ei+2lR:V6Gw9SnfcNkIkit1QW0vpBJ4HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761023389, "uuid": "eb560d08-545e-4495-ba4f-540a0e7f4271", "value": 72472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761023389, "uuid": "31a1bbd8-075e-4e5f-8801-b33df54eb617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761023389, "uuid": "a99a9667-db28-414c-b418-1bc3ba377f5c", "value": "Orbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e69f8b-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761064051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064051, "uuid": "a4483b36-58ed-4963-82d7-cd5f2582f0c3", "comment": "Malware payload (Rhadamanthys)", "value": "ea4b9c2f4a431801a36df0e66bc2323c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064051, "uuid": "b0e44252-6faa-4c1d-8e85-0ed558677d1f", "comment": "Malware payload (Rhadamanthys)", "value": "fb9e327c3c9e9418af3b879355fd99e085fa8843f6dbd353f6b8f734c495d610", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064051, "uuid": "8f65ac19-1c14-4304-96a5-7ef1fe07d4b1", "comment": "Malware payload (Rhadamanthys)", "value": "1b7e7fb502c0ccdf7d71b1a5035b6be60c9e6d7b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064051, "uuid": "ca86401f-7d2f-42c2-bcab-757170267bf8", "comment": "Malware payload (Rhadamanthys)", "value": "23c66a81cfcd156e8b559fcc616caa3605773a8cb6e3b3d245df99dd8a4785b11be293f635a0afd107798e43961f13d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064051, "uuid": "f21c2c07-5da4-4b84-967f-6bf9de4d64df", "value": "T184A3090E7E22D8397E89F8181CC53FD27D49236AA507E09B6505F76484F23EE7848BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064051, "uuid": "5c00bbf4-6b55-4058-b2df-8f58cc4ec51e", "value": "1536:GDB7eKg20aXcQerwrAb+pIDypPMAWe/tdu6BkQWJ+aY:GDB7b0TQEeY+6DypPSe/tdu6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064051, "uuid": "92bcb1c6-9bfb-4b59-91be-93819a0dfd53", "value": 106567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064051, "uuid": "33c3bcc3-1cd5-4c3d-b92b-0e4757638c79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064051, "uuid": "437c27f3-1a06-402c-b3c1-4d9644ee0c77", "value": "invoice-1637482117.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435823cb-aebb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761077976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077976, "uuid": "e43aa488-813a-47c6-b50b-329d80c25ee4", "comment": "Malware payload", "value": "d0f7c704362d9020823df00911c1c380", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077976, "uuid": "0a2ccc4e-e182-479e-88f1-52dcd673b219", "comment": "Malware payload", "value": "fbdc91031882f77857e6a5cac1c32a5c5a4571350a905cf9158d912a8b892b3a", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077976, "uuid": "fb9cb3d0-a8a1-4891-8961-83f8002230dc", "comment": "Malware payload", "value": "805f87789985835390b2c162a7c479f343f5de76", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761077976, "uuid": "0d84cea1-280a-45e8-b561-1663921bd3e3", "comment": "Malware payload", "value": "40c0d61eb08675ac674b0a8ecaf50950e1114d36ba736861a92f1a744938147ae09058ab64d61cf41f4fe4e0e59a1d14", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077976, "uuid": "90d2b8c8-1bd1-4001-9fdf-79e619fcd2df", "value": "T150762947F89151A8C1AEE234C6264267BB71BC984B3027D32B50F7B42F36BD46E7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077976, "uuid": "7546bf93-2db7-4323-a7da-365b7277c5b8", "value": "49152:uvlLEyja6vrb/TovO90d7HjmAFd4A64nsfJhA6aj3PUU72ryh3efMEO434uOxI7J:Qa6X/oh30ixILp4E0IlfKHtsqfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761077976, "uuid": "74cadbfe-39ea-44b7-a3e8-25b1f3af5a46", "value": 7545024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761077976, "uuid": "13a49b40-000b-4048-a417-09cc7b8e39e7", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761077976, "uuid": "c72ad16f-eb1d-4cd6-896f-8b4298c82474", "value": "appledamon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab9a4ef-ae35-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761020623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020623, "uuid": "cf836488-f8f4-42bd-85e8-1212b4eb6f1e", "comment": "Malware payload (Mirai)", "value": "a42aa9c5227e35be5373c0a508504e96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020623, "uuid": "303b1be4-bce4-45ae-8fca-701b041e696f", "comment": "Malware payload (Mirai)", "value": "fc6f272ceef93bd72845a1194e1a51c67a59a969784dfa05e0ced98592c74489", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020623, "uuid": "891c6225-9c38-4909-b1b4-0f7ba6514307", "comment": "Malware payload (Mirai)", "value": "2b08ce80b0278905a267fc9d65b43dbc20ae47d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020623, "uuid": "0ce5f140-d064-4dca-884a-8b72f84af39f", "comment": "Malware payload (Mirai)", "value": "b37f87d50031d3a526cd9391337735377b3587c4d23cee6193fd2265a75655f25ce02c8b480a8ecac989592cee81b4c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020623, "uuid": "b3b826b9-74f9-46b1-bbd0-091558faa010", "value": "T1D9142946F8819F62D5D012BAFE1D528E33131B78E2DE32029D246F25778B9AF0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020623, "uuid": "2154565a-2774-48d2-b9a6-0fbee6d4983a", "value": "3072:70OjJWoCJtGjQZdQ5/O/vXuaqGIaTL6QTL1Qq8X630pQ9ok:70gJW5hbyoXuaqjaisQqCu0pQ9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020623, "uuid": "f028b280-62ee-422e-b066-da2501fe9e6a", "value": 197212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020623, "uuid": "74d51d04-51fe-4f34-902a-4c0210d83b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020623, "uuid": "9c8e53b3-4344-4058-9370-e57055af208e", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85de89f-aeb4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1761075273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075273, "uuid": "a860545a-dadf-481e-860d-fe02c3e2fea3", "comment": "Malware payload (Cobalt Strike)", "value": "b8b08247501b27069b40737b04b731e9", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075273, "uuid": "ba50bda5-a2bd-4836-8c07-b7c570ee3347", "comment": "Malware payload (Cobalt Strike)", "value": "fcf2dfb4bbc60cfcf233616f5b995859d233dc46c108bbce16c49dec186e6416", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075273, "uuid": "671c79b7-2654-4878-9138-a84d7abfb75c", "comment": "Malware payload (Cobalt Strike)", "value": "e1dafc8ed515b11f6a7030936393865730920ba8", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761075273, "uuid": "6eb36712-8932-498b-b45f-3351d4f86723", "comment": "Malware payload (Cobalt Strike)", "value": "3143620fc9985b7fb383abd7968524464a49644d6263524ac6cc56ad186f4746681fb545fff657d5fd490166ae4d0f0d", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075273, "uuid": "a1e158ac-28e5-403d-a8ef-1aab9312b09a", "value": "T15596AF12BA8948E9D059C47083469A6359F274FA3B35ADEF02C152283EFF5F46F2CE54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075273, "uuid": "e39a5ab4-09f1-4382-98fe-c910ddaa0b1f", "value": "5f2cde99aadc21ed6041ed4a92ee788e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075273, "uuid": "2d1bde77-2455-47d8-b475-8874cce1f17d", "value": "12288:VGr49y1HpbX6Tu2YHSEH5Mq1TWsjJl3ZEdkQVFyMnPTsBRe1GqdFMi:8rLgu2YHFZMWy4ZEkQVYIgRe1Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761075273, "uuid": "118f8248-2384-4e96-affb-9524698f7ba5", "value": 9447712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761075273, "uuid": "d9c26512-91d5-4a94-8261-69e9d2293529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761075273, "uuid": "82fc39d4-5cc9-4494-9706-9e827fb08ee0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.84731968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ab3c28-ae9c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064605, "uuid": "aa32dd80-6efb-4767-84e3-05c71a73619f", "comment": "Malware payload", "value": "fb7716005a7bd25037436cb0e049333c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064605, "uuid": "07158304-2ead-4b2b-bda4-01d560ba79db", "comment": "Malware payload", "value": "fd2044c14199f00897da27878347d49901379ba4bdc010d1490cac5f91ae0c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064605, "uuid": "0834d4cd-2968-474c-a2dc-087afa387471", "comment": "Malware payload", "value": "6554fe0c391c086de90f0c1460c80d523bd6073b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064605, "uuid": "22fa1551-12d0-44a4-975d-a3eaeaa73241", "comment": "Malware payload", "value": "7f2eea0b85f773d45072ec2dd8d19689f46971ae7903a577cb9d806f2979add3d867d27a0bc679c6bd37a5a27c1011fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064605, "uuid": "ae59aeb6-b6ee-45c4-a4b5-7fc7ee56662c", "value": "T17E547C15B7A509F9F9B7863CCD524906EA72BC5647B0D6CF03900A9A1F376E08E3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064605, "uuid": "a51bc7e5-d407-4c80-9343-90026d829211", "value": "7d42b7268e0e58f0ba9ee0c899426e52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064605, "uuid": "39fbcbb6-37eb-49e2-a777-239c9e02ae42", "value": "3072:EfkduCHx12t4LWPfJAk7Ncvechk3jLgWYaZC4jYIqvqc7x1iPY/YRjdgXrMM57Xk:Efk8ELcMkzMWY6hjYLxYPSvUu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064605, "uuid": "cc6a8035-2ce3-4997-9778-e15c3ec38e95", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064605, "uuid": "90d21e60-f800-4e3e-8542-dcee36713140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064605, "uuid": "70474406-af3d-4010-b2e9-d87df5bf8463", "value": "FilelessDropper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9ead7f-ae9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761063845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063845, "uuid": "fbd8b447-31d3-4999-9637-df21dd155331", "comment": "Malware payload", "value": "23d5c3a7ab15c51835892f79ef689cd2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063845, "uuid": "5a72910b-c3a5-4eab-810f-a910f9379481", "comment": "Malware payload", "value": "fd381956578586130a812bcbbc16101adb4bae1d5e6ad85f9399116a8c30236e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063845, "uuid": "2fa59fb9-da42-4eb8-8b7e-0245d7694cf8", "comment": "Malware payload", "value": "e6a62f3e018d1415389f6ab89e84a13f55e18c9a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761063845, "uuid": "d1f23c0a-65b2-4569-8a20-fd9beb50d680", "comment": "Malware payload", "value": "f714d4d8dd787bc040341536d58aa0d152825c804e6701bba1c79771fc7500b2c0c51ab425e6553123e58dcb87ba7a92", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063845, "uuid": "d7ad261c-6e2d-4ca7-a29b-6adaaaab8ea6", "value": "T127A31A100F953DAD822521843EC972B694382169988E6DD1A6CFFBB7527DF4D3B087D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063845, "uuid": "76ed61dd-9d99-4357-96ac-48ba1b4ca3cd", "value": "768:GDhd0i7J4sYKgY/CMNfWdGhLBCvgirX+JrnT0fIRHhCf7wA8gLwqipSLAuAAroQD:GDB7eKg20xrMrnTKGPAK7p6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761063845, "uuid": "b5131d43-1fe5-4e46-8a2c-31391a433d80", "value": 102041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761063845, "uuid": "899bdbd9-2119-49f1-bf22-8b901f58eefd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761063845, "uuid": "b3307dcf-8f85-45e8-9d0e-afa38767d77b", "value": "invoice-1637482117.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27218ba-ae9b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761064525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064525, "uuid": "1d569179-2c73-4e60-b5f2-51223d51cc86", "comment": "Malware payload", "value": "7b61971c6e0353783d1d0a889e59e0b7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064525, "uuid": "052dd057-d7d8-4f62-8105-60c646812d53", "comment": "Malware payload", "value": "fe436e43d557bcd05c39fae11ba8f51298cb0a15e0976d8a792b0f21a33583e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064525, "uuid": "927fab78-020b-46d1-a31d-0a06d90c1cf6", "comment": "Malware payload", "value": "2f5f6a46c3ad08363d2f7b1245ed920c7cb04cfa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761064525, "uuid": "f1118f21-83de-44a7-8b6a-29f06b69f9a3", "comment": "Malware payload", "value": "f05366abf58999bae25eb5b9b7205e56994aa68fbe8417c2c2a46d07d41eb1b0d6b357f1e4bf73d9ea97a607fd2abc25", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064525, "uuid": "dba1f3dd-b51f-4400-a486-1c37e64c8658", "value": "T16DD4338129C1F51CF0D809B1FE19ED67CD16331B7882CA2067DAADA27869035FF5878E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064525, "uuid": "ecf9c88b-6e53-4ced-8a36-09121586300c", "value": "9b939ccab4b3bc616e91e65c1fe9bd5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064525, "uuid": "8abca976-b2d2-4bfb-bb43-5c7c396fdefe", "value": "12288:aK7oPOG1SplnRjFijjM4ji4Fu0zuK/lGRgOUqmq9kR6lhKXMB3a9FsqJKB57d8f1:R7omnRoj7fuK/cRgOnmq9g6NB36rKX69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761064525, "uuid": "143211ec-bb36-4dc5-8c0b-798de62dd4c7", "value": 647556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761064525, "uuid": "67b76a3c-0e82-41bf-9a4d-5a6b228dae43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761064525, "uuid": "00a78794-0ee1-4935-891a-ba14c835eff7", "value": "ijl111.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80428a74-aeb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761076789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076789, "uuid": "6307f98d-fdf6-4fbd-9b7c-4ff2e52832a5", "comment": "Malware payload (Mirai)", "value": "330cb178686685b90682b647037e711f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076789, "uuid": "f6b0eda6-6fdf-4962-acd9-9c6aad38d7a9", "comment": "Malware payload (Mirai)", "value": "fe7171ef1ebfa4290735d11831b8b14d39948591c01a13d557c65dcf3f596360", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076789, "uuid": "e5e0af42-71cc-4935-b368-e4f7933e3ab0", "comment": "Malware payload (Mirai)", "value": "a493874ad03fed22b849e0b03a768b100bb4d1d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761076789, "uuid": "bd6857fd-16bf-48b5-8279-0003911f0e57", "comment": "Malware payload (Mirai)", "value": "7e65638d6d62cc0ce4bc9823ca45e6212989c82061fe5107cb2a62c140ca8d00b521be6bfa0d03b1ae506294b281d290", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076789, "uuid": "81927d6e-be80-4c80-a85e-5c3f7bf5c2e2", "value": "T178D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076789, "uuid": "12313630-71d5-43f1-a8b0-0f38d30c803e", "value": "3072:79eSuygEPjt6qkWqVdKmDnYMb0gBd/gQyVGsdqml63aj:79eSuygEPjt6qkWqGeH2la3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761076789, "uuid": "a4edb19f-114e-42f8-94de-c1faea2ae740", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761076789, "uuid": "eecb530b-2de5-465b-9e81-832283f6540c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761076789, "uuid": "426113a4-ad62-4412-a716-ec33bc823515", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ac2b10-aead-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761071861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071861, "uuid": "2d0a4f66-8b65-4415-a2b7-70a285fe6e2d", "comment": "Malware payload", "value": "77e5b436790715391582c047446fd274", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071861, "uuid": "7be108a4-9079-459b-a9d5-8b8f5ec0b797", "comment": "Malware payload", "value": "feace2115731df93b5dfb47697387da3e335e5e0d1404e203665ada0cd44db23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071861, "uuid": "ef5b4d3e-6115-4a2c-8f3b-2c1b32619e46", "comment": "Malware payload", "value": "ea3e91e826b2d0020c89da0fc77a317eebebe873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071861, "uuid": "49dba2e6-aa30-46ad-b320-47ca6fe229ec", "comment": "Malware payload", "value": "2dcd27ef9b87dfe64719257948e7d97ffdbd62fc5e9b86181e2ad99a3af495721819d727124aaa4d96bc1a68f08586ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071861, "uuid": "49d351ca-4082-4877-9b92-32676a91f208", "value": "T14F464B83FA625188C479F879829AA573E5A07C6D8131737B7FE04B022F15B60EF1D74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071861, "uuid": "976749df-e2e7-4ba1-a0eb-286686f72850", "value": "49152:ulsovf4vqBC8H2o4at9JFpoZe+9QWXkpRDm8xG+yWhoFq2fGns5Kbh1muuucszeq:TDy46F2kphm3kDho60GdecL2P+4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761071861, "uuid": "285fa773-6ef5-4284-b561-ecf45c698a30", "value": 5397360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761071861, "uuid": "1b778c28-8eb0-4af6-8228-65de5addaca8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071861, "uuid": "9847375a-b1d9-4ef7-8744-7543338f4a2b", "value": "status", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c88294-ae35-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761020486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020486, "uuid": "9b3636c8-3d2d-4fd8-b4d7-8e24dac99ecb", "comment": "Malware payload (Mirai)", "value": "dda156d61b15d0d659a674d05b5bf396", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020486, "uuid": "eff3c177-97f6-4fc9-9596-4fc2edc005ac", "comment": "Malware payload (Mirai)", "value": "ff9c2d0dcb7c4a5b58574473bcc5fae143b4360365b4692e6d4fa59fb2bac44a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020486, "uuid": "0980f741-327e-44ff-ace2-6d5b61f7730b", "comment": "Malware payload (Mirai)", "value": "f94644ea66559323168eb5cecbf6616ded43db30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761020486, "uuid": "98007f0e-8ef3-42f0-bc22-806ccdc56624", "comment": "Malware payload (Mirai)", "value": "ee478946771c92df46ccb9475f0ba7c703827448f2193a8f59a1306e804ae968f239f02a1a7b8cc3d4d92f559c42bde1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020486, "uuid": "e83b56b6-772c-43f9-af6a-7088cd6ccf8d", "value": "T1B913E1A50E5235E7EE5DD03786D5837A3E120F452CE7B04B6990FCE24D1B4317852E97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020486, "uuid": "dfda3c24-43fe-4588-83c6-98d4be1f57b8", "value": "768:ei80oPMtEj04shGyv5PXIXgZ/XFKT1WsiVPvuXw0/AY3ba4JvJgGlzDpbuR1JI:eiCUtE01hfv5PmgZ/Xc1qlu3u4nVJuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761020486, "uuid": "814c7076-3205-4ceb-8779-97bd31c93d7c", "value": 42640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761020486, "uuid": "3fbc91ac-f236-4177-b8ac-3d1eeb6737e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761020486, "uuid": "73d3fe38-9f1c-4386-b551-0a05a59e360c", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ba706d-aeab-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761071086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071086, "uuid": "af7335b8-843d-4380-a9a6-b43d0be1848f", "comment": "Malware payload", "value": "7d6a704764d2caf7736c8fcdf948b0fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071086, "uuid": "d66c4b39-69f8-4ba2-8796-437ae693c5d4", "comment": "Malware payload", "value": "ffbad7beab3e0888d6957637f2ec80156402ad540e9c92ebb243fe27bea1f598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071086, "uuid": "68f12965-85e3-4d50-ba5f-388c5f6fc5a0", "comment": "Malware payload", "value": "2a86881174a3a9411167ba691a19fc2a7b21cb37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761071086, "uuid": "3f1300bc-cb10-47dd-8a3d-200597fda6b4", "comment": "Malware payload", "value": "c67e990ebc14c82ddd24dec06803a6860445604ab4aed244bc85babd3b91ac67b63ba02ed3e5ebc9cc5fa460cc540b11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071086, "uuid": "856fa532-8951-4c8e-9126-9fd3e1c89dbd", "value": "T10FD31ADBBB94DD97D905433805EA8325133EF7D087874B132D24AA351A13BE0BFD629A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071086, "uuid": "f02a0cb9-e75e-4ca3-a37e-731ff8078318", "value": "d6503dcc0b06d883a8984385b29b2cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071086, "uuid": "ee7938b6-7401-4e8b-bc4a-6564dc245f62", "value": "1536:uzG5Rs4yMmarXR4ZjeWDV0d5JztJUvMFMQiNbRkwOet5NkV:EG57R4h0d5JztFCRXOetjkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761071086, "uuid": "2fc1897f-8cc8-4dc8-b2a9-cba57f53f3d1", "value": 135781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761071086, "uuid": "486d47e5-5c3c-4b3b-ad55-12b5286f8964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761071086, "uuid": "697d7f68-4f35-4e0b-b315-23116cb9449a", "value": "SecuriteInfo.com.Win64.MalwareX-gen.18398642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }