{ "Event": { "published": true, "date": "2025-10-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-10-28", "timestamp": 1761696181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a59d4d8c-0925-4a4e-8faa-1d2b8deca3c7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a5cdaf-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1761636505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636505, "uuid": "c50232bf-2ef8-4785-985d-272ba17cb14b", "comment": "Malware payload (DarkCloud)", "value": "6aa7307557e477c0f55830c016803dc1", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636505, "uuid": "39a97ba8-6875-4fc0-b9f0-7303af569451", "comment": "Malware payload (DarkCloud)", "value": "000d2ec0988cfef8ea5f0f7feb80f928c9f21109dcb8f95d5252584d821e402d", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636505, "uuid": "1c40e4ee-e414-408b-a8bc-2bd1fbcff055", "comment": "Malware payload (DarkCloud)", "value": "1afc729c13cda7e8bff118fd00e721fc20ff86b0", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636505, "uuid": "d95e7ead-8152-4282-9c57-40d6499f6b29", "comment": "Malware payload (DarkCloud)", "value": "6bdd2d5b2d1218db1fd93704531a9b24d8d3b25167a227c2202b054e1a39e9ef1c42915e594916ef9815af5946f55c20", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636505, "uuid": "34fda935-75e6-4664-ab96-ed6c41ef6165", "value": "T14155E11D2BC34648C43ADB34DBB2465C07F1A65BC622D36FFA4231ECCA2A74B6511B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636505, "uuid": "03c9e853-b34b-4da9-92b7-6eb711df3466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636505, "uuid": "c1081f4f-70d2-407e-8e76-0e0be888cafd", "value": "24576:+huhCgk+pfb2M/fag0e091EWFgYmEzAogZQzQySXk:O1+pqM/ig0LgWCQA/KVSXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636505, "uuid": "9cd7f0c1-0bf8-4304-9e0d-1271b462b8f6", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636505, "uuid": "4ef3a1ad-df85-47b1-b37a-5ee9125740c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636505, "uuid": "47490b16-9645-48dc-a0d8-29deb504afc1", "value": "CONCILIACI\u00d3N DE PAGOS DE BBVA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb60278-b3b8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761626350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626350, "uuid": "77485d62-1a50-451a-ae62-9cf625ba2bc7", "comment": "Malware payload (Mirai)", "value": "94cb1bf5079fd2cf6b2e690baa41d9d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626350, "uuid": "6c039cf1-2b5a-440a-a4f3-c4086256a954", "comment": "Malware payload (Mirai)", "value": "0018c3a0ebe07eafddadceb7fef8fe50ce6a468fc22df79f7d586d0c96b82499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626350, "uuid": "8b81f0af-1ff2-414d-8b94-d6e8d9ca5719", "comment": "Malware payload (Mirai)", "value": "0e7ae0e22329793153baff8b1c8f32e587eae405", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626350, "uuid": "92413aa6-7201-4a09-b351-1c196ce38033", "comment": "Malware payload (Mirai)", "value": "2538521165e248dd09da56979b9f52e87cd568f764d2c27fdc39ddd17e33781be4ee988cf30c2168ca6cfb10b7a8a3ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626350, "uuid": "020434ba-164b-4bb1-a046-6c2348f37e65", "value": "T150E37D22C964AE98C2258471F021FF796B539E6646C71FBA5EA7CB714043DCCFA047B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626350, "uuid": "30d1648a-c025-4681-9a22-ab53467208ad", "value": "3072:/+mMuMnee0PIKmRJoPsqcuq/niuYOsMAW/wOoDb:/+ZIwRRqcuqa8xJ/KDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761626350, "uuid": "263e0554-c2b2-4fd8-a5be-491a94f87d98", "value": 154756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761626350, "uuid": "8fd41fba-dfc0-46b1-9016-5fadb3381d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626350, "uuid": "79ce4b05-6437-4954-8289-d5ca8cc32041", "value": "Orbt.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7744c3a-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636087, "uuid": "5957714c-b5ad-49d2-b083-bd02f2fe7bbe", "comment": "Malware payload", "value": "437e1dcc15e59c05957222f519b5ab99", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636087, "uuid": "7768aaae-f711-471d-b0f5-714da4f0aaee", "comment": "Malware payload", "value": "00f51b8ba702afced72406d8148dc690a951a8562c622b9e937e3516e9b1f812", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636087, "uuid": "1838127b-5b9a-4bd7-a208-29390d5a975b", "comment": "Malware payload", "value": "6c8a0d861c299b4b1472eaeda453e6c4dcda1034", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636087, "uuid": "ab974677-6273-4a56-bd0c-4183c85d8d75", "comment": "Malware payload", "value": "c40099b94d05b20d3c6b7ba5d04d820330dc968cd27d969b1838e585d1adeb6d15571c15bc28a00532f9c13b697ad640", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636087, "uuid": "3ccdab3f-0b70-417d-b5be-199ab3e73423", "value": "T195352325B585DEA3D742F23888EAD5521629FE80BF4A881B7359772E3534FB801CB14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636087, "uuid": "2efe92dc-b82a-4414-a3d4-f8d5d9aed964", "value": "24576:IOdTQ9q5I2HF7eyPKm6jwhJdx3ye0+mJKaxlNF/DYB3t07ECEA:XtQaI0FSKeKTiM0N10p+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636087, "uuid": "737a385f-fe5a-48b6-8986-40173df87562", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636087, "uuid": "ee607c00-9502-4e06-9af5-91f4a1ebc785", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636087, "uuid": "1c372e79-6da4-4608-9ee2-39ae5a2cd99d", "value": "Swift_280494.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d317d3-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761635815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635815, "uuid": "a67e51a1-26ec-47ce-96fa-e4fc2837743e", "comment": "Malware payload (PhantomStealer)", "value": "1a5c0dd3a2532d5ea1e73dfb60032c88", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635815, "uuid": "a4b3d52b-e66f-4e25-bced-9a779b41dab0", "comment": "Malware payload (PhantomStealer)", "value": "00f7d4ab3d5a7f2679a9e1608c3ffdd7b8d1252fe265f28bc7af7d119ceca881", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635815, "uuid": "99dffb67-e35d-4871-ab1a-29a1c6cf0509", "comment": "Malware payload (PhantomStealer)", "value": "a92fa914989bbfff295193c0cdc5a88a4483eb54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635815, "uuid": "43f78c11-c01b-472a-b8b6-1a9873883727", "comment": "Malware payload (PhantomStealer)", "value": "7bb579414c729140b49fbd88e087c65e5370a6248afe40f74ea75f4df0e07cc96ddf07c0cda6cdd8193e8aced68093cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635815, "uuid": "b22c7a82-384a-4dcb-a023-fd1b604e43e0", "value": "T141255B61DD68075A8E4727EEAD904BA2C56EC209453381F5F2DD0B8E33068ECE37E56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635815, "uuid": "7f93c6ff-a976-4f32-be45-8b601d745a7e", "value": "6144:EfYcyfYmf+fYdfYa4fMfYcZfYFfYFfxpfBfY/fMfYtfYc6f6fYUfYbfjfYiftfYn:Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635815, "uuid": "097dd788-1596-485a-95f5-b3c720439260", "value": 1035690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635815, "uuid": "5d20d7ad-c8ab-42ca-9e0f-b48d7a209782", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635815, "uuid": "ab5b11b7-b93d-49a4-a526-f6fcdf74bc77", "value": "Request for quotation-DEC-00884003430028960866_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a072088-b428-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761674611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674611, "uuid": "38db27f1-b65e-450a-99a6-cf971bba99ae", "comment": "Malware payload", "value": "09fd60288e99c6b693fdeaacb9b291a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674611, "uuid": "437fb259-7673-47fa-8f42-7d8366826839", "comment": "Malware payload", "value": "015e5096b32b61e8feeabba0f087c1ae5b6b8508960e8b142c661c4b3d984c6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674611, "uuid": "7abb2d01-5c77-494d-9db5-c41f71c15ff6", "comment": "Malware payload", "value": "05b7702c3488bd340d622329885c1da8727cdf68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674611, "uuid": "29465d1e-0834-456b-ab25-8be1ebb24aec", "comment": "Malware payload", "value": "dd3170aa13c2cb00c61f3be7812b5c9e9ef1f257c64cc2a3c5d32c50c30aeb77d283320c076760cd128ef200a396719a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674611, "uuid": "1157bdb7-6c99-4c53-a20a-2c79558bdaa4", "value": "T114C3F796B881DB12C6D556BAFE1E41CD33231BB8E3DA3207ED146F2037DA95A0E7E441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674611, "uuid": "4e1aac81-452c-4c21-902c-dbee96c28c37", "value": "3072:9UO/oKhF1kNt01k/FZcQA5F5RUAsXPGm5TI+kpX2gs1an16:OO/oKrCt01k/FqPbHro9pRkpG11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761674611, "uuid": "3a69c2f9-790e-4403-93d9-7f7c1c67d758", "value": 127732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761674611, "uuid": "211f7416-f223-4594-a50c-bbeeb36c1a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674611, "uuid": "f8b77137-7062-4d77-b474-b79d23080a29", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d60653-b409-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761661478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661478, "uuid": "3286dcdd-fb07-4fe5-9838-104a3177d991", "comment": "Malware payload", "value": "98d2f8044bf4a384225003fcd755198b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661478, "uuid": "c344106e-73ef-46f3-a710-f20e3d066dc2", "comment": "Malware payload", "value": "025b27506908417d81a13fcf980003c8e8688486629389460cba0fcc9e569b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661478, "uuid": "89d3d0ba-26ce-46f6-af00-5bc14a923485", "comment": "Malware payload", "value": "b3beb1c6b1e90c67507b279fa7ccf9c78e8a6c54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661478, "uuid": "4f2321ae-e38d-4431-9f19-e7e3e1b06d64", "comment": "Malware payload", "value": "88a3e2c6b347d2f5b7b1d1ca699ef53ceca3e3742ea94edfa4d76b6ec66227a420da9d6f6a1cccfdcf8be2307f553e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661478, "uuid": "4683f37a-ae57-4dcb-ae6d-d2e54ea33d0a", "value": "T131373344F73080A8F36F56345856544CE6EFB099DBBA62AB84F0039B9F13962A50F737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661478, "uuid": "79ebc437-4bd2-4751-aa6b-768a7bdd6dc4", "value": "ce92706925e359aa40f23197a9743843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661478, "uuid": "1c122144-d02d-4b43-96d5-75170f948b29", "value": "393216:MyLPR3QHSmd+PxHj7goYzwk4gsdJCVadpySgmmR9qNzMo8bwfD+kHmsUNJ:MyLu5yHjdqwkpjadESgmm/yDql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761661478, "uuid": "54b0bd16-7d43-4e3c-9d14-ed511f16da93", "value": 22377095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761661478, "uuid": "97e5ac0a-8092-427d-905d-25d32fb22975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661478, "uuid": "701aed70-b7da-496e-b4c1-d8d095496c3a", "value": "HFS_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357f308b-b3b7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625990, "uuid": "8885d199-c9b8-4f66-bd21-7a0839750913", "comment": "Malware payload (Mirai)", "value": "2f2e39641a5c1c0920c0159dbd41e497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625990, "uuid": "868dea0c-c14c-4a72-9640-f128d8bb9ac0", "comment": "Malware payload (Mirai)", "value": "047c07bbfb3a1af86f6f9ecca7f625426b4728d819dba9807f908ef7f135a86b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625990, "uuid": "29cbd31e-3eb6-43de-a8bd-369c888f4575", "comment": "Malware payload (Mirai)", "value": "6b2ec3845d2e54f8af3187f52f6e821ead9fd5a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625990, "uuid": "9a273fdf-ad38-4e11-88b9-4da7116a6d59", "comment": "Malware payload (Mirai)", "value": "b1c64fa266506be382fab0142e7887fdafef1411327a44d543b3072ca77084685af4a64c902e916cdfac1f06ad9396ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625990, "uuid": "b5507171-71a1-40a1-b0b5-46bc8c2fc4dd", "value": "T1A4630A82BCD28A5AC5C062BEA66F659D3361A3F1C2CA3103EC975B1137C715F4F26B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625990, "uuid": "503a6b66-bd65-4883-9093-b4310aadb11f", "value": "1536:kgXnYPFO83a4zD6FZkzvzTEBN/PprlR2R9dSt:zXYPFHL6OvIHI92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625990, "uuid": "92dacb23-5af2-4986-b604-c7c231bab5d3", "value": 71152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625990, "uuid": "0b8c32cd-f793-41d3-ad13-a362b1235e72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625990, "uuid": "8bfc39e4-0a37-4516-8bc1-9b6579c26984", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c36b09-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761640317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640317, "uuid": "1b7753f3-545d-4efd-83cc-e5aee1f17fcd", "comment": "Malware payload (PhantomStealer)", "value": "aa3a8dc8406e4998da963b0401376c8d", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640317, "uuid": "6826e5ab-9b98-4696-8821-e472293a9d66", "comment": "Malware payload (PhantomStealer)", "value": "048b16aa8b4c5fcfddc7609999446ff888f7106e2f4fa106a459fdeb21c81e82", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640317, "uuid": "0660af82-e708-4603-9cf8-fbfc45e00756", "comment": "Malware payload (PhantomStealer)", "value": "7d9ec8c5f8c75b97346517370c9147f84d8d0f9b", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640317, "uuid": "50059aa0-475f-4475-b5db-1cce58a3189a", "comment": "Malware payload (PhantomStealer)", "value": "66ac2f85cc0cd41c539b3d1eeb64593c91de286f7d8d9ca8e4eda090b05699214d65ffe12ab80fd177f9a8445cba6eac", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640317, "uuid": "6e601cd7-0070-496a-ba63-53222cfb8009", "value": "T13C357C2B59018CFD8BDC5692A2BD0D183A696351F222251E1B36A3D5F3033CD7B572BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640317, "uuid": "7cee6c10-e49b-4008-979d-a438d6c1fbb3", "value": "24576:DYnS+hsXiP43kGrsGDfDWzzF6V/s8Oo8lKtq2HmEFHx56kwdOzXuw+ME1c5:AUo3rvKpGQz+UuwC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640317, "uuid": "da2cba5b-42ae-44e8-b4c1-a2755141a45a", "value": 1149208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640317, "uuid": "77ab950c-8821-485a-98ca-5f5ded7bcf35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640317, "uuid": "489841ea-789a-4cfb-8976-113bd0e7277e", "value": "output_1761551725.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad7ac1a-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761646427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646427, "uuid": "2004720e-076d-4a7d-af21-136f35199016", "comment": "Malware payload", "value": "c171723aa6f80bd7941cd7bbc53d5a29", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646427, "uuid": "a5644d56-704b-4277-89e6-978df9c118a0", "comment": "Malware payload", "value": "04bd9658b8d38e25fd13e5af29b458888b09c5eeb16a0391b0dd43d72fd0c349", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646427, "uuid": "432d8f0d-0bd8-40cc-981d-1340e074d0ef", "comment": "Malware payload", "value": "962808c6d16746f757c16310d510b8877f50b781", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646427, "uuid": "079988c6-2e81-4755-9543-9a8314efceaa", "comment": "Malware payload", "value": "e9ab44344fa830084d0312e95efbe37c8be2cebf56792f085444a9df895181856a35b1216b85e2d11f418a043f6fb39b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646427, "uuid": "37c0de88-9747-49fb-9952-53f16b6d8fcf", "value": "T10656F187F798A92FC87710B2897E527115874D028E839B436D58720C6DBBAD43F5EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646427, "uuid": "857f9e49-9881-4445-98f0-b2d5bd5bec2f", "value": "98304:FdPlH5rYEcgLCrSLqaqfPSLGIiHgb5Oq0Q8reT0DAar7oUa67KI6owyf3ifhOq6E:h9YuxyAbk/zrAsJr7oRcKmSkq3RkEh1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646427, "uuid": "759a3221-06e5-4e85-9922-5db40e2d0965", "value": 5939844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646427, "uuid": "bd149e46-f778-44d8-9f45-c51e3b31460a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646427, "uuid": "359a06c7-b6e4-40c3-b187-00f91ba572cf", "value": "toto919.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb41320-b3f0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761650562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650562, "uuid": "d4e21862-ebbd-4d5d-b57e-705721c18014", "comment": "Malware payload (Mirai)", "value": "5b63434f7f4f12113440d2b3941f9ee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650562, "uuid": "85639524-f7fa-4858-bcae-eeeca40008a6", "comment": "Malware payload (Mirai)", "value": "04cda065e61f96b3677847650a16c0702f4618c782e40bee20fa76b8778f88a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650562, "uuid": "3a828125-33dc-4f96-a979-bc1da3cc5965", "comment": "Malware payload (Mirai)", "value": "7647c237cc9a705d99ebf418d1deb20cdfe354ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650562, "uuid": "21deee17-3809-4233-aad3-e2ebdc20c2bf", "comment": "Malware payload (Mirai)", "value": "f45cdf49efdf1bd1b146bc315e539411107c224f67a400297e1950623e31c16a49586fe47e4c69984795415e5764875d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761650562, "uuid": "cda826c8-0c85-4b5f-b7ab-5aca361df031", "value": "T115147120FA0663B1CC721A38A7952E5A6E7B14559FEB26312D1F533CDE228509F31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761650562, "uuid": "9b640d32-4413-42bf-a7d4-4b3a3fd10a24", "value": "3072:LruYQJp+Ey56trhiBhUdkFwnKfKF6OLm0aFAUcs:I+or0lFiUOc3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761650562, "uuid": "4ef0f1c2-074c-4e34-b1d0-6d90685b9a93", "value": 193268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761650562, "uuid": "b6dd726d-7a1e-4720-8291-489cceef35b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761650562, "uuid": "2d033a4d-a63d-4bdf-be7a-6bb0f5b824a4", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59669151-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761639794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639794, "uuid": "e76510fa-0028-4aa7-b222-837871b86392", "comment": "Malware payload", "value": "f1dd5f0dbf3519f56a3f65c846e56e33", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639794, "uuid": "7c5c5b52-0393-4bdc-bd85-c0f6d8963aa2", "comment": "Malware payload", "value": "04e515ff8ac7881aaaf36cba57ee3bc63f9b627226689ebf5dccf566c42a7d42", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639794, "uuid": "f8a4df18-a8bd-41e9-bac5-a618d0c12838", "comment": "Malware payload", "value": "219dab1edc12abface5a1027d7d7db0cdf8ac51c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639794, "uuid": "4dfddb46-f448-40ca-9bcb-401d2ee1ef59", "comment": "Malware payload", "value": "ae9ad75bcb12b00bdf67de422e74cae0cbbd809799f148b5ea65841794c2c3ffcb1779c85dafa8c16a5cbd40076355e8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639794, "uuid": "d6402b33-3bf1-453b-b9f5-a6a72a622d33", "value": "T1C1E512FB94B2A8536B604663EB0F1C1A339B19D53A64D342E94191AC7F3B1D38E91733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639794, "uuid": "00bdddcb-4667-4946-b8b1-f9ffaa8087f0", "value": "49152:1Oc2yD4lTPtvnoJ+1eyOZGwL0tkLLr7OcN60ksoQzdhObv0EkMZmbynwXHRSLz+:1oyEFPxoqJxVk/WcN6OoQzPm8qGywX02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639794, "uuid": "aad9ae0a-a727-41e7-ab6f-4624383801e0", "value": 3093298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639794, "uuid": "de0dacd9-da3f-4a2c-acba-cbb471cc8533", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639794, "uuid": "e33e7c59-a780-4b15-836a-2675a2e50ebc", "value": "Feeder Invoice 9-2025.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8403c7dc-b391-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761609801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609801, "uuid": "4af17619-3fd3-4982-9a1b-1188cfa9a954", "comment": "Malware payload (Mirai)", "value": "b7119c4cd0d1408ede7863a8ae91868c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609801, "uuid": "9ad7592e-fc38-41b0-86c9-88725fbb05bf", "comment": "Malware payload (Mirai)", "value": "051a90032aa8c6a64cbdf57d99120284880336c0d7114bae3ff3e4a8c9579b58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609801, "uuid": "932e7af1-7cb2-471f-ba06-e3b8300045ec", "comment": "Malware payload (Mirai)", "value": "021688919d93e07454bdbda4778a7c9b4792254e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609801, "uuid": "a9ed517b-c079-469f-9a0f-402b60ea8a83", "comment": "Malware payload (Mirai)", "value": "6e80446afc10f860cf446de849325bf447195778a1b130e297f4c72f07757e21647d42c5b2c5f89bada0b6ac97866901", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609801, "uuid": "b7da1b08-0dac-414b-8982-4b6d0ccf67bc", "value": "T1AF148220FA0663B1CC721A38A7992E5A6E7704555FEB26312D1F533CDE628509F31F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609801, "uuid": "c4e625de-2e67-49cf-8829-b596c9b88e77", "value": "3072:ctsVS4xrl7wwhGIwYKOH6RmwnKRidO1Iu+O/UTA:coTLhVwftmREOyz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761609801, "uuid": "4607b95b-e76f-40a1-9bef-7dba815fdfb9", "value": 201460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761609801, "uuid": "547b662a-e6a3-4fa3-8517-422a3b64c4a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609801, "uuid": "659772e1-fdea-4462-b73f-b15cc080e102", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c5b466-b3e9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761647553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647553, "uuid": "3b1ae880-0787-40c3-b7cd-6bd8d56415f5", "comment": "Malware payload", "value": "2286cc07c060874d631897e577202637", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647553, "uuid": "5f82ef9c-9846-455e-899e-f7a9f8f7131c", "comment": "Malware payload", "value": "051af4fe8595363b81bd943260ddbe465554e36303329e88600757c085c8b480", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647553, "uuid": "bbf85c83-43a4-47e4-8f80-0e3d435aab9b", "comment": "Malware payload", "value": "8ff89385695195b72bfa2314c2b408c810d6b524", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647553, "uuid": "bb755689-483b-4aa0-b759-5106f1429dca", "comment": "Malware payload", "value": "e8d5fcbb5faff1f6e797756304c0a34a5232ffa34482d0b5aeb4f97926b95405f31db1a4ec42e4283691c4af83277d67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647553, "uuid": "af839906-5768-4220-8e3a-a355501d692d", "value": "T1254302C08EA9A54EFC872A35E7C3549567FDE2378F860139F948542D452390AD2CEDAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647553, "uuid": "a5e3609e-c72c-4000-a924-1bb640eb7eed", "value": "768:EyhpjQ05v4BebR3NEHv2/Guw/mCbVZ1S+mcWsbDrYg6OCG93I24X9QOAxuh:FW0Hwe/Gd/PVa+mREYil3yNQOAQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647553, "uuid": "97a4c755-3fe0-45f6-b86d-ad77f516994a", "value": 60240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647553, "uuid": "49a99146-b9b5-4c63-9f77-9516a77f5337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647553, "uuid": "6227ce2e-619b-44cc-b718-693df29556f8", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27983224-b3ea-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761647871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647871, "uuid": "97041929-5701-416c-a6b9-b817dd816b05", "comment": "Malware payload", "value": "22d772ca9be10efe596ae143ce60613a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647871, "uuid": "f25337b8-a1a5-4f40-8b13-02d02cacc2ca", "comment": "Malware payload", "value": "061710123a06e34b280d0bb696950692a9cf2c92a54ea997551a9bb3d29ebde4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647871, "uuid": "93af3b03-9445-450f-a489-0f218a5c5673", "comment": "Malware payload", "value": "c1862e0ec25284c8ac394f9d0a9b5ad520e3fbb6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647871, "uuid": "281e1a6a-3dcf-455b-8000-f469c33f69cc", "comment": "Malware payload", "value": "83f23f2f1120023eaf6cbb4ae2942dee250384f9fbf0eefe0b02fcba0f89a37369d17622b3390c0177d9a827c316fbed", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647871, "uuid": "09e6fed3-e898-4467-8c14-6880b9a601bb", "value": "T16B66F1C6F7D8A92FC8775032C57A56F192474C128A83DF536948760C68BBAD84F4AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647871, "uuid": "f466d524-9599-4077-baf9-a97eb23f99b2", "value": "196608:2lZtiTSdtXnJ20soIsRxd/Yw93D+JGSiN:2Fb9JXNYI6JG5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647871, "uuid": "672b3f6b-1441-4936-b247-959adbab6530", "value": 6757621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647871, "uuid": "8438efb5-3bd3-489b-907d-1893ae0f6fa1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647871, "uuid": "86de3f5f-c76c-45ea-bb7e-531153651682", "value": "jonotapay.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e643023-b3fc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761655587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655587, "uuid": "d5539b12-3ed6-46df-b646-19b8b8ec9469", "comment": "Malware payload", "value": "bd4255eb00ec36e690b784f7b8012d02", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655587, "uuid": "c3d85fcd-bee9-4914-8262-75fddae96a25", "comment": "Malware payload", "value": "074e8f95d246535508da84a0c6d8ec13674ef4c5334b2e051f10f8edbd5c7ac9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655587, "uuid": "82c718f6-7115-4269-88ba-0e3c00fd8e81", "comment": "Malware payload", "value": "d844febc8e67b15fedd59ec09d7f1e0303ff38ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655587, "uuid": "a1a736f5-e87a-42f8-bc9a-be12ee6034dc", "comment": "Malware payload", "value": "361e1f559e5e7a3ec99bcf08be2f20b0b7186670e824fee7afce27c2b0e6f3fdc9b2caeb6633ceea5c7daddfd8765a73", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655587, "uuid": "42cf5710-926b-4941-8b3a-8512975f60bc", "value": "T1CB814F8E0644D731D70D8A1EF7F2B1B4910FA283E6EBCF46B954186C0EC5D4CB686E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655587, "uuid": "f81d7efc-9fda-4d19-82db-1da1d652b44f", "value": "48:FS2JMZnbiBxQuZ44cvyZpbwzFhM3OT/TbTKTNTb:FS2JMZnbiBxQuZhpbws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761655587, "uuid": "9d471923-1485-4df0-80ac-75066e3d7acd", "value": 4068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761655587, "uuid": "019be991-2472-4512-b982-3541516b434e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655587, "uuid": "a730c03b-a795-4ac4-9fcd-6c65715a7b04", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797407d6-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620950, "uuid": "cb372c85-6b7b-4cc6-8400-8f430010a3cf", "comment": "Malware payload (Mirai)", "value": "ca713678158e6b4951b2b9b283d59f4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620950, "uuid": "dac41018-f87a-48b6-9c15-05027cf4cf2c", "comment": "Malware payload (Mirai)", "value": "07a9904362e497b93af1da128d38992b33830db96c9b1361e16076998c21a242", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620950, "uuid": "e0ebc652-e8f1-4431-90f3-dd927c3cd615", "comment": "Malware payload (Mirai)", "value": "9f3a6f19bf23d7d27eb188c61d95c25902479c61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620950, "uuid": "5435063d-9954-4356-876b-8b0054cb5c1d", "comment": "Malware payload (Mirai)", "value": "21638c054d38bba34cfe066be7cf005a83fdd7ab7ad32a130fa9188a0ff9c15b0495ac70e601114ff84f990b63958af1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620950, "uuid": "4cc04ecb-a0df-4134-bb0b-e62ef146ea5e", "value": "T128933952FD818A62C6C126B7FB5E028D376613A9E2EE3303AC255F2137C795B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620950, "uuid": "cddc9e87-ae45-4f47-b4ec-8a1c8ed29f12", "value": "1536:qdYEXG1cVM56a9stYn1Us7h3UPNqIDKa9rS5+m/H3hGQz0Oc4g9jq:qdYEXG1kM56avFsqIN1w+mfg+0O3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620950, "uuid": "b2caf26c-407f-4755-9bc3-43b8dc5c54d6", "value": 89844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620950, "uuid": "4504f2ac-5e4a-4b95-883c-4382adbe78a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620950, "uuid": "7b3962a7-6a6a-4eab-b1d3-1eded0de3d23", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c1204f-b3c8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761633552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761633552, "uuid": "ca948a70-b2fe-40d3-ac1c-bb6174d9b111", "comment": "Malware payload", "value": "a26292be90d73b9828fb326a9bc11421", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761633552, "uuid": "50adb0d6-c41d-4122-862b-a2a20a35b8e1", "comment": "Malware payload", "value": "07eae4917983eb8a5dca23be7e75af67b8b2d71e9872962c9b26bb13dc7de9c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761633552, "uuid": "e08f98bb-1e8f-4bbb-aae5-084be28a92a4", "comment": "Malware payload", "value": "1c7eb21a8971e1b963aa43f772b4caffc6ca2caa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761633552, "uuid": "bf1a67c8-65e6-4ade-9ef0-8ad9a93fa8f8", "comment": "Malware payload", "value": "0a5fbc0b62c2ff3729b1791c2baaa76880d8a5717333a7dc76a7d5df6060fba2f133e19727b5955f04533106c2db6dd9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761633552, "uuid": "d9e7b98e-653b-4182-8fa9-2a4fd1326d27", "value": "T135A5384BBCA108A6C4AAD232896691927A71BC050F3163D73E90B73E3F73FE05A75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761633552, "uuid": "b5af2cea-7054-4610-909d-ae3aab25db7c", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761633552, "uuid": "6741dfeb-a664-4ea4-80f5-9cd37719410f", "value": "24576:BWf4px8YtgCs0dim5dRbnAgoRp1Nj/tTCJCWwmegyywwRecE:BRX8Y5s0Umr65LjgkwRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761633552, "uuid": "423e1290-7e9f-45c1-aaf2-94ceb0cc1f43", "value": 2073600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761633552, "uuid": "e542f79b-62e1-497b-b12f-3817a88b3865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761633552, "uuid": "223bd70a-35ea-4291-bfa3-211886c6a0cb", "value": "a26292be90d73b9828fb326a9bc11421.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20abb03-b41a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761668746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668746, "uuid": "099a4200-0feb-4b65-af1d-8fa5a104ad91", "comment": "Malware payload", "value": "531a3712a0f97babf2adb86569b386db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668746, "uuid": "3020fd38-8766-4f01-9e79-b97b2f6fd4fa", "comment": "Malware payload", "value": "087bdfae258aa01cb940ad8a97248ac1b9a7d0742ba61417aace97a042f35285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668746, "uuid": "2f1450e2-bc6f-4527-a467-d06b66fd6b56", "comment": "Malware payload", "value": "cf6e5fa492e433b1afa66326e3d2b28df81e4883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668746, "uuid": "7c6c803f-47b0-49e8-9b10-42daf89f7eee", "comment": "Malware payload", "value": "99d83e63f9beb61a42f0630d8a2de607294dcc71c16fd56ac6a909c92998f64a30c68be561c61482faa29d74fb95e048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668746, "uuid": "d674a149-e5d2-4ef9-872f-792d7d3d3786", "value": "T1AE53027395D1008BFF5FD732256A44C50697DACA842CF4E25A18F4C40F2BA1A1BEED36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668746, "uuid": "258a6fe1-71d9-4ae4-ab7c-0cb56154b2da", "value": "1536:U/8xb4sQ0lK+2VA5z9jS0owPXfG7W6Cir8EZavsaQ+ZAQJ:g6PlK++055W711Fn1QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761668746, "uuid": "a8f5968e-08ee-41cf-b61c-e471e8425668", "value": 62652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761668746, "uuid": "804cefa1-0b41-418a-9f21-ee0ac6112d65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668746, "uuid": "27eb22fe-111c-4404-b3c9-151076fcd59e", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cd0d58-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656622, "uuid": "75c04c4f-2d29-4838-a062-0e5232ff5bfa", "comment": "Malware payload (Rhadamanthys)", "value": "b126cfa13aa2366a5ca5f8821c49b9a2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656622, "uuid": "3e40ca53-21b4-46ad-b740-309d247c779e", "comment": "Malware payload (Rhadamanthys)", "value": "08a7454877562606e21d378bedb6f4705997f060b7f0e1eb7a964921a8d22a8a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656622, "uuid": "9d6e305a-0fc5-480b-905c-73eafac43140", "comment": "Malware payload (Rhadamanthys)", "value": "8737595241388cae98d107ed8ae5e2a6a368f6d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656622, "uuid": "8c40b490-75dd-42b5-afac-d0ffef69eefe", "comment": "Malware payload (Rhadamanthys)", "value": "671fe8e20784a7e2bd5f3e3a2cd07d6a8b71d09465ad5183ff0616d3d54462e0498011ff85df2521fa4ba394e8b65968", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656622, "uuid": "6cf02309-952a-4915-ae4f-83b3bb329c82", "value": "T14BA3EB765F37BC5C12D26BA518C436FBC86996492D0C85C73A4BB760E2A4F473932C8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656622, "uuid": "7afd57cc-c57f-4fce-8bd8-5b12bb666f03", "value": "768:GDhd0i7J4sYKgY/CMNfWdIRsR8RlRLRdR9RvRJR4RGRbRgRlRZRjRNRYRSRoRwRN:GDB7eKg20Xrbruq45XAXQf6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656622, "uuid": "19689720-c331-43ba-90b4-cd7ef2b037bc", "value": 102095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656622, "uuid": "247019eb-c54d-48fc-8bce-1cbee213cee4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656622, "uuid": "02d096d9-11dd-4000-8deb-a6928142e6c8", "value": "invoice-1637482117.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1379e4-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761656735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656735, "uuid": "2b22b8c1-32d1-4880-8e16-257dec864125", "comment": "Malware payload", "value": "44d65109ac349188994e0835a9510b50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656735, "uuid": "373fbf75-9b58-42de-913e-59fbe02b871f", "comment": "Malware payload", "value": "08d130f0a41a0c68dfb746b0b393ffb0b5bfd1f1c9335ab0a2f068260de3a54c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656735, "uuid": "44d3ec3f-f0af-4831-8f7f-dac8ea8836a0", "comment": "Malware payload", "value": "a591d53be799f1fc37b4653b369838d2e3ada354", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656735, "uuid": "3b670b51-8e59-4f9e-ba4a-38dbdb82a7d3", "comment": "Malware payload", "value": "07331c654c08dfa2fece143acfe2c2ef54f8f9cc3253880d95dc56753db5a2ccd1770be014095d8c8428ec5f3e289eb9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656735, "uuid": "9ca72d66-7b73-4bdb-a9ff-0cf2db980efe", "value": "T1F5A3081EDE6B247524E2B15C52AD1BF69C168DE12EA00480FDA5F39217F2F3C2C58DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656735, "uuid": "13809a3d-441b-4cff-87e7-b0d777a916dd", "value": "1536:GDB7eKg20UQQ6MrLr+ew8g7Yc7IAYMLWwf6BkQWJ+aY:GDB7b0RQ6m3JwJ7Yc7wMLWwf6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656735, "uuid": "68ba2fa2-0468-4c1d-8bf6-28875e4b48fe", "value": 102779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656735, "uuid": "3e3f82a9-5c13-4231-b1ce-b0fe211a16e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656735, "uuid": "6ac15bbc-fb08-42e5-b640-57d32a257cad", "value": "invoice-1637482117.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3441b59f-b3f3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761651758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651758, "uuid": "98ccd67e-e99e-4ffd-8225-ccc5f9e13d97", "comment": "Malware payload", "value": "5aa508e1e5b46707b937261b2dbb3e03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651758, "uuid": "e10f49d9-755c-4911-9104-703d3f0e5bad", "comment": "Malware payload", "value": "0939f8e13a0ace644218129571cf2dac582e8f1b15e21d5bb90afc0db0e4d309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651758, "uuid": "f001b8ee-2146-4644-9d63-647ed6046a25", "comment": "Malware payload", "value": "37b1df1b1a5fb8cf7662ea7ae10d10eff0028c92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651758, "uuid": "8e7f8d15-a928-40f2-8153-38eb3cf33a7f", "comment": "Malware payload", "value": "7f3eb1f86a16515ec70ef7c4b1dc3ebd6c958af9f62487eb5731a731c60c12383c699a64a222c1af5746e0343a33a36f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651758, "uuid": "4d826c41-6d08-4b3e-8e57-3c45712132d4", "value": "T18C6302C3254B9074DBFA7C3261639362828BF465E45B13DEBA6BBF400A3DF5C1C885A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651758, "uuid": "1e2797d8-2fb7-43e3-b8b0-89cae25ca93c", "value": "1536:iMrHs0Ejk/KoUhG/OnZ5+n+P8BtWu25fAxk60xtoM2Fs/NS:drHhE8VUNZ5+nS8BsfAoxtGFs/NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761651758, "uuid": "e0e42f3a-c103-4e46-a950-d04c5b0cd0d0", "value": 66776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761651758, "uuid": "d0f6d9b0-eaae-4323-9858-af8898a3e57e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651758, "uuid": "d0823d52-689f-4235-bb0f-b3767c285ea5", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbadcc08-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660172, "uuid": "7956541b-57c0-4384-95ba-38c10c2278ee", "comment": "Malware payload", "value": "9ece58b626cb2036cdc1ff8b2cddbd6e", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660172, "uuid": "89c31ec0-c720-4630-afe0-0f37a40adb34", "comment": "Malware payload", "value": "09c43c5d316dbe800a65e341a42bbd8894d11eb9865f77851f3906035941ff61", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660172, "uuid": "61b0a122-ece5-4cab-9038-faa8faaab3e7", "comment": "Malware payload", "value": "9b5303e6b1352e76c03e8b1eb62f5aae926f4a2a", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660172, "uuid": "0d9af97e-93f9-4dd3-a1e5-64adbf4bbe47", "comment": "Malware payload", "value": "175c17ac9b0edeb63f6153e0d46ec8f954d8b495bb319aeb6a054765c1d9aa839ca8886034fdd1c710818ca3cbd842ee", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660172, "uuid": "fb22ca96-7697-4bc5-9263-ee661ec90311", "value": "T16F2179EA6C7EF2044A8DB1839DF6B61988E45D8ED608A02B427D534C01881D1FFAD08B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660172, "uuid": "98330354-d379-43ca-a77e-398c4b426721", "value": "24:Q9MDF1CdfC5pAydujWtlTUgy7Y6IBhiYW+kIUZ7EdS5KFLeWX9jDsDmbjfMGVtKp:Q9MDF1kf2px4jWzTJAYzBhiYW+kB7Ed+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660172, "uuid": "116c2a45-30cb-4ca6-94d6-e106c009ff6a", "value": 1391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660172, "uuid": "dfb882a8-d9ea-4397-a264-8763c61165ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660172, "uuid": "d1caed8c-9b98-4ad0-93ce-0893783a008f", "value": "svhost.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc1dc12-b442-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761685810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685810, "uuid": "4b9a1070-f88e-4f8f-b752-79305797bd6c", "comment": "Malware payload (Mirai)", "value": "c7808d9f4ac33b9464293c17a797f6c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685810, "uuid": "f2cfa230-2355-444c-8b39-a75c78e60ec0", "comment": "Malware payload (Mirai)", "value": "09ea44ca258ebb667f24f029280a418e9ea9d2041e86674ec5844a5e9beb1ae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685810, "uuid": "b4ef810d-e28b-4564-ac48-6d654b53875b", "comment": "Malware payload (Mirai)", "value": "1d8dff0d990203fded6ce53eafa119a9c34bbe43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685810, "uuid": "85086627-de2c-4fd2-9883-17e427067036", "comment": "Malware payload (Mirai)", "value": "c5d37568439be670cf1fd5b60abdd99058c5c81c4e57fd9667532c2a4f63234391bb6be562325c87a7459718fa9dd765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685810, "uuid": "2be57009-dbb4-4148-8704-f0fb9f8cb4d3", "value": "T10C737C84FBC3D1F2F2A342B1021BE7AA67349D245015EAF5FB0A7B797C72312695A14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685810, "uuid": "aa75f74b-85cd-466c-8928-ce9900705e46", "value": "1536:Pa6YNNwByf6iwHhuLgQOZqwTYIaonDLSI5orrYgO:aEByf6iwHhJXhTZaonDcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761685810, "uuid": "97ceb73c-f315-4703-8695-00038701cdc3", "value": 74968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761685810, "uuid": "e4bcd964-9fa1-4cba-aba0-ca0db8192e9f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685810, "uuid": "8a9b3758-2838-4ce6-8263-27173fe3fe97", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca538797-b3e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761647715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647715, "uuid": "8e0a5e87-ebf4-483e-8f87-cbe88fcdf55a", "comment": "Malware payload (Mirai)", "value": "99a2e44f9abf81df0ba81cd72549e7fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647715, "uuid": "fcfcce9c-dc65-412d-a030-df2e824d0048", "comment": "Malware payload (Mirai)", "value": "0aa226065559f67d52e3b8d8bd82a867a70a0b9be3adc024cf0abbb627e84aae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647715, "uuid": "8661284d-56df-4c93-af8f-ff9a51f84057", "comment": "Malware payload (Mirai)", "value": "98c0459b40b0ebc4991a943e37d9f58d7a71da48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647715, "uuid": "99011904-2dc1-478c-8e8e-bd2ea1505fc7", "comment": "Malware payload (Mirai)", "value": "572e43b44976fa7ec6fd6fb7e193d09f01b6a1a0df4fc84cbea5af869284e85d0e87ca3770e0a469568a2e17ee5c9c2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647715, "uuid": "1e05f772-44ae-4d02-b053-944ffd2e4942", "value": "T1E2A39F8BA5507ABEF0E4993FC4134E26F7109F7005871B2DA5BDF9A06A3E3507292E47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647715, "uuid": "bdab8365-e3d3-4673-ad97-ef1784361108", "value": "1536:Dg37QOF/ks8qBWS0CvSdTdx+9fu9BMPyYSauMZHacg9jTY0Ob0A9pR8rYm:cLQWkFqBW1XmfeBMLpxg9a0AVUYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647715, "uuid": "6eab4432-6cac-48ec-8673-8cc61b4fcd28", "value": 107064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647715, "uuid": "7f0a5ab0-74e2-47ed-b5c9-6682f8541310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647715, "uuid": "7e2b5cd7-2e1b-479e-bd1f-985874549763", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50da468e-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761653953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653953, "uuid": "ce05a842-55a7-4296-bb1e-e5b87aed4dc1", "comment": "Malware payload", "value": "f413c6e80fd5fefa47f8c919fb428427", "object_relation": "md5", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653953, "uuid": "0dcbcfe2-7339-4b4b-9aab-4102f7286980", "comment": "Malware payload", "value": "0aa27437d32e15689e37d2daae90a477207b0c99a86cf7789abe706da79b0eb8", "object_relation": "sha256", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653953, "uuid": "fdc46f1a-7337-4b57-b352-aa017b467e07", "comment": "Malware payload", "value": "1eac578fa241d01c88def1c95f8e0be970ee7b10", "object_relation": "sha1", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653953, "uuid": "a5ebe9a8-dea2-483e-b781-9911bdae7adb", "comment": "Malware payload", "value": "5a37334994c932d0ab07f2260a051c5ef88faff719f8e3d2da6ee2b1a66644c0718738eb60c15b6c76ca19d0668f94ae", "object_relation": "sha3-384", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653953, "uuid": "309dacfc-353a-4e57-9e05-cd2884c348c0", "value": "T123E026949C40CC8819B966699EA6EA18E352106B1052DA443B4CDA531F310064AC6ADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653953, "uuid": "0693e8b2-c5cb-4725-86ef-cdb87e357a9d", "value": "6:q43taYOXHmgEqrhaKB8SFXbHZmLoUAQgK9DFiwMch0MWXfGb:Twt9Eqr8G8+b5m7xMwMCL8Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761653953, "uuid": "813efd11-9a15-4643-8724-60b0c5d7c9e9", "value": 334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761653953, "uuid": "21eabbfa-928b-42b7-8890-26a90a8ce3df", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653953, "uuid": "51b95823-6c4b-4dbb-9b37-e9bf2016db22", "value": "0aa27437d32e15689e37d2daae90a477207b0c99a86cf7789abe706da79b0eb8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed00846-b3d3-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761638193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638193, "uuid": "39a30c6a-0b6b-430f-9977-540b2e347a6f", "comment": "Malware payload (a310Logger)", "value": "28e98fe72f49690119bc5c8d9365e6c4", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638193, "uuid": "9c1af9e5-15d2-45d0-8804-d761a858bfc4", "comment": "Malware payload (a310Logger)", "value": "0ca81580a2ed80ceb0e7dacabf505540acaee2670736174009477c86f2febaac", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638193, "uuid": "c6f292c3-b335-476a-8c32-512bca5b3708", "comment": "Malware payload (a310Logger)", "value": "ef83e8bc20830ca9a7c54613b9cc8d9fec574fca", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638193, "uuid": "f889d04b-779a-4111-992f-8bf8282ecacc", "comment": "Malware payload (a310Logger)", "value": "ae7ff5b98648a046e8cd725321ba0b5e88130210b18953217cd4d7b0e8b10ce686e9159517c502d450823374b540cd9d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638193, "uuid": "21e0f554-5f7e-49a4-a48d-8a4be9ad9859", "value": "T12F55CF027381C062FFAB92734F5AF66157BC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638193, "uuid": "8f31d013-e6bf-4b1f-8dc5-b778b4889d88", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638193, "uuid": "8f03f7f7-88d6-4779-82dd-8e47e6134ca0", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXdagZBDqU92MSlQWdOacPK1AFaUivRvzB:vPVt/LZeJbInQRaglJ2xbcPKqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761638193, "uuid": "016136d1-3344-4dd7-a69c-43548db4b36f", "value": 1353728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761638193, "uuid": "9566d1e5-3a8c-4621-b937-d8d4a8552c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638193, "uuid": "b9bdb925-d7a6-423e-ad42-5cfefd3137d9", "value": "rfq.copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc490f79-b41c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761669703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669703, "uuid": "83a630e1-2f81-454b-8552-acea8913e3c2", "comment": "Malware payload (Mirai)", "value": "6bc32492d12f291d93784269ac9f21de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669703, "uuid": "08a0ddb5-6e36-46e4-92a1-4dd67dcf0307", "comment": "Malware payload (Mirai)", "value": "0d5f90b844bf0664e51af4ab6849902b124a9b358540dc475e12be709ea45e6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669703, "uuid": "01681308-5581-4317-82cb-38868cf99bfb", "comment": "Malware payload (Mirai)", "value": "fd9bbe572840d6f4adf26122b9f32eb74030305b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669703, "uuid": "0e63736a-27c3-4cd1-a4de-bcd878233ded", "comment": "Malware payload (Mirai)", "value": "c59b0172afba075436981cbfe2d71aff124b2f3c0e5a398856ee9b6a797d5967c4e0be8650f9b65313f18465a8df58da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669703, "uuid": "72edc62a-a3fd-41b6-94d4-c455286c009c", "value": "T186A3AF47B5517ABFF4E5AE3FC4134E169625AFB005870B2D61BDF9806E3A3903292E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669703, "uuid": "bff6a425-a3a2-4445-ad70-67ecb3309c7b", "value": "1536:mSzT406z0vxl0GJmg7JbPk3/UXNPYJaZ/NGHtCwXC5OL8wOpmQinV9h8rSm:mSX41z0vxWgpcU9PYYKZC5ZmQORUSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761669703, "uuid": "5a369c05-317d-4bc8-9514-b2228ffd08ee", "value": 106924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761669703, "uuid": "dd545c70-8b1d-412d-bb99-08a882383806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669703, "uuid": "412be347-d473-4c7d-a664-fee6c9e0d05b", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0201778-b3c3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761631457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631457, "uuid": "b994da26-3870-4fc0-ac03-292a43a58b28", "comment": "Malware payload (Mirai)", "value": "1ccbc2cc262420bb333af456e3be941e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631457, "uuid": "3dac24a2-2649-43e5-ba6b-d2b868ba2f67", "comment": "Malware payload (Mirai)", "value": "0d82c11a95b346a400b5a0e83c7f4a71fd0ccee56e66169cf6bfbc86d8d97e5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631457, "uuid": "306efda8-5e69-4aef-b0ed-fd2d8e88fea3", "comment": "Malware payload (Mirai)", "value": "95dfcfbc6cd97735424837a565fa1c361d0c6322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631457, "uuid": "ba07a72a-7346-4b54-946d-36c1b5852f83", "comment": "Malware payload (Mirai)", "value": "3c625d5d018db3c2ef4124e1f48e3a44d1ce5bc72ee1a8bc386c1002fca50032b92c2f9dd7727d7615c78e7d3106a09c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631457, "uuid": "fdc33dc5-cc3b-49ea-979a-e2b52c2a5e3f", "value": "T1D4F3AEA3730F6091C86206F80BCF6B9D262365015EAB9BE76C5E363E5B771DE45023E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631457, "uuid": "80569e52-c8cd-4e68-974e-f7d190a1534d", "value": "3072:fRfeH5yaTdGCSwggEX2wp89AZbGy0tBAKg7C0vZQVEldkq:foHgwrC2j9AtL0DAvCsQV2kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761631457, "uuid": "88e337a3-a124-446e-b54e-8decc0fccf10", "value": 165504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761631457, "uuid": "b48d1d54-aa2a-43ca-a6eb-ce78cc5e025a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631457, "uuid": "bc17916a-5bd2-4d3a-b2ae-831e2270b7d0", "value": "Orbt.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1f26e1-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620951, "uuid": "efa57b7e-1929-4d86-bfbd-0cfa20f376f3", "comment": "Malware payload (Mirai)", "value": "a0a7ee43360734e05915af1787d10c52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620951, "uuid": "9582762e-3179-4e3a-a841-01f69e8e6c0f", "comment": "Malware payload (Mirai)", "value": "0f1503c92beea0c869610e7a579bcdeeaeef80dc4a5cc79fc7e5c90621b07f13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620951, "uuid": "0b39e7a7-6ed4-4b1b-93a0-d95d3366676e", "comment": "Malware payload (Mirai)", "value": "5fa9f3321c791fa755fdc24e023904405e87ef73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620951, "uuid": "8fa36f28-d65a-4f4e-b9ee-a8a00754783a", "comment": "Malware payload (Mirai)", "value": "1c5d6e21a202ec758cfafafee7e5562592f590332139ce6c99edc651794fd2cb8fcab60f51262c5ae0f1db2150b4e544", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620951, "uuid": "7d92b896-20c6-47de-901a-340a8cfc15bf", "value": "T179932852FD814622C6D116B7FB5E428E372713A8E2EE72039C155F2137CB96B0E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620951, "uuid": "aa945c46-989d-4cd7-8bee-107ca7adb7d2", "value": "1536:gFRoWT1FVUq3bUpQ9RAKryKyzdY9Ej5rXS4OZd1K697Nvf++7J:gFKWZFVUe9yKyu6FrX+HDbl7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620951, "uuid": "5eab1ab2-a249-4e75-8c3b-3828787b4674", "value": 93356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620951, "uuid": "8c315202-fdb9-4cd4-a027-e60a5c16ae32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620951, "uuid": "295a8e95-de47-48b1-8ecf-cf8ad7c37fd5", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92d9ccb-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761634855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634855, "uuid": "0c89fd20-3130-4b15-8268-2c02d3954b9b", "comment": "Malware payload (RemcosRAT)", "value": "8a55a067def2f95ef26af7b10467ccfb", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634855, "uuid": "4a6987f8-15c7-4a24-9d40-92edbe2ada54", "comment": "Malware payload (RemcosRAT)", "value": "0f40f4b11e4ef78043b6fb6f0266055e6cdad9b6710c4093e5404fdb7beeda22", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634855, "uuid": "7b6cd7e7-0c1a-4ece-9eb4-9ecaf509bfd0", "comment": "Malware payload (RemcosRAT)", "value": "1ea9ce6e473d0061b385ad5975f6d2f4d837fc9f", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634855, "uuid": "d49780f3-a499-4162-bf2b-484c3e3a8190", "comment": "Malware payload (RemcosRAT)", "value": "6ffdf21a016ffca1df2faa9c529be66ce02a1065f0d37dceae66f827d7d04ce92a053204e2d4cb727cb7520a4dd84d09", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634855, "uuid": "1aac7910-3559-4bf1-99ef-87eb841ce378", "value": "T145C5CF5D94B05C926024FE74AAC5F793CCEA17851A174B920FE5E2A67202C43FF7B362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634855, "uuid": "8ff42d5f-7196-4b0d-b4a3-c26d31bf7e71", "value": "24576:tzIvbUO5H1J+d3mbJwx6DXOzRlDznsGrAEW0r5P1/DE1kJ6UaMIQkBL:uH0it", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634855, "uuid": "44773232-19a8-4650-80e2-3f82ae0fbcac", "value": 2681070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634855, "uuid": "1a87a752-ab56-4b12-9ccd-9fe51cfd4833", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634855, "uuid": "715f6e8f-1de0-43f9-8170-3e034d8fd62a", "value": "Specification and Drawing_JPEG File.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339c5049-b442-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761685687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685687, "uuid": "1076eb72-bf70-4766-90a9-58bcedae3162", "comment": "Malware payload (Mirai)", "value": "83012200f92369eb3d8f71d02ca8b5d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685687, "uuid": "9f221b46-5b51-4f31-982d-f098b1052c8d", "comment": "Malware payload (Mirai)", "value": "0f80a79da89e99d18a78946ace4734a40fb07008a9fd7f8cc77658e30b038388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685687, "uuid": "2562ee4a-18d2-4e94-97aa-27f6311ac813", "comment": "Malware payload (Mirai)", "value": "fbf21d67f0f5e466f25fdd0224615a611fb6ba3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685687, "uuid": "4957d50c-30b5-475b-b91c-54a137d5b7a7", "comment": "Malware payload (Mirai)", "value": "2219012a56c2384959dfe6a45ce7273788b6af595fd3b0ff53a967e1e54d73b5a29216e01d6a8fc144b010e909953727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685687, "uuid": "9f8622b2-d06d-470e-8e98-7e068c6cf9dd", "value": "T1CB630855F890CA22C6D5267AFA5D428D33231F78C2DD7206DD24AB3537FB9560F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685687, "uuid": "e9ab9270-8287-43ec-9c3a-473eb298e8ba", "value": "1536:PPeLRJPws9h+0F1MObDlZeIONzII2aULmOg911Ir6:PkIs91bDb6NjRPA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761685687, "uuid": "a0ce3e5e-54e8-466f-82e1-1c7ab4b772b2", "value": 70904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761685687, "uuid": "e84f11d5-5707-4cb3-8b91-a0b787281d38", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685687, "uuid": "d0554b27-0733-4f67-aee3-a8e8d34c9537", "value": "frost.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62c49aa-b3fa-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761654982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654982, "uuid": "68710395-1e45-411e-81d7-c91a8ed625a5", "comment": "Malware payload (Formbook)", "value": "e91e5df72e242e36101c2831afb33bca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654982, "uuid": "30ba2506-9ab5-45e9-a328-e6de60303d8f", "comment": "Malware payload (Formbook)", "value": "0fdc777e2317f52e7b8313ab65b1834798e30eec5f83f63598a15aef329bef9e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654982, "uuid": "c713c7b2-d68b-4781-82c8-0b9011867b28", "comment": "Malware payload (Formbook)", "value": "a84c9e52f5bc797095302d1980ed29b2864e8d1f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654982, "uuid": "8089a4d3-18ba-4378-a852-eccf8d993016", "comment": "Malware payload (Formbook)", "value": "5170986865fdb6dd373b3d9dbe5af9aa0b8e5cf9a39f9d7e83c70cebf0e1ee180845c74ba90fb0dd5d1e484b234fddea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654982, "uuid": "026a816f-4a6f-4880-88a5-5755a4ed477c", "value": "T16FE42354696AF76F68860F78434FA423B1740B1576046A1E7E7B3FB03A2FCB058D0A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654982, "uuid": "3dd2c06f-4514-4f63-83b3-8997d9a7e596", "value": "12288:vQf5iMXsDQyG6yncTuJ8KXi1WO9eUdp39397lB7ZaBT1sTL:s7XY1yc6JpXi1W4/HL2KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654982, "uuid": "9cd022cb-302c-4b7e-86b6-411eaa76a599", "value": 684811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654982, "uuid": "07bc38cb-13c0-4666-8bb0-ba4e240928fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654982, "uuid": "c549db2d-5421-4206-8da6-d12116ab927b", "value": "y6JpZX20JbOHoJQ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97f49fe-b422-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761672168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672168, "uuid": "321436ee-a42b-4d39-ac6b-7c141d907d5d", "comment": "Malware payload", "value": "8b133c97f5fa11cb30824e99c9ddbcf1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672168, "uuid": "4986477c-c89c-4ee5-a956-c4b61ba46911", "comment": "Malware payload", "value": "10abd349d957c2f58c35acc963771f764be7ebdc429ee3974610f59f066c6623", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672168, "uuid": "07217013-b877-4fbd-90e9-63e33cc9e931", "comment": "Malware payload", "value": "90f327fee2fbb1afd3eaae05aca9598c16257ad8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672168, "uuid": "8a9bb4c1-287b-4950-aaf8-e36ab5fbe3c1", "comment": "Malware payload", "value": "2dcacf5139e1a96f69f39ca9c1275c58697fd3ce80e1d4ac91d2d724d557afa2dc2078fb2e4a23edd7af1ab11e0070e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672168, "uuid": "6c9449cf-7b4c-4552-941a-74f9f7a69a98", "value": "T11031918F41C0126568C0BE84B5E3881DB8A8B6C638D01EDDEB6D25A17758B94B81EF77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672168, "uuid": "dae18d0d-25c3-4e66-a96f-ea252a92b341", "value": "24:6rM6WBCQhBh9Mk8Qoe6CZKCyk/TU5k/qzoz4k/GN3k/N25k/d0k/Ek/H:A/GzhL8Qoe6CZKCyk/TU5k/2k/Ok/N22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761672168, "uuid": "9a6b440c-1666-4220-9db1-b005eb87c3a4", "value": 1471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761672168, "uuid": "b0e7a29f-df68-4704-8d05-8ab321ef2a16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672168, "uuid": "d2100db2-1979-4cad-b7d3-c6d5b4d2fdd2", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02344709-b3b7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625904, "uuid": "1a1366f4-9a9e-4373-979b-277093b30f16", "comment": "Malware payload (Mirai)", "value": "b6dd5e3debcc314fda3ac2b8b3d97f42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625904, "uuid": "2474fcac-924f-4afd-897a-fdfc7f4397c4", "comment": "Malware payload (Mirai)", "value": "114e7c4cbfa1791646269b74688e4122166bb49ef45ae714694a5cf77689d0ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625904, "uuid": "235780a0-b027-45d0-bfa3-a81d2b1761dc", "comment": "Malware payload (Mirai)", "value": "9797563e30ade2ac7d4d7426e0d235d1247608b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625904, "uuid": "37bf5f59-0b93-4828-bce0-a2ab8d0dd999", "comment": "Malware payload (Mirai)", "value": "298a4beb10c304526b07d22ac67c4145e01f0a9ccab0b63e0cd7204fa202c40ca249ea5898d118082d5dbd2ca4b86cb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625904, "uuid": "17ff60c4-f0e9-4dba-8a9b-acaca3660258", "value": "T18A343A46EB814A13C0D627BDF69F42593333D764D7E77302A9286BB03B837AA4F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625904, "uuid": "67180141-6fc0-470f-b46c-3d2da373cbb2", "value": "6144:nqdiboIbPAR8Poa/rKCdAoPhpCfga+FzG8V/G3R:nqd9IkmPoazKCdAopoYJ/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625904, "uuid": "be99fbe4-89e8-4171-a95b-95a85a39c58d", "value": 247510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625904, "uuid": "5fcea724-c18d-4dea-bf7a-e444cca49e05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625904, "uuid": "143d1022-89e3-41b8-b064-d1815b6c8c95", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27f367b-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761639971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639971, "uuid": "5b4f0cf9-af07-4ef5-8694-7ab7daa53cef", "comment": "Malware payload (RemcosRAT)", "value": "608b21ca44e6540f62f8963932c68fc3", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639971, "uuid": "6665c3f2-5f4f-4cd1-9768-ad6bda839d5d", "comment": "Malware payload (RemcosRAT)", "value": "1209cf58ef2e8ce7de8e89e0424728ba1318cf3f8d99599a3a9c5941ccff44df", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639971, "uuid": "c5adb36b-1326-405c-87cd-1f4d50de2945", "comment": "Malware payload (RemcosRAT)", "value": "7a24055438c7a9251ecacfe6cae7f476ac08c9b4", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639971, "uuid": "2cc232d6-f4c2-48b6-8625-06f5514d957a", "comment": "Malware payload (RemcosRAT)", "value": "e8fdf25c1ce08c7ad9f8029cfe5956967d868b62dde56f709cf4e036815ed7843d3b4b13f558fd4207e4e1c63ffcd55b", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639971, "uuid": "bcae8754-96d7-4b2a-bfdb-ab58e2fa2d39", "value": "T1B68226438D2AFBE15FC08816AC75C0CBE3B04CF609CA4F7763C997652BD92AD8294576", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639971, "uuid": "80b97b3a-181f-4a04-9111-8d2f20207275", "value": "384:mjmSB0yfoOyw4tAqmwBGnDUZJqhcBBAncI/OkbGCHAaSvQ0728xeC1o6X:ammZpDwBGsAPmkbzAn28VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639971, "uuid": "b3bf0a84-47b2-4c5c-b2bc-63f5698da07e", "value": 18009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639971, "uuid": "32cf5ea8-d73f-4bda-991e-b9c3fe53e9a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639971, "uuid": "7376e169-c11f-44a1-9664-93a2dcc94cc4", "value": "New_Ref_202510283_order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619add60-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656558, "uuid": "22561f41-cec8-477a-a02d-2612e6bb0e31", "comment": "Malware payload (Rhadamanthys)", "value": "06c7427741c570af647abd70baac74e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656558, "uuid": "ca5193c4-1690-41b1-9716-273625cab314", "comment": "Malware payload (Rhadamanthys)", "value": "1309f5f1bc2ec20caed74a79a77ee6d73ff71bc96403ebb11603c8c9bfe18a2d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656558, "uuid": "3a68fef3-0c34-46f3-b31b-f357560bcf81", "comment": "Malware payload (Rhadamanthys)", "value": "7f194a7311ad95202afbdfe889e9f42a09daf704", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656558, "uuid": "166ccc97-01a2-445d-ab9d-b51e14fa6a56", "comment": "Malware payload (Rhadamanthys)", "value": "fdfcd3f59ad7cdf2650a0be062ad43c0a4c41b021eb528ef28d120cf35e8693bf6bb9323cc03981c61b2660943bb46cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656558, "uuid": "58af8e48-a585-4de8-a46a-a132bd4576b0", "value": "T1D5A3F92DCBE7ABAA8550D8133A8390D388DCAB5F4C7540E4550AE7B52856F181CBFCE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656558, "uuid": "8d7d9bad-ec32-41ea-b244-136d65700790", "value": "1536:GDB7eKg20133parPrCM2KGfU6ZUA++p4QF716BkQWJ+aY:GDB7b013SDXaAQF716BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656558, "uuid": "86093d16-d272-421c-a239-5741306c752b", "value": 106060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656558, "uuid": "dd8bcead-a4b9-45cf-baa2-27f5164b4a8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656558, "uuid": "00f82662-64d3-43a6-a84e-c1b5c2ebc969", "value": "invoice-1637482117.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7f30b0-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656578, "uuid": "3ff96c94-98e4-4544-9aed-a35d2900e1c5", "comment": "Malware payload (Rhadamanthys)", "value": "116094e5419fa5ce1a6fb7a7a93ca031", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656578, "uuid": "83cc48b5-5b4a-4361-a486-deeec2552075", "comment": "Malware payload (Rhadamanthys)", "value": "157020abcff01b74bce8e62f180b82923d316868a1c8b166803e5d3f109b92d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656578, "uuid": "ae0e3a93-2227-4c87-9b62-70f6de1b8e94", "comment": "Malware payload (Rhadamanthys)", "value": "358acb98cad532e58d312e4a3c2a3004607d89d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656578, "uuid": "fc000aa2-ef34-4811-89ce-a87c7d9ad960", "comment": "Malware payload (Rhadamanthys)", "value": "923b985d452e771966f447addedc46acbb08a2873fdcc94048899ed239cf02335cc67a068e5261852989edd1432f5ae9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656578, "uuid": "02d706bd-8621-48d9-8a3d-487f3cef4db2", "value": "T1BDB32B5127178C22048DE19795B23F36EFC2D1F7AC5885888B6F739AB05A93079D72CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656578, "uuid": "f9b5989e-c743-423f-8d23-a442910383d3", "value": "3072:GDB7b0V3s3i3T3Z3Ga3l393GN393m3o3O3Ceh3Q3a37333P323a3331Q3f3H343w:0W3s3i3T3Z3x3l393GN393m3o3O3Ceh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656578, "uuid": "0711b59d-b5b4-41e1-9735-569bd3a48e30", "value": 107988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656578, "uuid": "cffb2951-e3ac-4945-af6d-c9500e71e53e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656578, "uuid": "0790d914-718d-47f4-a018-135b8eba5b97", "value": "invoice-1637482117.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e9900f-b41d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761669823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669823, "uuid": "f2a81ec1-a878-4cd8-8280-b5036d7625ae", "comment": "Malware payload", "value": "9491484ff27626cd4478b6dfba24827b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669823, "uuid": "3080226d-e6ac-463d-8861-7913cc837b9e", "comment": "Malware payload", "value": "15954898a63ef8e9ddef70a559156d67e0b25d40b20595a51d8727c6b1c607cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669823, "uuid": "08ee42db-e3f1-467b-b43c-ffb317aa7885", "comment": "Malware payload", "value": "16aaeda3ac60753570d34299276ff22b47047a0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669823, "uuid": "9fe93b9a-5d7e-40d7-8a0d-479a23548b91", "comment": "Malware payload", "value": "63c22752a4d6882c747509ea67ed77a8abd5680b73f32e50885d19dd13516943bce662be1c33078110bf7b9bfbbdcf42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669823, "uuid": "2ba42e69-0849-443d-833a-140df24a4813", "value": "T164430287045DAD60CCA7CFBB4D684FE62123E5A3404D57219CCBA6511CEFA395B812FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669823, "uuid": "9ca7d9aa-7f70-462f-8766-15e5681b1e55", "value": "1536:XStfBoqaA8d1o4GFIYUrzcjkxlM0y9FLW/4mVV+BWF0X6+6dLkg4azHV:XS8qabd1o4GenwjWlMVWjVV+QF0KXLGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761669823, "uuid": "538dd0ea-871a-43ab-9461-86baa4762ed6", "value": 59608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761669823, "uuid": "8740a48f-c54a-4549-9d25-4cbc64eac69b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669823, "uuid": "fe5e9e88-9713-495b-9212-8bf4f7e928c8", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02d319e-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660153, "uuid": "b48d4227-2b0a-4fce-ace3-8468ffa3c278", "comment": "Malware payload", "value": "2d05c623863a99b17627f8f66e376d99", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660153, "uuid": "dfd87b78-f038-48de-a510-e0ad207b0a85", "comment": "Malware payload", "value": "15c14f409bb866760e3fa08f6f15668c89f63e668c8526d20b771b5829978977", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660153, "uuid": "9150022b-5d61-4e76-8c14-bfd7d41e2cf0", "comment": "Malware payload", "value": "d23447966082969fc919291c8a5f0364ade7ac0d", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660153, "uuid": "db1e984f-6159-4210-8d8e-06981a4543e6", "comment": "Malware payload", "value": "b88d32311ec1d2dcc072a48537443c62c592619df04b89270e2560d8fd343447bbc368dfa10ba0a9c2d7e2f7b70b928c", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660153, "uuid": "6eed5fbe-8c32-4c0f-b4df-352ce9155c99", "value": "T1C3F29FE9A3AB155C3B959EA70961C3457A0D92922C63D74067FCB11FEF0C6F2A330DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660153, "uuid": "c6728898-4c96-460f-8508-948c936ee487", "value": "768:+SXxf7uCgMxmn2fClhylh10LBlhk0A0sflhUt3HyhSPoFSL:+Kxam3qOB0tA0A0sfgt3HyhSPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660153, "uuid": "725c9e10-72cd-48b7-a83a-7795dac69deb", "value": 37236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660153, "uuid": "f744cacd-9798-4677-b74f-831b86b514e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660153, "uuid": "43be30cb-a547-42ce-a0f2-418c82598d94", "value": "m.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382a029e-b3ec-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761648758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648758, "uuid": "1d6b0a22-e2f8-405c-b88e-f3ce18224da0", "comment": "Malware payload", "value": "a65078f9110f60042ba2a0f3400cbcc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648758, "uuid": "0f3033ec-93f7-407d-94b9-f1f2a2852afd", "comment": "Malware payload", "value": "18316148ebf382c1618f82576538591a3b07a1d36b913dc93f78ba3401a95d37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648758, "uuid": "63779bfb-4147-42bf-890d-3ca07ac361f8", "comment": "Malware payload", "value": "9e2b89e852a7b609ac7173d83cbf31be8023e4ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648758, "uuid": "d6daa0fb-d562-4aab-bb5a-87814b30a40b", "comment": "Malware payload", "value": "9fd289e0d661cf0227338ad61eb6440a56278e56716786e7ba852fe18b7550e5446f0a055a5cfab0a10078070f4f1852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648758, "uuid": "46ff3263-773a-46e2-96b7-1174e8bb186a", "value": "T1EA6302FF237257DAE62582B1890313EE48FD32751D27932749B18BC225A9ED520755CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648758, "uuid": "ef09bbf9-f07d-44f2-bb8d-ffa7410dd2cc", "value": "1536:ydBtMmW+hVBEsvoNw4gFsoMHXK56Z/ok1O6NPFAxNn:yd7M8FEpwooM656Zg0vAxNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761648758, "uuid": "539aa522-23ef-4619-8074-6c54e8d3591f", "value": 66736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761648758, "uuid": "5912bacd-957a-4ec6-a82c-59208fff3661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648758, "uuid": "6d83e1b1-d136-4215-9cff-b65633d8778d", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9241d28a-b44c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761690141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690141, "uuid": "59f153d6-d437-4f3b-9e9e-eb8d1d13bc90", "comment": "Malware payload (Mirai)", "value": "25270bf444911394c155fcd2eb0ebe66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690141, "uuid": "8e979511-2a17-488a-9d39-3d07903dcec0", "comment": "Malware payload (Mirai)", "value": "185c406e9d984ba0193ba8f874438af789885fd03eec5b8f3a347d44ef0b9052", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690141, "uuid": "02fd121c-8058-4308-b717-9bb32a0938bb", "comment": "Malware payload (Mirai)", "value": "58a788c3947efc9063bd9ea6d1eaea1e946065c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690141, "uuid": "b357cf9d-309b-44a2-a3f8-1a4420cff046", "comment": "Malware payload (Mirai)", "value": "8afff57c9b90e6ca7fa294c3819a811fe27d7443f752cf85d14b2e1c8c2a60975593365331845422aa6795c7227afde9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690141, "uuid": "37356c56-231f-4241-9b1b-819da43a5afc", "value": "T183630855F890CA22C6D526BAFA5D428C33231F78D2DD7206DD24AB3537FB9560F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690141, "uuid": "cd08182b-48b9-4b55-b387-40e4f5d01239", "value": "1536:jfeLaw0owThW0ixMOfwZMn/oorXUyAdV9FOl911Ira:jA3wT6fwSAoxGUAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761690141, "uuid": "84dd6807-b312-4a3b-8d1d-97dd1485dfd4", "value": 70904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761690141, "uuid": "3e9aa920-025b-4491-8d77-f8897e89549c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690141, "uuid": "cfdcfb8d-828a-4498-8689-0c47f064aa24", "value": "SecuriteInfo.com.ELF.Mirai-DBD.27646421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d253b5f2-b3f1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761651164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651164, "uuid": "db095188-06fa-4395-a677-dbaf5f25aac7", "comment": "Malware payload (Mirai)", "value": "237388a813e07cec49d575470d696780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651164, "uuid": "329eee8c-5b30-4be4-b462-d7a7a5ff426d", "comment": "Malware payload (Mirai)", "value": "19021b3d1419c90c9d796be9a221f15346dbd53d26f34e9c0d8508cd6652c84a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651164, "uuid": "5a5cfa50-fb5f-4b04-baf4-45e04b9f6d1a", "comment": "Malware payload (Mirai)", "value": "74f56b188fb61acaa34add4c6d9fe6738ab051e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651164, "uuid": "2e849c4c-8ea8-4988-aabe-304007254266", "comment": "Malware payload (Mirai)", "value": "f5599c7ea1368b45e0feb9b65d77b1537d7ca3402ba232550fda5ff4efa5d15c5d93ac3939b309ade7811550ec8360b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651164, "uuid": "a4ff2584-dd57-4e38-9fa0-5725ee4c5bc6", "value": "T153D3CF31F0016CE0DD11067834BA957C1301EEF40AE95282EEBED5AE2577D997AEDBB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651164, "uuid": "f896cb55-da60-400d-925d-ca033aa070fc", "value": "3072:Vv7psuAc9PugaNH1+1G+G5vYH9chxS4uT+FiZB:Vvi+1GPxq9c+BT+IB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761651164, "uuid": "d076c9c5-e8db-43b7-82ac-680745884fce", "value": 131796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761651164, "uuid": "6d81b6a4-b10b-4784-9ef3-b9df0f9ae02c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651164, "uuid": "8a26ed8e-b033-4682-a9df-7ff6dd568c9d", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079b67fa-b3a6-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1761618612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761618612, "uuid": "3b1c9389-6ffa-48d2-9a93-ec8bb3b5c777", "comment": "Malware payload (VIPKeylogger)", "value": "c8d1181374b3818d5f64785d872976ef", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761618612, "uuid": "ed396d8a-df83-416d-88c7-feb2e4e894b8", "comment": "Malware payload (VIPKeylogger)", "value": "197aa3d6e0919553b9ae53814e3cbda1e1c4d891e9a684b6fbef5684b8fdf44e", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761618612, "uuid": "3792b4f1-84a2-439b-b1e4-870a1fdd831b", "comment": "Malware payload (VIPKeylogger)", "value": "8fcd11728dfc3fcf4a8c3ff88df606218506302c", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761618612, "uuid": "d213afb6-241d-410f-9b2c-adeee635f2c9", "comment": "Malware payload (VIPKeylogger)", "value": "e7467f702affe41906ebc5e2a3eacb1f9ac3f7725c44e2f4e7afc39de518b7a97148c98d56201261d40eea2e7e28bf21", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761618612, "uuid": "7d79bdcb-5f41-45f6-86d6-920a0a921d95", "value": "T16D9302D6D4A8C1C433A117D2E2EEC0375E9C4784B256264E6BF68543A53785D6E602EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761618612, "uuid": "fff72646-ecba-4ac2-b70e-3db1eaa5581d", "value": "1536:9JsY8V42rZioKG7FohxwVSVSFEUwZ5yFFzREx/I6cz4iZAGlA5wPfV1bJTinm:IcGHxBjEUwOfuxpiAePbbJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761618612, "uuid": "f174f31b-c6d3-4efe-8caa-b4601b1d61d8", "value": 89291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761618612, "uuid": "6f5211d2-f11f-4ec8-8300-b7f938af19a5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761618612, "uuid": "3c68fb31-ea51-4ade-a0d3-0f2af593febd", "value": "nRequest_for_Quotation_MK_FMHS_RFQ_25_10_28_pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba1dc8f-b3b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625088, "uuid": "fbf9bb3b-3fd3-46db-a8b1-f178d294eb7b", "comment": "Malware payload (Mirai)", "value": "5ffd13f735cd233f6f5cb8bbe5cdb536", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625088, "uuid": "1eb80e09-4ce8-4d97-b98c-71f54d4c4c01", "comment": "Malware payload (Mirai)", "value": "1981a56ef39f0fa37060a88c2c340abd322fe685be94152b35fa46eeb38fa65e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625088, "uuid": "9357a220-cbdc-4197-93fe-393caca17d56", "comment": "Malware payload (Mirai)", "value": "c82ffe63b7656c2abc0b59c0f566b0ee510736a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625088, "uuid": "17884e55-646e-4b3d-9d4e-f1768327fc0b", "comment": "Malware payload (Mirai)", "value": "f7f65acf2a0e61b2c32e39fc36210f422d6c7775e024e7b0b711c9f3ee51625bea0e9d2eb8fd70a81f0a0327ab2bac06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625088, "uuid": "94fef21b-8c6d-4155-b17e-64476be9dd83", "value": "T1C924A64E6F328F7DF7B887344BB74A20975923D623E1D585D2ACD2111F6028E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625088, "uuid": "cbb06348-7bf1-4d60-b4ab-8cbcf647ef31", "value": "3072:KVO/4tF6If3snOTk+FmIlgAjcJIgMEztdskajBiY3sjUXXt9kfv:9gtF6If3KSk+FmIQLVzTsbVi3jUntmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625088, "uuid": "ce3b9f45-847d-4afc-aea4-2ede99586bee", "value": 225476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625088, "uuid": "341ea072-deeb-4d04-9495-c28dd167524a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625088, "uuid": "f3d64ff4-bf19-4ba1-a7a2-22b4112c6b5f", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e50735-b44c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761690142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690142, "uuid": "99e6804d-bcd2-4602-84bf-038dd073fe38", "comment": "Malware payload (Mirai)", "value": "096b565c6b7cbec33ff268d86554eaac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690142, "uuid": "913ee1ac-d3b1-4282-8971-f2821b6e6697", "comment": "Malware payload (Mirai)", "value": "1a13f6f2aa0613920ec8ef9c4f9e4c29f0e42773ecd4f00f089f7735f58e5aa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690142, "uuid": "aac6484b-cd18-4920-8f0f-5603768b1903", "comment": "Malware payload (Mirai)", "value": "091140aede4e38615ada330a6d5d0538cb8ee366", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690142, "uuid": "42b029fe-c8d2-4194-a795-93af68bf8f2a", "comment": "Malware payload (Mirai)", "value": "6551f7063b2b1617abf5c8a3dc152fce27aae7d0ebe6306e406f583b6f955fc1476eee2d7a6652dd44581759b0083711", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690142, "uuid": "fff252a7-e6e8-4dd2-be18-0b6d53467330", "value": "T118630855F890CA22C6D5267AFA5D428C33231F78D2DD7206DD24AB3537FB9560F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690142, "uuid": "0ec68812-5b18-4c53-b160-40b9c26956a4", "value": "1536:jfeLaw0owThW0ixMOfwZMn/oorXUyAdV9FOl9z1Ira:jA3wT6fwSAoxGUqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761690142, "uuid": "acbaf7c2-9e66-4b5b-a286-85dfd66b9e9d", "value": 70904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761690142, "uuid": "bbaee90b-1d34-4d0c-b2ff-0bda1da9b6ef", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690142, "uuid": "c3986795-bc4c-4328-9083-29472a9b687d", "value": "SecuriteInfo.com.ELF.Mirai-DBD.18984417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3395e018-b3dd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761642308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642308, "uuid": "25c0c471-bf8c-4baa-881b-8b419deafe6c", "comment": "Malware payload (Mirai)", "value": "9f2cf41aab8e5b7f62bafc71745956c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642308, "uuid": "52d01aa5-7576-4318-97ea-0b7609df3331", "comment": "Malware payload (Mirai)", "value": "1b28f805a5a0bc589d1b17c656896668bbccc252153ea64f45af06977074ecb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642308, "uuid": "d43704c5-3058-4ea1-818f-5738f938d784", "comment": "Malware payload (Mirai)", "value": "5a642925fe0900cca3e74b7d58826cb339ec50dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642308, "uuid": "b5838478-4f03-40c5-9ab3-e5f6503e75e6", "comment": "Malware payload (Mirai)", "value": "aeb9d2507d48766c82ae9da516144e4f2cb98d7008570411a2ee6aa137c5a29a609f109375e81faca6a8cf2aceea23dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642308, "uuid": "efee1206-6ae1-4dff-8e0c-1c34f6e95ac0", "value": "T1FCD33A06B30C0A47D1632EB03A3F67D193EFAAC121E4F640756FAA8A9171D375585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642308, "uuid": "1941a49e-14a4-4c17-badc-14831348eab0", "value": "1536:2FDcpcRRY6NR0cPzx3f3expTvTwN5Lzg1PgEK/MWcvARIIADXjhHqSgHksg/z4jW:2FtNZR3exl7wz4g9/MKR0sgb4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761642308, "uuid": "22f62875-6b0e-4ef2-a8c1-f444275f28d5", "value": 137368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761642308, "uuid": "0d113726-f8fe-4061-86b2-642257362564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642308, "uuid": "6bc1cde7-75b6-4752-8225-645475f1d6e1", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20fc59f-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761636078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636078, "uuid": "e86a9f4b-a20c-4886-b460-2475e34d6c5b", "comment": "Malware payload (RemcosRAT)", "value": "3948a2c23b505c86224b63c6c97ad21d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636078, "uuid": "cf941ade-46b8-4177-b01a-5090280d4fcd", "comment": "Malware payload (RemcosRAT)", "value": "1c1e75bbc637491ea0c24c3e5323a76e824aaf273808479addeb35831342307b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636078, "uuid": "44762fb7-f1e8-4db7-bbfc-09fe62d37cbb", "comment": "Malware payload (RemcosRAT)", "value": "d9baf79ccac9f7885ea553a56c2436fbb38de9eb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636078, "uuid": "596cbd25-db66-4234-bb6b-79a5c86bb738", "comment": "Malware payload (RemcosRAT)", "value": "8bc2bec285a9e544e29e525f1f53ee6e3a9b59bc98af4b3ef9e5b30022acca292f3b1adc705e7e86db64ad6833c76650", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636078, "uuid": "df7cd0fc-e57d-4f46-992c-aed51b2de1d9", "value": "T1CC152360BDF7CF5BDE5A793048A6CA69519EFE01A389DC523B0AB38F717086006C356D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636078, "uuid": "7def189d-15b0-4b5b-9738-b7e570e53eda", "value": "24576:68r0Db52uMgVlm1MXZ/yYqxEyaWASNqc/zHbW:2DbTOaJ/yYOamNqc/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636078, "uuid": "1c7c665b-c405-44e9-a9f0-de5897c197c2", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636078, "uuid": "d014e7be-6041-4ec5-8734-53acb9d41b34", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636078, "uuid": "5913328d-5ae1-443d-9526-7e72c2ed044c", "value": "RFQ.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5158a5b-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656672, "uuid": "cac1589a-4028-41fd-b571-4d5edf860d6c", "comment": "Malware payload (Rhadamanthys)", "value": "903962ce0feb3370743684ecc0365a2e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656672, "uuid": "ffaf444e-e7e1-4030-b2fe-601fa8fd2d40", "comment": "Malware payload (Rhadamanthys)", "value": "1c740e0d183772311e6c60ba45253c4225d76dd9b0efd7784608155d4cbb6dec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656672, "uuid": "52fdd6b9-d8bf-4a7d-99d2-ba7f643b07c0", "comment": "Malware payload (Rhadamanthys)", "value": "46cba3eca6360a1307c0208a87245b68ff5c292f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656672, "uuid": "fa4d74e7-6e29-4a44-b77b-bd936adafa50", "comment": "Malware payload (Rhadamanthys)", "value": "fa2236ea561b78cef69a6b59015ba19acb15f993bbc7d9c8ed70b1a7ab943a0ec024bb887e0ec88b1e52dd51c0a02fe6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656672, "uuid": "450cbbf2-25a2-4fc2-9063-19c1bfdb8861", "value": "T132A32C8F5D0BCDF92D76B6588D0386BF800AE8A9B4A13506DA4AF73116E57113CE1DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656672, "uuid": "c7be7ead-503b-4bd1-9f1e-acf278e93aec", "value": "1536:GDB7eKg20tqqDGLUqB338TDBcqkqDd83QpAe5qcTlzjm8ttMMRgsrkR5rXdqUBar:GDB7b0hzfI2qP6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656672, "uuid": "6ddfc20a-b8c2-4aca-b272-3c79e3e5a6af", "value": 102714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656672, "uuid": "9f186262-8795-422c-8829-72c3934f7434", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656672, "uuid": "ef6487a2-eebf-4234-886d-65c00c4872ec", "value": "invoice-1637482117.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a64cbaf-b3dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761642024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642024, "uuid": "0c38031b-52b9-417f-81c8-b17975a47bbb", "comment": "Malware payload (PureLogsStealer)", "value": "cd965ee2ff847fce13327260e6a6048c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642024, "uuid": "ad31752e-5330-487d-8280-093942ebc453", "comment": "Malware payload (PureLogsStealer)", "value": "1ca5ca6aa28440ae30564d2db5d644f846851fbd8569d0b10e0b2a83c661d057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642024, "uuid": "ba94aa75-4497-4248-926d-31b46114bff9", "comment": "Malware payload (PureLogsStealer)", "value": "f51b695d060ac8b90e2ad55246b34c01f44d9cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642024, "uuid": "e76b3478-79ad-47cc-9624-cb52fa1a92a0", "comment": "Malware payload (PureLogsStealer)", "value": "4db647515912c441921035823a758df4a0d75fc7340dc5c4b0bb21c57e388861bc598c7da4bdb885d87e307659d19ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642024, "uuid": "23133577-0165-45b4-bc2c-cced25d16314", "value": "T1B395CE186AD01B17D73E83B589E38AA973BA94D8FF4BC70B9944B46614013E1A7431FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642024, "uuid": "1a070685-194c-4f7f-b8d8-d8f02f8b95ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642024, "uuid": "1606d634-0a20-41f3-b890-1eeb5a8cd641", "value": "24576:HrL/R/Lfd+eX7VPIGPeyJwjdk5Ck8rr09vXtRP6bv8+cXk3Ryyhw3N/5qSoelM:3Rs07Ooe+F574r0FvP6bEuw3NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761642024, "uuid": "5b51dfaa-ec1b-4675-9742-2c569b85f8ea", "value": 2011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761642024, "uuid": "d439ab1c-5587-4575-ad97-f1e52f8d1631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642024, "uuid": "da95648f-546c-40bc-9181-cc8dd49e2063", "value": "Demande dispo et tarif DOC 29400294958920 20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d6f8d0-b3f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1761651309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651309, "uuid": "f02db2fc-37d6-4db4-a821-61d9ab67b4ce", "comment": "Malware payload (njrat)", "value": "4c69e77faceae9737dd10edfcbc91bfa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651309, "uuid": "d9caf650-1e63-4804-b0c6-ebdccb88189b", "comment": "Malware payload (njrat)", "value": "1d03bf975d8312c7578ceb8f9c8c9d471196806810613aaef602fb6bca22c022", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651309, "uuid": "a7858b80-c253-4255-b24d-804de14fb2c1", "comment": "Malware payload (njrat)", "value": "c8f71a47054d5f9ecd97abe9397d68da3c1ef75c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651309, "uuid": "6c726f90-f078-4e86-a82b-94dba32da937", "comment": "Malware payload (njrat)", "value": "620f0a21b269488d80de9f9111b820fe7c8bd037869a218716a5665937ffe34d30662d6443bbe983639f556012da8772", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651309, "uuid": "184fc651-3038-4388-9057-bcbf1bf93bb9", "value": "T188733AAA5C8435CC1772E7C74DCFBFA8922B36774A33089A0203B66411B7D591BD94EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651309, "uuid": "191f6c0b-df4c-4ac0-82c3-4b30aa2a438c", "value": "1536:pxpdS5RmtKNWtB31x1iQLdauH1WVNuVEuP3YoE8PDA7n6NVECXppfdIhZVdC:3SuKot91bRBaOWWauPoADAONuC5plIhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761651309, "uuid": "196280c6-8b5f-46f1-84e9-e3fc6b8c3131", "value": 80684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761651309, "uuid": "4d38b312-5d63-4acd-95bc-ba6cfb08901f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651309, "uuid": "d6ab7697-d8a9-4907-88c1-d10d1b12c5bb", "value": "output1761649026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8741be73-b400-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761657481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657481, "uuid": "a534e3da-4c42-47b4-9227-4f193f52ee6d", "comment": "Malware payload (NetSupport)", "value": "a687db7e36bb9167500298c2ab0ad76f", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657481, "uuid": "f436e0c5-4588-4ebe-a9dd-49e9e02b5760", "comment": "Malware payload (NetSupport)", "value": "1d1cc38bd108a95f85beab885c4ab3d8cfe75466166b1e8934450ee9d6f802e6", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657481, "uuid": "55de717e-285c-4e85-acdc-dee286aeb9f9", "comment": "Malware payload (NetSupport)", "value": "03798cd3acd20a71c4227d7622c0a93c76537cf7", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657481, "uuid": "0485f9d7-59c3-4b06-9f5c-c98235227d8e", "comment": "Malware payload (NetSupport)", "value": "29366d71efba6f1b2347eaf340e0bfb52e47f1271a3f21c8fcc497b37439f1fd46daf72e1ff75adeb0595571c6910fc1", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657481, "uuid": "e1c87b12-700a-4192-bb2b-f249e56b05c1", "value": "T105A2E1C6DC387643E006C7BB1378924317636C99874F4679FAE6B7506C160B99EDA405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657481, "uuid": "30d6840e-a433-4c31-96b9-5a13d5d31908", "value": "384:JRaScOps9u2j2UlY1Zi9pVL/0+Y3Ga7q749prswcOmrOR68bvELtPEKb:JBcOp6u26UlSZEV/x3a7VlmrKTKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761657481, "uuid": "71c5644a-1172-49af-bfab-9e0a69f3150f", "value": 22083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761657481, "uuid": "9f0d19f3-1dba-4033-8be3-31b25b3574f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657481, "uuid": "95cf96b3-bbf8-4920-b9c8-6d06378de52b", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdb103d-b42a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761675722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675722, "uuid": "1e6c68f7-22aa-4ff5-b63b-f45fb9046139", "comment": "Malware payload (Mirai)", "value": "c5fddf4db5dfc8c46435e56908b3c23f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675722, "uuid": "652756fd-6e6d-4e24-a7a2-ccba5d28f91b", "comment": "Malware payload (Mirai)", "value": "1d448d056e4a815b5982e734eaa5b9de0222b1504b9506e9c648be21327a0016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675722, "uuid": "159ac461-d6d8-47f9-8a45-ce280b9eafc3", "comment": "Malware payload (Mirai)", "value": "130286502951db6aaff1611210b5b4350a2be0b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675722, "uuid": "a56e4cc6-49a4-4dfd-900e-4f2103fd6669", "comment": "Malware payload (Mirai)", "value": "37980b961a051a81a589df733ae5bba9b0faa7f967ed19f68665ba87a8008f9490cc23e70a006d5ea2a4298eed9ae51b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761675722, "uuid": "b97c83ff-7693-4048-b1bf-eaae8fdf9ad9", "value": "T159C38CA87A4E7D82D3CBE37DCE084F21712B75B0C26593F17E11935EC2CA9EA89E4541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761675722, "uuid": "1a60a68d-7b4d-476a-bc41-33570d95e4ec", "value": "1536:FuOSTEjBni4SCGhfKmFSI5eg2Po7zE5I0jXiB3Q9lceC56fYO:FuvIjBPvlg5ezPo7zEpjP9WeCRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761675722, "uuid": "f3b4a882-f253-4b71-a125-98e331fb2863", "value": 120664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761675722, "uuid": "653a1b4d-bb29-47ac-84ab-f3ac2da5250a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761675722, "uuid": "16e748fe-4178-4cb0-bc48-d7807359ca25", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91005e18-b44c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761690139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690139, "uuid": "4faf84c4-c988-4cf9-85be-e595e6786324", "comment": "Malware payload (Mirai)", "value": "878d3144ea42cba40d891eb818d6d08e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690139, "uuid": "a2ae1215-34a0-4aa8-9fa7-6d45d53c7517", "comment": "Malware payload (Mirai)", "value": "1e4ccd17f60d46d6f3e4c117db56d402c0f55adb13a08794b785ff44af535346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690139, "uuid": "3854bac8-18c1-47c8-b09b-a40cd94317a4", "comment": "Malware payload (Mirai)", "value": "7bbf07ff53f6bb7af21edf62c9e80385b76c6951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690139, "uuid": "bd4e3591-bf83-4957-a088-f9e3692c8ae1", "comment": "Malware payload (Mirai)", "value": "0158e70047979343c38945febf3ba7e8053857f1fbed4931f71abb1895afd5fd8b4b65f19d110f808e228069e8eff173", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690139, "uuid": "e2e40e82-f43a-4d60-ae35-73cbed31ca74", "value": "T13B736B84F7C3D1F1F2A306B0021BE7AA57349D245016EAE1FB0A7B797C726126E4B15C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690139, "uuid": "ebb57dcc-42ac-4132-a3f4-e8f4657b51f2", "value": "1536:WkIpY7Nf59iFefwue0gYBZDozY9aPizLSIporggY5v:th59iFefwuS8KzMaPiz0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761690139, "uuid": "4a17229c-dabf-4298-a0b7-4ab0aaa96f48", "value": 74968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761690139, "uuid": "6c74e57c-d9bd-4e45-85f7-1d2269378047", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690139, "uuid": "b3baaeed-fd80-4098-976d-b5091b71ec0e", "value": "SecuriteInfo.com.ELF.Mirai-DBD.79688569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b62253-b412-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761665345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665345, "uuid": "a65c5e29-dba7-4ee7-b0bd-434e48bc50a8", "comment": "Malware payload (Rhadamanthys)", "value": "b85cedbdd6d10dc75d2e3ab59418757a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665345, "uuid": "e2564d58-dda0-432b-b617-2e1a1e72f342", "comment": "Malware payload (Rhadamanthys)", "value": "1e69c32fa837cfcdab82ce2b74717c0acdf41a44a8b3d6adfc7ceecbc64b1acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665345, "uuid": "e6f28582-6335-4da8-9c36-f949c9e87c4b", "comment": "Malware payload (Rhadamanthys)", "value": "47adeb5fd876c4bc051fe86ef6646e126c3d2efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665345, "uuid": "6e59969f-40f3-4f90-9f94-8f41e7de328e", "comment": "Malware payload (Rhadamanthys)", "value": "b9f7f85fd80c80291399b4960013b86cd8a5fb33bdb94f6904243eda3e8499d2540b95a98d6aa0ccc8a379c2a98e40f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665345, "uuid": "71804a4d-290f-49da-87e6-5ec86148b1b8", "value": "T1C5E5D26EA9549068CB5541384F3982413AF27F4D3B2722D31D62B274AFBDADB3639F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665345, "uuid": "a4c6eb9c-9dd6-4944-8be3-ee336c138cfb", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665345, "uuid": "0087ea38-3631-4056-a321-830e54bbcc89", "value": "49152:Fu5mCaykrbfH+b0U8e45rW/Vakh24D3d6ZdPqr5wsYRTCgLkAvVKg:FWb0VyU41Ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761665345, "uuid": "180c26cc-9c25-403e-a926-9913b04ba81d", "value": 3133240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761665345, "uuid": "de3fd3fb-5e89-489d-b533-12e24afc5c26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665345, "uuid": "02f50484-56ba-4909-8a84-870e2530d217", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4225612-b3b4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761624941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624941, "uuid": "cc875dfa-73c7-40c7-a1b9-9e925725bb64", "comment": "Malware payload", "value": "9bec09417f52de9e574fd7d8cbe4dbe4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624941, "uuid": "80392a76-2ca9-42bc-a39d-f6172a43eb5f", "comment": "Malware payload", "value": "1ebc58f60501e02c8bdc6f586d9782107c943faf13a9b62213a02251e9002b4c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624941, "uuid": "cadf6166-bcd6-424c-a3df-f76ddacfa37a", "comment": "Malware payload", "value": "04e4a1493a54133904a5ef932d894818a9e3634c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624941, "uuid": "c2a8c9a1-11d8-40e3-83f3-ee717646234e", "comment": "Malware payload", "value": "6719b64b3956c2d56ca59c0a0f3e33c3992df0ac53269db7d5854339e79d9c93e55e03fdb7289b7fde64c226217cbbda", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624941, "uuid": "ba9fb916-0e74-4a5b-bada-3f96c63df353", "value": "T19408238BF74C991AC0F322315D5A163362094D175A4EB75B2907724E28B3AD87F7EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624941, "uuid": "ca0ac5b4-71f1-4112-9721-2dbfb58855d1", "value": "1572864:+EMxuzQPXYPQfMuK2TncaBweemu/mWMRmuvbH7nUDSSVY2:mkcYPnuKtaB++nmU7b4Swj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761624941, "uuid": "2cfad540-ad3f-40e8-a3e9-6085c59bb385", "value": 84000965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761624941, "uuid": "3ba73e52-b8f4-4b9e-a0ae-0ff01e473f65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624941, "uuid": "c33abf02-664f-400a-952c-011082e6c79b", "value": "GB_WhatsApp_Pro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45010f8-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1761636511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636511, "uuid": "5386c46f-c6cb-4d60-a356-3208cb440683", "comment": "Malware payload (DarkTortilla)", "value": "a39ed2812cbf9602bc9b9243b5bde682", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636511, "uuid": "dc92c295-67d5-4f24-8c7e-6bc8942ae727", "comment": "Malware payload (DarkTortilla)", "value": "1f1e97a35caf2831608ec2e0c6ad91a22052f44c57de7d115754382bff3f3890", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636511, "uuid": "d93cd67c-c964-4e1f-86a4-a375adab9664", "comment": "Malware payload (DarkTortilla)", "value": "bbe6eea040b8f5d92c2e411c4821fc03b1126cb8", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636511, "uuid": "52a3ddb2-bce5-46ec-ba09-4e6c4ec7c589", "comment": "Malware payload (DarkTortilla)", "value": "59e5ae0a0424f8497561c2b0edae620716b8eaa326224d21debc4702909296e63dacceac37dd2a2704bed85ccc83f629", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636511, "uuid": "148265da-588a-4098-a33b-c74a6535a29a", "value": "T12C55E12D2BC35648C43ADB34DBB2065C07F1A65BC622D36BFA4231ECCA1A7476512F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636511, "uuid": "c2f61f19-abdf-49f2-90fd-89777bc2d3e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636511, "uuid": "5f5f4c2e-42f4-4ee3-866a-78f289277553", "value": "24576:9huhCgk+pfb2M/4uT0e091EWFgYmEzACgZQzZ+Xk:31+pqM/lT0LgWCQAlKkXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636511, "uuid": "735a754d-62ec-4985-ae95-db5c217d77b3", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636511, "uuid": "60ceee4c-fb06-4b58-8fca-8ffe211bd87c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636511, "uuid": "8007c303-df35-4dc6-87c9-397bd3beeb81", "value": "CONCILIACI\u00d3N DE PAGOS DE BBVA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360c59c5-b442-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761685691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685691, "uuid": "ef7385ab-7569-489d-b89d-cffe2d65bf9c", "comment": "Malware payload (Mirai)", "value": "6cee2c5d8383d1f1f2c62bdc92f0ad68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685691, "uuid": "a2104424-8b59-4408-ba27-199a6613f9a1", "comment": "Malware payload (Mirai)", "value": "1f7a20fde10e84294821d734b70d397b2fb55727029185532f5470c934522c24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685691, "uuid": "5bc807f9-7b07-4721-9bf2-aae3743431c8", "comment": "Malware payload (Mirai)", "value": "d600df34c01dbe8093afae32a127ae4612fc06f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685691, "uuid": "de2eeca7-6f80-47df-8859-172681774096", "comment": "Malware payload (Mirai)", "value": "035209b3be4346126536ed1f6095c84064a99eea4f53f624717a6eae867ecf4c5f956212cedbe0dc3af5162e46bd2175", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685691, "uuid": "b80a6f0b-9ebc-4a7c-ab22-064f5cbf21df", "value": "T194630855F890CA22C6D5267AFA5D428D33231F78C2DE7206DD24AB3537FB9560F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685691, "uuid": "65526bac-7e67-4817-a7fc-d50993c85e0f", "value": "1536:PPeLRJPws9h+0F1MObDlZeIONzII2aULmOg9z1Ir6:PkIs91bDb6NjRPq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761685691, "uuid": "7fb9ab4b-0842-4237-9892-8e800625fd25", "value": 70904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761685691, "uuid": "64ec5a9b-d41f-4be5-ba7e-ab850edc076e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685691, "uuid": "b6c8183a-dc79-4d41-bca1-56623ae14c1e", "value": "frost.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64669b1-b3b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625374, "uuid": "a29127ab-78b5-40b3-b743-e24f1ce65999", "comment": "Malware payload (Mirai)", "value": "6a8df5ad13f4b6abe982083d252c98f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625374, "uuid": "1f2b75f3-f9e2-4c76-a5ac-9a7d4ef4fc94", "comment": "Malware payload (Mirai)", "value": "1fce7646d7f27af11b90e71e8a707e3e5138874110e45f904e064b3ffebcb843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625374, "uuid": "131ea473-17e1-4c8c-a48d-44bfb233445c", "comment": "Malware payload (Mirai)", "value": "f14bdbf7a514a1e407b49c2c6fffda8cba9df5ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625374, "uuid": "3814471f-5f0d-49fc-b4df-658b73569f95", "comment": "Malware payload (Mirai)", "value": "4a697a35f364e72e3a0d8ac278f68cffa34517f26bb33734a353c9730621218453523962209e6829665a5589857472aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625374, "uuid": "1d7c7756-cd69-4757-80a9-095325556207", "value": "T1B124D70AAB910EFBE8AFCD3706E90B0528CC652725A47F3A7274D518F54B64B49E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625374, "uuid": "8e77a50d-07b1-42e6-bf48-3814bcabd2e7", "value": "3072:FiFjNv3D2wbtdmA37O5Iyw0PJ9GJPsxlPfLD1AtsLoAj+waZLRt4f/Y:IrbtdmA37mMQJ+PsxlPfLDOtsLIwEy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625374, "uuid": "f80bb402-9ae8-410e-a1c3-9b7cb4707bb8", "value": 228932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625374, "uuid": "85515ca1-5470-40b4-9fa4-b7d27ee39c8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625374, "uuid": "2edab8d1-4b55-4576-8a60-85d699db05ac", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919fb8af-b44c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761690140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690140, "uuid": "ed0a3b6e-6c02-4b3a-a4c4-191ebb4fc8b7", "comment": "Malware payload (Mirai)", "value": "a9e0a772440b813ffe6d30950e8e16b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690140, "uuid": "cfd869f2-4409-4a5c-88cd-522e17815b6f", "comment": "Malware payload (Mirai)", "value": "1fe2e0d002c24883e121d1850a5eb852d5b3b5c1bd271d1b293cda191110c4b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690140, "uuid": "534eef02-2da3-42c8-b61f-daa08f7fca34", "comment": "Malware payload (Mirai)", "value": "b7965cf203e007e734ead9b6d3f48b83b0c67759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690140, "uuid": "e242ae91-8604-4b06-86bd-fd471c760513", "comment": "Malware payload (Mirai)", "value": "d960022c5a26bd1dbdfec239253e25f7d3560e7ad16e303aaba124332c31bf137f0b36da9dcf2712ee7af4df3c43b039", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690140, "uuid": "e646f6a1-247a-4d49-b961-9f7837943f46", "value": "T1A8B3D7567B10DFB2C26DC5300AB3C7966BE92AD129D29449B35CEE1C2E3134D681FED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690140, "uuid": "ad08787a-0d67-477a-8769-8519d4498b55", "value": "1536:Wi/vkQ2tuR36NP76loyAnz1aDGdrpK0C+f3ci4r3VlEtuI8qyvre6:L6a68+yAnz1QwK0vfMJr3fEtuFjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761690140, "uuid": "4b375040-8c3a-4a68-84d0-b49afe265f03", "value": 111364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761690140, "uuid": "02074c56-726c-489d-b6d9-0e2ed839b702", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690140, "uuid": "5addf1fb-4a19-4d9e-948a-b8b996b42abf", "value": "SecuriteInfo.com.ELF.Mirai-DBD.99795566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34db53af-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761635867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635867, "uuid": "d6008fdd-2733-42e4-962d-967dcadf69ae", "comment": "Malware payload (Formbook)", "value": "e911936615b37b981ceb975b5efa08e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635867, "uuid": "76e72c7c-aa93-45e4-b5c5-79c208ca96df", "comment": "Malware payload (Formbook)", "value": "20f2f32534dbab75a5c3ee41786c118bdd6b638e1fd9b4e863f21e51248d45e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635867, "uuid": "7ebebf6e-4736-41f7-8e0a-b31e488606db", "comment": "Malware payload (Formbook)", "value": "ef836b9dd3892a9e867f478067807fb26eb01a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635867, "uuid": "8ed76099-6f7f-441b-a77f-7484ca88aaff", "comment": "Malware payload (Formbook)", "value": "8838fd96643f79848e0eaadc34f383529c2803700530b0049152724c687d428c4af2803724f38c5ff385fc77d7784b1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635867, "uuid": "8bfd569e-4fe7-4c29-8825-e61b85519de8", "value": "T15DF423825AC09D90C2847330843ACE54597839319D29A76ACB1DE5BB7C707E3FE5379E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635867, "uuid": "3053548f-429a-4624-8a34-39474dfed94b", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635867, "uuid": "2415fe09-9281-4b9a-96e3-148cb73af51f", "value": "12288:Ez7hU5I5yuNHIgzSFKxWltRohBfSTso93UOBLKTfAX8oC1AWiCiDJnN/0/q8zbg9:Ef+iN57Gtene3NVKLAX8l95UBQG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635867, "uuid": "66042629-001d-4278-93f3-0f8e4271f1f0", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635867, "uuid": "d4f93488-6d43-4e99-9fa7-e57768236802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635867, "uuid": "68544932-a714-48fe-a337-bb8066e3e896", "value": "OVER DUE DHL ACCOUNT LETTERS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be6f8ca-b423-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1761672521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672521, "uuid": "49e1f917-61a5-4981-a5ca-648815fc1057", "comment": "Malware payload (RustyStealer)", "value": "92524d6a1335d799a6f284277be694f1", "object_relation": "md5", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672521, "uuid": "c17f858c-f142-44f4-b6d9-d2144d67d6be", "comment": "Malware payload (RustyStealer)", "value": "21080a1cfbf838b6f7d7b1f1173f2bdaa0cd45f75a5c93487a7c5f06d2037f8b", "object_relation": "sha256", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672521, "uuid": "c0209e64-ab42-4e15-a1e0-21e4ecc07573", "comment": "Malware payload (RustyStealer)", "value": "f13385aaf62d2b4df8da184690cb17c2f70ce092", "object_relation": "sha1", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672521, "uuid": "ef9181d4-e0d4-4d22-8e01-b3ad11accbff", "comment": "Malware payload (RustyStealer)", "value": "07524385495e9f508f34d511f17d59e05818175cba2dc8db8b453bf27c36c8cb80d91079410956b6c054f1d648075db3", "object_relation": "sha3-384", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672521, "uuid": "8b0229c9-3aad-40db-8550-f558d4767a08", "value": "T1AC25F112F65124ECD576C0F98A395B62AE737C880B21A5EF23A432652F37EF15E3C605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672521, "uuid": "4e70d24f-01f5-4f09-bd9c-b9faa9253875", "value": "9b2f0ef76cd98cbdebcb80546443694f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672521, "uuid": "43b8a147-9546-486d-9a14-9e35127cfce0", "value": "24576:9mIYaTnx6QG/a40lLcwoPts5e3xzlutvh2G3j:9JYaTnEQG7065gAxzlSh2Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761672521, "uuid": "1a5e2129-7e10-4e6f-9798-2d90958d65d9", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761672521, "uuid": "3b0b04a4-c447-4f3b-9879-2970d63849f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672521, "uuid": "30167942-d551-4784-be72-ee9d5e4d7a8e", "value": "networkvid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1b9db5-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761634749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634749, "uuid": "2488c832-cd77-40fe-a4e9-484510eb76a6", "comment": "Malware payload (RemcosRAT)", "value": "6f28cb5370e6f3b9bad83fa8270abd13", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634749, "uuid": "eeb0ee14-c3bd-4b2e-a5c8-6321cc21c174", "comment": "Malware payload (RemcosRAT)", "value": "210aae8a35d870238963dc2e8d8a8a10c174e9150586f46f5580dad62de584e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634749, "uuid": "b6c4cea2-ae6c-4e61-a1a2-068280e9e4df", "comment": "Malware payload (RemcosRAT)", "value": "4fd2b36c828e5a47a04791c7d96c47c311799c88", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634749, "uuid": "b627453d-d474-42dc-8558-735a0bc7dbac", "comment": "Malware payload (RemcosRAT)", "value": "ad310eb9547b4a0c0f9d57a923fbb86758cda2e0bd219b26931b2982aae5a44115953c22be1df6d5f587f2a1c0f5d8ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634749, "uuid": "131c865b-ab2c-4b2d-b7e1-20c3fb19622b", "value": "T12B459E021A14B1BDB7AB092723FF7B391224478AFC346E1F3525F6E0BE8F2E56155168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634749, "uuid": "38a34554-86de-4f52-a0f8-7d11acf4e633", "value": "24576:1qd76ocIElk06Mlk5N6WwjA2ZZFzWXvMPHbgqoeE6:IRkFtmmRzaMzn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634749, "uuid": "b1641caf-8c8d-47d9-a9b7-7f779b7c5321", "value": 1188053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634749, "uuid": "c7e42441-4586-432f-909e-05017a78a479", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634749, "uuid": "a9ef2d69-1b90-4226-990a-ee02d318aeb0", "value": "Cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98703246-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761640330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640330, "uuid": "3d6e9cbd-5816-4eac-b0e2-931ad472118f", "comment": "Malware payload (XWorm)", "value": "94ed819fa2ccc8319df5ed2e9f9db3dd", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640330, "uuid": "413186e6-da62-471f-8c6e-8c7231343b53", "comment": "Malware payload (XWorm)", "value": "21f87386bd2ec17ba8326b20f99ee5bef6b1811a9433cf58357794542f8eba1f", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640330, "uuid": "e480c009-1677-4ad2-a4e9-36ba045edfa3", "comment": "Malware payload (XWorm)", "value": "1cfe9d2638e81469fc8f10204d397b59b5bb7f73", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640330, "uuid": "75e4fb97-41c4-47e1-9836-b449e2bbfb0f", "comment": "Malware payload (XWorm)", "value": "fb2cd982297dfddc8383d020f28c0e9709c4f6e7a0ac6ed8db573908966e2358186685749e860b1cf4b46db579eee5bf", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640330, "uuid": "9635f152-3828-4e5d-9f2c-0203980fe28e", "value": "T110256A9D9471ADD3A050FE70E540EB978CDB478406274B121FE5A8AA7206C47FFAB3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640330, "uuid": "1d782090-8595-40b4-98b3-4aa17922b10f", "value": "6144:s/GfFQN+6NeNHGWHKqgYJugXlFOJYW1v2g91ZJcEI4JaixzUiybaNOhpr1YzxYDP:X4qe+rQfFaHlrJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640330, "uuid": "fe65fea4-2d23-4892-8431-24dc907664bf", "value": 1022162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640330, "uuid": "23aa3246-ce51-475c-8545-2b541bd3c88c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640330, "uuid": "5768d1fa-92db-4a23-844e-c62ba9ba7634", "value": "SPEC-ORDER 83652624 CHINA-202509.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be288af3-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761639963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639963, "uuid": "ea819c2e-d9e2-4bfc-b848-a4167e209682", "comment": "Malware payload (PhantomStealer)", "value": "ef6a37224eaa59431cfd3feca2d536a7", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639963, "uuid": "5777a235-716e-477e-a2a0-97c8859251c6", "comment": "Malware payload (PhantomStealer)", "value": "2289d9d5d2b1879c9b95fe142444c8c43e72979d0af81a4bead23ef66b87c257", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639963, "uuid": "c5e0e69c-fc1b-4320-a3b3-83fabff8313a", "comment": "Malware payload (PhantomStealer)", "value": "192b329bf43dd780c518f58cbb6269e8f79b1821", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639963, "uuid": "8950daa5-7abf-499c-bcbd-83fbfd64d63e", "comment": "Malware payload (PhantomStealer)", "value": "2fa64144c80b6cab51bd2f1a2209dc5d55bf7faeffb99f98e50628c3b55e94ca88b8fdd64b8da91548cb823a24420122", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639963, "uuid": "88091074-2110-491c-ab34-69f65c8856c6", "value": "T11426021589C82FB9CFAC5A1880FE161EA3F04A8E546B758AFB377D4AAFF750402071D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639963, "uuid": "84141f3b-c4c7-42a1-a3d4-8eef6d572109", "value": "49152:2KhhIwP7y+9vSmX/CCLWjWIO61l6S9BqT8zI0vZaBbv83I6daezlmA0:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639963, "uuid": "597659a3-6e4b-4c40-b953-35070b181572", "value": 4469791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639963, "uuid": "dc426606-5c6c-44b5-a7ad-155efca5191b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639963, "uuid": "64ed0118-feb1-4c33-95ed-4e0296f29607", "value": "Document Reviews.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9e716f-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656770, "uuid": "c49a8fd9-3002-41b3-8492-f406c56c4e3a", "comment": "Malware payload (Rhadamanthys)", "value": "e124c9706e34df9473f51c924921cbc4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656770, "uuid": "57a8a231-2b0e-49b6-8dc3-518c43a207f6", "comment": "Malware payload (Rhadamanthys)", "value": "23cf8580611dad9fc7d8e62167ff6ff14ba2a73980a06ef54f7095b3d7c09400", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656770, "uuid": "85799888-d6cf-42d2-a2fd-4546935a388c", "comment": "Malware payload (Rhadamanthys)", "value": "c7b05ab976110a62a569c61f33627dcbfacd15ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656770, "uuid": "00efc549-8dfc-45da-b214-8596e864ed37", "comment": "Malware payload (Rhadamanthys)", "value": "3830964a191aa7bd9c27aece0db14fbc560fd32785cbb3a43a794845ba9b03370cf400234b30cda337d5d3a481a3b15c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656770, "uuid": "095873a5-8740-4bb9-bcc6-3e0c4c4bf0f9", "value": "T1B2A3D683AF87AEF15454B99F3FCC62B96C4B3DD1240691ECB94FB3B1159A7669C800C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656770, "uuid": "89c323a0-2c4f-4a2c-90bd-3e1789f4fa22", "value": "3072:GDB7b0LTtxI40apEb7WFiHbeAo4USZR/+wEhz6lz/AqRoOvhE49ujjLx+rUsWKfv:0eTtxI40apEb7WFiHbeAo4USZR/+wEhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656770, "uuid": "ede074c1-b205-45a1-b6b1-e548db105ba7", "value": 104771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656770, "uuid": "8a273fba-ac5d-4470-ab68-2633a16ff4e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656770, "uuid": "671005df-e191-40da-a479-2c0ed908a67e", "value": "invoice-1637482117.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2758c55-b400-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761657553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657553, "uuid": "36b8ef2b-7f74-4f29-8e53-6b7b3ed9d3c2", "comment": "Malware payload (NetSupport)", "value": "2c2c42dbb0031f4cc26009ff553216e0", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657553, "uuid": "f5734c28-f798-4585-89c1-419ca8603caf", "comment": "Malware payload (NetSupport)", "value": "248dd0b1bae1ba0165bbb3ec94257908d26e28398726ed7485e0767a815a0c1b", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657553, "uuid": "c0e064a0-d759-45fd-a191-b76201f967a3", "comment": "Malware payload (NetSupport)", "value": "6818d57bfeec2c3c463a4f169a673973378d77ac", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657553, "uuid": "8c5ed888-aaa1-48e0-a518-0120241d7713", "comment": "Malware payload (NetSupport)", "value": "850a21d3e633fcb73e3edfab0de45da678fdb2358c1ec886f5ed113490acb05a574ea585e7dcf2315ec938e06fccbbc8", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657553, "uuid": "110467ea-b3ab-43fa-b300-53797a725c24", "value": "T10CA5338781715AE54F9B682F438653C27CCB2E72A7453FF88C354FA510835C99BBCA86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657553, "uuid": "bd3a29f5-5ebd-4758-8f3b-d3329e8ba584", "value": "49152:tUgZ+JoMraP9KzXRRvHEhxhUd+COu0vgzSmPO+vNZixvTNZWep2qT:8gPsz/HEzhUFOu0v4O8HixLXIqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761657553, "uuid": "36feb0f4-b977-42f6-b19d-4d388a6354e1", "value": 2255681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761657553, "uuid": "06a37c9b-1d8d-4427-8f1c-cbf16f795eb9", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657553, "uuid": "32dae553-e9e6-4ed3-8e1e-644251fe1a8f", "value": "248dd0b1bae1ba0165bbb3ec94257908d26e28398726ed7485e0767a815a0c1b.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c6f4b6-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620949, "uuid": "0042b799-7a40-4d95-bbc0-513e1843b5ac", "comment": "Malware payload (Mirai)", "value": "41a0ef6843fd132d82d0082a0c99b99c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620949, "uuid": "0057ac8b-35a6-4d77-94f2-511c71f6dec5", "comment": "Malware payload (Mirai)", "value": "24baeb75e2dccf8d13daf971933a5ba53262b85bb41aa250a539ecd3fddeac78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620949, "uuid": "93064ea4-e1bc-42d5-ae8e-d709696edf0f", "comment": "Malware payload (Mirai)", "value": "40c7d5cd36b317d72d6f3a7e8ef73e1b68c0f3c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620949, "uuid": "938bb9d2-794e-475b-a59d-335509d6d430", "comment": "Malware payload (Mirai)", "value": "fb66b816ff836babfdd19bd66d1373497f491afe360bcaf7b753905c29b42ab54b042467a5f3e1634427375defc1eafc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620949, "uuid": "05bf81c8-bb16-438a-beb3-73be10a35836", "value": "T1FC333A02957C1A2BC4D0A77311A74363F2FA2B5541D4E68FBD760C4FEE983502ABB6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620949, "uuid": "4698fa57-1004-45df-b6fc-af37638370b1", "value": "768:WdoXL889wsGBaU6bhlBlLKUo7uVW26lKGpa2FRxdWSRIzV4GMIZ/Tfi:WdiLnqs2Ub/BlLKNHlKGkOxdbIKsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620949, "uuid": "3e399d18-7c9b-4ff8-940e-65aa0dc617cc", "value": 53820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620949, "uuid": "a167bd80-84ac-46d9-9928-8928d16b49b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620949, "uuid": "770686d9-3bb1-4603-bd13-06657e1fd4ae", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd34f7ba-b3bb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1761627989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761627989, "uuid": "5e90aa90-a8e8-4b56-856b-050de1edaf67", "comment": "Malware payload (Gafgyt)", "value": "de335cbc9846a4017676cfa20bac41ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761627989, "uuid": "ae96b65e-e8a7-4dc5-bacc-00a1dbe340a2", "comment": "Malware payload (Gafgyt)", "value": "2541e7c6889f9f3322ac0a8eda7f15f46b8c4f8d742953235d8818a41245e62b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761627989, "uuid": "b29c4c2d-bcbd-4da5-94c5-0a9571bdb810", "comment": "Malware payload (Gafgyt)", "value": "0a9e16be76f91abb7aa84b6d6c1a4c895628cb2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761627989, "uuid": "1aeb10e5-5b23-451b-a003-d8cc8fcf5812", "comment": "Malware payload (Gafgyt)", "value": "ed993e22f773689c1c4711cf51903e730fe234fec35fa8bfde95b581b02317ead9d35b954585a7b29c9565aa8d45187c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761627989, "uuid": "ed6b1fa4-1018-44be-925e-a0bee07029a2", "value": "T12B530239C98E1E86D54D4D712A134C78ABF32FA5671BEBA10223FE02A347521B516F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761627989, "uuid": "adf39128-a7a6-4175-862e-7543d654e35d", "value": "1536:lUPESzbkvjrHINfVZI4CCmCtD2s48hkaQPos2X8YrKRoRZ4u+qgw09p:lUPGjB49mmD2s4vXr2sPRo/4u+qgwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761627989, "uuid": "9bcdc55f-e42b-42c6-93db-e5e3bab63c5f", "value": 64456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761627989, "uuid": "97c9c5b6-ec5e-435c-9b0f-384fb81ae39f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761627989, "uuid": "a4772348-503f-467c-84da-89e04aa6d80a", "value": "Orbt.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6ba841-b449-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761688975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688975, "uuid": "a82076a9-a7ac-405e-b8b8-c9b11a658989", "comment": "Malware payload", "value": "9bac6e63199a047845962a492defe910", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688975, "uuid": "6f8c90e3-2a75-496b-9ae3-2f118ec944a5", "comment": "Malware payload", "value": "25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688975, "uuid": "6d4ffe35-6d37-4041-8033-0dabfa254973", "comment": "Malware payload", "value": "e3f44486e385477bdebb4b215a059fbb8c56becb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688975, "uuid": "7c0c84f1-71b7-45d5-a14a-aefd8e538222", "comment": "Malware payload", "value": "8a4e2c55469f30884f94749e976eac0784a3830da02668023e2c822e473b8f672049c4d804b56a54aaca0e51dc704739", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761688975, "uuid": "02cb71a8-8d80-4c94-a98b-72d6911b853e", "value": "T170B53301706D02A2D1141A7A7B8097BDC9D0FFFE1B2012CEB896F36F697286D25B35D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761688975, "uuid": "fa39dcaa-e862-4cd3-bedc-bf79a8b66b03", "value": "49152:P2Rl4DKw9I7pSkTX8rAv6u6Lcs3KwY8X5ieigDLgS:RD9I7rjxJI3gY5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761688975, "uuid": "c09f4608-632d-4c3c-8c4c-d10c8811dc87", "value": 2310144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761688975, "uuid": "132af7d0-f88f-4148-8858-0fa52b4dea74", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761688975, "uuid": "95fe00e8-ac05-4841-9682-4ca3c040e3cc", "value": "OHPYYBSL.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736fcb68-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620940, "uuid": "10b9624f-cacf-4faf-b577-7462afd3deaf", "comment": "Malware payload (Mirai)", "value": "296732882110eb6e473d61b399c485da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620940, "uuid": "35290b58-37e2-4fac-b007-f2ef837b02cd", "comment": "Malware payload (Mirai)", "value": "26135616f7e17cf01362cc21ee0a2a10ae5186d136ce6ec24c874181109d7a9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620940, "uuid": "669b6a6d-e67c-4114-a7f5-3741a86d7808", "comment": "Malware payload (Mirai)", "value": "a9134ee024a3e5ebf93ed50d6c016cefe8a3d8b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620940, "uuid": "e1b177f9-384d-4a0f-9de3-9d0e67133c03", "comment": "Malware payload (Mirai)", "value": "c9840cfc2980477595f7e15efcbb6b2bd743feb1011ba4569fe492a2e07909b5b9bc0ca16cf576bf13630cf55bd52ea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620940, "uuid": "f626f0ae-389a-47c4-8e1c-4d482d9ff062", "value": "T17EC3F909AB614FFBE86FCD3746E90B0529CC551722A83B7A3574D828F64B54B4AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620940, "uuid": "6ad7a795-9ebc-491c-b6e2-24857fb138c3", "value": "1536:xNZqs2lYRB1f+g6z3jL3pFLURXkb3+YEwIvF2E+7hQqw5HxZp+/praXbr2F1lIl9:jZqs2lY56TXH7mqw1xi/h+2bmFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620940, "uuid": "945a68b9-d471-4db3-9d3e-81199848b7cb", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620940, "uuid": "58e2d883-8897-4777-8904-cb135e352e69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620940, "uuid": "657f2416-d018-4bc8-8296-6f051305daa8", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16378b79-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761635816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635816, "uuid": "7cd2ca15-fd03-40cb-be26-3554a9a73756", "comment": "Malware payload (Rhadamanthys)", "value": "2493b7f003fb1d50b098c5de10878ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635816, "uuid": "aa196ea5-b5c7-4291-9a99-2afe69b8362c", "comment": "Malware payload (Rhadamanthys)", "value": "26426afeb90b26ad2dd96542ceeb775fd550af0e0f83b32edff09f88aef2dc6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635816, "uuid": "87c0d584-250b-450f-a88c-0e5f1890359c", "comment": "Malware payload (Rhadamanthys)", "value": "5c5e92ad673d2be1619a448a645b037584ae0541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635816, "uuid": "42cc6a65-5d94-475d-8a3b-e21eb9330264", "comment": "Malware payload (Rhadamanthys)", "value": "7574be83baf21224c9b90258d49c83e9185f1a4d86eecdd508b1e736c1a04510ae5d42df0a9dd6fd418e46595bd2d353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635816, "uuid": "2ddb0d94-a8b2-46ed-a846-197b1dd82c6d", "value": "T1A6D34A9BB3F530F8D177853985920A05F772B87657616BEF03A4426A1F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635816, "uuid": "f4af77b6-b5e7-4663-b54c-875fe97285c8", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635816, "uuid": "ca757bb5-11a1-4942-8111-b180da2dbc78", "value": "3072:Bv+zxFifIup9RzJ3oZBysYCbpPNVTGbbZ/GqWDA:jwQRzJFdCbp3s+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635816, "uuid": "51def719-6b47-4f77-af10-42c388740d8e", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635816, "uuid": "638e80ee-0992-4aa5-846f-f8dc1cb2ed03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635816, "uuid": "e4db9fb3-4f60-402d-a105-432cc22b7acd", "value": "SecuriteInfo.com.Trojan.Siggen31.64782.6013.21911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c24e2f6-b40d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761662965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662965, "uuid": "50e9ceea-b8ac-441b-81d3-6fe25368809e", "comment": "Malware payload (Mirai)", "value": "5c03007b95b6b575123dc2c6297b8674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662965, "uuid": "85dfe8f7-dc96-4eeb-b83f-bbc531078b87", "comment": "Malware payload (Mirai)", "value": "277aafa54bbdf972f77d379726a4e4340379a0eaa60206ac2992d0b511fa98a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662965, "uuid": "d56b7422-fba3-4a76-80e7-35dd7fceaec9", "comment": "Malware payload (Mirai)", "value": "2936d6edad0ede55708d5047ee197cda5ffa3d88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662965, "uuid": "4ec11fca-15c7-4adb-8501-cbb5c7a14595", "comment": "Malware payload (Mirai)", "value": "414d36c87775e12ff38f34a7537d9204cdf3ac862e2af69a2465ac8e8d5d73bc44493bc855b1d38f4e726390920c60fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662965, "uuid": "836518d6-0058-44e3-8f5b-57bc7e039cc1", "value": "T128937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662965, "uuid": "839c972b-0f8f-4b18-a9a1-d9e48a988385", "value": "1536:W/QCZaxGdvts3i5JPho3UxPu++ov5EUIKqI4FrS4LSp:WYCZa8dvm3oJPhqUxP595GKfUmDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761662965, "uuid": "6b682fb6-30a1-461c-a6ae-1ce9258a47b9", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761662965, "uuid": "e85cf59e-df8b-42e3-9f86-3c8015615fe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662965, "uuid": "185de1ba-c0d9-41e8-86e5-9cb9bbe50ee3", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e20956-b3cd-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761635760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635760, "uuid": "039b5263-93b3-4701-8263-02d0cdf92284", "comment": "Malware payload (SnakeKeylogger)", "value": "7a4a93d9fd57fe927e37b4d42f4a95de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635760, "uuid": "2eafabdb-6d5b-42ad-a385-6601d678a602", "comment": "Malware payload (SnakeKeylogger)", "value": "27970ddbf47c5d596977d0315ca00910caad322be5d733057c1389f383c29116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635760, "uuid": "dd42b755-befb-4d8e-957a-efa74ee52fc3", "comment": "Malware payload (SnakeKeylogger)", "value": "2a5adc3cec5c7623b41e41be0de42dee9b78da8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635760, "uuid": "83435d11-dfd0-46b6-9773-ea03d6614025", "comment": "Malware payload (SnakeKeylogger)", "value": "81861967da7ef835ce16c3e6aae760fde9bf248bac1b58fe03d219b5e3e76677ab6210e2e1b0cd37e581a8acadbc3709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635760, "uuid": "a4e6bff1-278c-4b11-ac00-f1cb6d786b06", "value": "T18135AE0273D1C062FFAB92334B5AF6115BBD79260123A62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635760, "uuid": "a4089054-b0d3-4f15-85c7-00f7e6a12253", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635760, "uuid": "6cc22fc7-2a0d-4e53-94f6-fad444bf59bc", "value": "24576:S5EmXFtKaL4/oFe5T9yyXYfP1ijXda+1b1EYgmFYG2/PyE:SPVt/LZeJbInQRa+h1ERmX2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635760, "uuid": "38c03b4a-c641-4c11-8d58-72c4c3afd5da", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635760, "uuid": "99c8bd9d-74bc-4079-be33-129d0e80f5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635760, "uuid": "4bac576b-56cc-4bb6-a5a5-ffc0d787b0f5", "value": "FACTURA 25551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89a4518-b419-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761668408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668408, "uuid": "5d766d13-c2f3-4002-8da8-75dca76177b5", "comment": "Malware payload (Mirai)", "value": "0aea3cf90adff5820197122e796d374b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668408, "uuid": "a0bf36c0-6a0d-4ea8-9f19-06ab666451ff", "comment": "Malware payload (Mirai)", "value": "27d5821a51c48d778fa5405296b8b365133655785201795ff6a3bcd4c2749fa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668408, "uuid": "5b2f21b5-31de-46f7-a150-63de8022c36e", "comment": "Malware payload (Mirai)", "value": "8dd85d465d2c47c0380faca7a163724ee924e68e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668408, "uuid": "409f5658-7009-43d9-a423-ccb976f607ed", "comment": "Malware payload (Mirai)", "value": "2578f3a5933048bf7ad3a9e936c47eb06863b53f7f9081e5eddbee84bd5a3f7ad1881ed2365bbc59aeae7bbf6134a791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668408, "uuid": "35eda67a-4c2f-4d71-baa9-2719d6e5ebdd", "value": "T1A613D645BC909B2785E922FABA6E018D33162BA9C2DF7007DC115F14778A96F0E77782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668408, "uuid": "f5b535d6-5947-4ce5-90b7-666749ca8168", "value": "768:pvvKSVUBR+0G5yC/H5eMChygtGopOrqO/J1GAWtZJZ2c0iUmnhO:pXKa0rG5yC/cMChygtpOBdWFAcJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761668408, "uuid": "b266e4a6-7de2-448c-9237-71e61f2e4684", "value": 41521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761668408, "uuid": "11490cab-403f-4916-a08c-097981929525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668408, "uuid": "d9649e73-9cdd-4417-86be-29805d7159fa", "value": "SecuriteInfo.com.Trojan.Linux.Generic.413614.25502.7409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac1bd4c-b40d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761662963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662963, "uuid": "c04a32ec-dd3b-48ba-9166-3f0e97f7e015", "comment": "Malware payload (Mirai)", "value": "647f7a071ed4bd3562fe00fe9eb01486", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662963, "uuid": "db1cf7a0-1c0f-4df8-bca4-ab31f8b0533f", "comment": "Malware payload (Mirai)", "value": "2803b190cc416dc6329e294ae96c7d202f7775581c32b60f712a579885f9759c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662963, "uuid": "061fa9c5-eac2-45a8-a4d7-9482212e15fb", "comment": "Malware payload (Mirai)", "value": "e13d44e458929db925e448d3b9cb848d8c441b87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662963, "uuid": "809d0295-af03-4b62-9a12-c272112b7fb4", "comment": "Malware payload (Mirai)", "value": "07d813604e53a70e1da66d5fbe92ddf2949d7109aa9da21474d25ca44455e08a49d52374f460cf121fe9a5ce6ef94dbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662963, "uuid": "ca906ca1-1851-458f-8b33-d4aac9e8c8fa", "value": "T14AB35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662963, "uuid": "d70cc994-68a8-437c-89b1-db0ab696d215", "value": "1536:WTW/VCxsHZusL2Li62C8vqKTR5/PPVGAto2WszrW+TNe7/:WytCxsLx62NFT7VG92Wcrbw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761662963, "uuid": "8cc469d4-96e2-446f-a190-77feeca6ecc3", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761662963, "uuid": "41fd2d6e-49ea-4f9f-b4af-7051888e674f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662963, "uuid": "f1e680c1-40da-44a6-8c4c-50752d7bb48b", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25c6a1a-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656721, "uuid": "4e470890-4942-4940-9792-56b0c7397861", "comment": "Malware payload (Rhadamanthys)", "value": "0f98d22181b77a1874aada06653a1470", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656721, "uuid": "1edfc66c-4620-46e5-87d1-e4fd4bcdd909", "comment": "Malware payload (Rhadamanthys)", "value": "280c4c359f935f4696869da856e0a0d98850a556aa26351459c63a6b32f82f96", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656721, "uuid": "9ac83571-1889-434e-bf1e-5b2b2c9b9cad", "comment": "Malware payload (Rhadamanthys)", "value": "d22c625709aa6e8799800a87e4d7b5a1f8f1e4eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656721, "uuid": "1a640e37-5f56-44ab-bbf6-e981c22008cd", "comment": "Malware payload (Rhadamanthys)", "value": "5227752e3538e46cc3b0d6aca7c599934b3c7b4b2b8b3038532600a19d9ecc01a63465d81b644e63c4735775ae43b2ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656721, "uuid": "e6413434-ed33-481b-829b-941365542c58", "value": "T15EA3170A3CB6BDB813A2275464E740BDF9A8DE57122351640449F33D28CC7B9F936AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656721, "uuid": "49260e64-22f5-4e81-b8b4-938eed27cd20", "value": "1536:GDB7eKg20dvF+ErVsEBfroRjIq64QSjuWuaEMTe1OAOSeeZ/Ds3e8DU2rX6BkQWK:GDB7b0RJDyW9e6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656721, "uuid": "21be7623-e2c3-4220-b21b-eef120f025bb", "value": 104043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656721, "uuid": "e5313de1-771a-4363-9a86-77d75ca5149e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656721, "uuid": "6bb91f69-6ddb-419e-bc05-53380f547786", "value": "invoice-1637482117.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1189b3-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761646432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646432, "uuid": "0d264b8c-46fd-4fae-a4a4-00c3ff48699d", "comment": "Malware payload (AgentTesla)", "value": "608da9f841a023fd6153eadd30e57ce7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646432, "uuid": "345fb3d7-0953-4ac0-b6bd-f1f602fe4331", "comment": "Malware payload (AgentTesla)", "value": "28c5e8b7d20d75a98b5a03259201fdb64fb6ac876eefd759f5536ef6ad3a098c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646432, "uuid": "77a33548-3838-4789-98ee-6fb89875f2e5", "comment": "Malware payload (AgentTesla)", "value": "00048a7876998a610128ad103b1c9c89f2281efe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646432, "uuid": "2bffb11e-d27d-41d7-8cb5-248b4c0672f1", "comment": "Malware payload (AgentTesla)", "value": "e13274d75a68d56c5c55d4e7bc866faae24bc01d102d9ea7d16ce6ef278ef945721afabbb647a728899e12968520127b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646432, "uuid": "411ccdaf-fbd1-435a-869f-606158b411d8", "value": "T126E4125033A5E903D11193F81AF0F17617B86C98A520E3568ECD6DEFB6F6F095C282A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646432, "uuid": "ac998e78-9a71-4c40-864a-5b1294a8ba32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646432, "uuid": "67db2481-1240-47bc-8933-acd67ab46bc3", "value": "12288:dcVbQSxcG9IXR55HXZFjVEGuo2/tO/XCifBqLzwr7IV8YQ+2bOxI:dchQSx3ihHZFjV2oStO/Si2Uov72bM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646432, "uuid": "c7c832de-db62-422f-8c19-f920879ff4f3", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646432, "uuid": "d2a19d86-4e8f-420d-99c0-11a72c60f2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646432, "uuid": "1fc4566d-445c-4963-8c42-d4b8a8983517", "value": "WeTransfer Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75576a9-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761646421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646421, "uuid": "280dca83-29b6-4627-832a-a802f750191b", "comment": "Malware payload", "value": "d8c7becf6b8f004b316d7e0bd32d3342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646421, "uuid": "9d402cec-3490-4a9b-a339-2dcc957b1756", "comment": "Malware payload", "value": "299802b7caddcce95481dd4b3b4c451dcc21a554fcb9a99c8f60373e73e28e90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646421, "uuid": "5f648bf1-ee05-4853-af48-57c344ae83e7", "comment": "Malware payload", "value": "98430a85d3009859e144027db2aa9cc7c356a8c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646421, "uuid": "f98f4959-a2ee-456a-960b-a9a21fbdb4b7", "comment": "Malware payload", "value": "cd5b739dbedfa6807829527928fb6bc818fe91e95a5f9480361e38b86312f392f58da433d55161637387686f65831bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646421, "uuid": "1fa3574b-d11f-4706-ac43-4a35cd1ddf96", "value": "T17FF402141B99CF06F5A55BF549A1E37123B4AE0DA920E2068FEEBCDFB035F4214643A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646421, "uuid": "3264f8a7-1db2-42d4-9ded-44341de6a4e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646421, "uuid": "ae192480-4a04-49c8-b473-70dc396a01c8", "value": "12288:evC3L/rb8WkuSrrSfUflpgyX4FyxKQpqB5TOHc2lM4mBOaJKnE+RUkT7:e87v+uSrefC8yxKd3TWMXEE+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646421, "uuid": "1cb47b5e-afbd-4e30-b86d-e527ba673d9a", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646421, "uuid": "0ea1b894-f2c0-4ab3-b3c3-4a9a8633d1fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646421, "uuid": "d8947da9-4f30-45df-a9a6-bcebe35aab24", "value": "PURCAHSE ORDWE#005464511MN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b66a283-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620953, "uuid": "9ed1cc98-5275-4c3b-aa12-c417966c0cbd", "comment": "Malware payload (Mirai)", "value": "f0e300b72171dae3ec2e64755b2354c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620953, "uuid": "71fb2822-e1cb-4808-8491-d5d9614fdf0f", "comment": "Malware payload (Mirai)", "value": "299d6c031cb611b98daca4d6a8c9d03d6cc54b8e6da9d39c845d6475f3cbe2a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620953, "uuid": "b23151b6-15f4-4349-9b0a-34b3fbe64cf3", "comment": "Malware payload (Mirai)", "value": "af50584b4478c5a407a9144fa42a6e42281e3436", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620953, "uuid": "8b625c29-2a2c-47e9-a2f6-73e0d07e4348", "comment": "Malware payload (Mirai)", "value": "d40c1975ce6579ca57cbb316cb539bdf6e5afc6938eb60371ee4145e15945fe373b449936f3d46f2d6d987656e67b28b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620953, "uuid": "f12131ea-36ac-42cd-af0f-93b28a6aebad", "value": "T116935C42B70C0E43D1675DF02A3F27D1D3EFA6E121F4FA88691E9A8591B2D321586FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620953, "uuid": "5e9733d8-9c0c-4e0b-af08-0c6f2735adad", "value": "1536:gwiReU18TQLro6XLio5o8lVBbbH7h5K0UvGW4BAfKMcBRWFMOXyC/D0QLl/HOo:oMa8TF2jb1jAfGSM1CNko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620953, "uuid": "734af714-a445-47f9-b1fd-aec28c1e2165", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620953, "uuid": "1df878d9-3ae3-4283-895b-311c70f03ecf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620953, "uuid": "adc7e2ca-d594-4917-b0d4-2ec492a0041a", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f6e7d4-b422-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761672167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672167, "uuid": "fa99ff7b-f644-49c8-b7ec-80a28f841ccf", "comment": "Malware payload (Mirai)", "value": "9ca1c8dff5e85fc4785ed56d48540042", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672167, "uuid": "9a435244-b46b-4efd-89d1-396dfaac2e05", "comment": "Malware payload (Mirai)", "value": "2a344233a93dd8f98b6797e4aa5ed6f21d2360972d150bd268537a3881dc74f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672167, "uuid": "7e1ad86e-8111-4c4b-8253-327921ad6dc3", "comment": "Malware payload (Mirai)", "value": "875bc8644cd536d97b78bbf139cd425779477389", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672167, "uuid": "46e66b2f-db32-4141-91de-c03c292b75d3", "comment": "Malware payload (Mirai)", "value": "7d860efee2c40bf819f13e7854e15cf0a3acb6d0564ab76ae8dc1789938ecbcf2766bc35732c0024bc3a261176faa6ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672167, "uuid": "1cc9b36e-a7cf-43a2-a5d6-058e36a93825", "value": "T1C8D3BF21E004AC91EC2119B538BD867C0310EE7417DA5682FFFEF99EA477DD836AD260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672167, "uuid": "9dcbc38f-7f08-44ab-965c-80e7e307ac17", "value": "3072:DuimTIUAgw3+YzEy5YR46STbxn5RvuVd0Auyk/:DvYKdzEy5W+fRvuVd0+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761672167, "uuid": "13895f70-c893-40e1-b5bf-046f974b3c08", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761672167, "uuid": "366361cb-8344-418f-bb67-dcd287c9c570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672167, "uuid": "afbc3f82-465a-4208-9ec4-9686c2a51a30", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5484ece0-b3df-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761643222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761643222, "uuid": "c0cf1d00-e3c7-4ff2-a41e-f8a8e0f621bb", "comment": "Malware payload (RemcosRAT)", "value": "f78ab7a7c4a521b281752b36a85fbf67", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761643222, "uuid": "aec6e21c-c1f4-4b2a-a81a-839c8f097c6c", "comment": "Malware payload (RemcosRAT)", "value": "2acba1b931e5668cf6d6444a63da78507cd34db9a720e6eb98ea46610c10f09b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761643222, "uuid": "ce0197e1-a2e0-4983-8fe5-b2ffd7ce5557", "comment": "Malware payload (RemcosRAT)", "value": "d91c436b07061c8b839b45c8e9fc0901f953aab5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761643222, "uuid": "5dccc819-9142-4ff1-ab1c-c4790a5627d9", "comment": "Malware payload (RemcosRAT)", "value": "15632fd7025bca28d9520b4776c45a937e21e335ff63cbb11ea0f5653e8459173bb28d5976196747b2ed88bdcda15d53", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761643222, "uuid": "89c66b77-a3ad-4a01-9731-a848a4c3b342", "value": "T19203B65C7E509D6C2237B73A5EE99005CAAE9C27CC31BD06BBCC748C4F784624265EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761643222, "uuid": "cac822d2-f238-4eb8-ba55-5cd28cef945c", "value": "768:iIGK7RnMRkUZpncBqn+q0Ngjz/JO7DDTicBOMFhAgcoBKjcT2cy:H7RnMRkUZpncBqn+q0Ngjz/JO7DDTicG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761643222, "uuid": "682afb8e-96a4-4cb2-84db-7ec3f207109f", "value": 39549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761643222, "uuid": "45e94aec-4af5-4b0f-b7b1-8e104ebcdae9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761643222, "uuid": "ddfb29f4-242d-4c53-b797-adb99e1fe036", "value": "pwei090230sdf0f230sdf923090dsfjkjkkdsjof02303090ewsdf902099fs0f9.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0a4492-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656687, "uuid": "4edc26d5-51f8-4a86-a440-d50026326fb9", "comment": "Malware payload (Rhadamanthys)", "value": "fff1f3532f32b98e3f775be44a06bc69", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656687, "uuid": "c1ad34bf-cc15-4503-9400-ae0e9e37a194", "comment": "Malware payload (Rhadamanthys)", "value": "2c0fb8d5faa007afbe132cb108f7966c8c80fc257f905874a7b059b2432000de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656687, "uuid": "ffabc606-5724-4db3-962c-76f24a707d1e", "comment": "Malware payload (Rhadamanthys)", "value": "5c9ac61a9dd9ae7c9d7d62a2f1a8ca86b08373ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656687, "uuid": "d3f43ff4-6771-4783-996b-e20425248ab2", "comment": "Malware payload (Rhadamanthys)", "value": "a1d7cb6978b7fd8afd0130450cff3ef13288a2a77e108280ef5fb0be2b6408d8845fbe4af83a07c321335f558f4a409e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656687, "uuid": "0e3e1919-8e5f-4306-bff5-51fe0ed33173", "value": "T17AA309077750EDB0821DF1727ACCABD26E6FADCD54A00060F44BE72395A4A3728999F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656687, "uuid": "24c2dd63-1f95-460d-ade7-5e1a091bbbdf", "value": "1536:GDB7eKg208YprxrI4Kfu0zNSlAilcHQL6BkQWJ+aY:GDB7b0xtd4dQL6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656687, "uuid": "40517938-8e03-4de7-acea-5623eb6cb5cb", "value": 102667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656687, "uuid": "d688df84-fb3e-44f5-8246-89abb4cae37e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656687, "uuid": "c0d7ac82-d392-4a1d-9fd5-8aee46549899", "value": "invoice-1637482117.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e61548c-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656553, "uuid": "113b15b9-c1c2-4308-a538-87fd6e357768", "comment": "Malware payload (Rhadamanthys)", "value": "c73d88fa71b3f1f548155cce199a45c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656553, "uuid": "bba6826a-6459-4c5b-8d70-631c96817180", "comment": "Malware payload (Rhadamanthys)", "value": "2c3e0860a4eb813f27f9b6c7dc49422e7242b7a02d91388309a03a8c7bc8504f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656553, "uuid": "d04ef778-09b2-477c-b706-df17318103cb", "comment": "Malware payload (Rhadamanthys)", "value": "083de5aeb5da62eb109ca610ddac60b3b436d63a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656553, "uuid": "ec2893e2-be82-4c80-aef4-f15eeb00c504", "comment": "Malware payload (Rhadamanthys)", "value": "4be302cd499abd7e82b482ec5da72d037f9260cc25c102e9ef0bbd611eceb7a4c77eeba45bc48866849ce2e80dff493e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656553, "uuid": "6cde7253-7690-4b17-bd1d-b94e565a30cb", "value": "T163A30B6A083E58FD85AAF5E94E4CD497B80345B6AA6271CC4D5FFB317080B2B30F94B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656553, "uuid": "fc1d720b-d4e7-496e-a41e-67021913eea9", "value": "1536:GDB7eKg206xZJfrIrY4MaQAuf36BkQWJ+aY:GDB7b06xZJTGtTuf36BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656553, "uuid": "abd6cc89-8589-4209-83cc-c9518535f873", "value": 104059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656553, "uuid": "76f511d6-f0e7-4ed5-9afb-132c03da9e6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656553, "uuid": "db3f0812-0340-4694-80cc-6277d60f4d39", "value": "invoice-1637482117.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c802831c-b41f-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1761670904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670904, "uuid": "7f6450c0-f9a1-4556-94ca-1d4c117463ba", "comment": "Malware payload (RustyStealer)", "value": "828d1cb86b3c616e84a527f93911a629", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670904, "uuid": "10b67c79-5a7f-4eec-94c1-3abadb3b2263", "comment": "Malware payload (RustyStealer)", "value": "2c67c1181a38c5be2205833e2d88de1e8f42fe5d7458d5b3ee669c6e50f5c6c6", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670904, "uuid": "f74b9ee4-3c42-4f01-bc56-57a3ef2a376b", "comment": "Malware payload (RustyStealer)", "value": "159d073153b24050214453132ad430fb8dc05710", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670904, "uuid": "2af1c1c2-34ae-403d-91cf-535bc5fa5654", "comment": "Malware payload (RustyStealer)", "value": "c7d67243e7cd4ae01a76f696bfc9f178bf8b9a750582a30a8ecc162e13ddd91b858858b9031310c860f33a8ed72bd127", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670904, "uuid": "41b11ca7-7dcb-49ea-a422-f8753fe4ee3f", "value": "T1EF463302B9A14436C55741B79D6AC7BC922AFC000B159BC796D41C76FFF93F20AB0B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670904, "uuid": "43554ba4-95ce-4510-b6cf-42ab339e3594", "value": "89fa639e427cd8c6012df4a19c312d06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670904, "uuid": "7c6881ed-5a6c-4dd3-8758-c3d8cf8794a4", "value": "98304:+npjNMyagKC7K+KjZvcne4SPfZ0U0Jn+fcjlT+X8Tq0dAUh8lGtN4WMeC/:MpeypnK+KjlZ50UmjwX8G0dA08mzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761670904, "uuid": "1aa9c8c5-e3d5-4661-b182-ec8085ca87b7", "value": 5613056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761670904, "uuid": "e1a42fc1-7848-4c3a-83e6-308d0ecc340d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670904, "uuid": "25660dad-f100-4be9-a58e-381ef2ce1931", "value": "steamconnectgh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781dee95-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620948, "uuid": "1e597661-3b17-411f-8517-643b38d01321", "comment": "Malware payload (Mirai)", "value": "abfc6c07e4fb54aaceee2fc86a561681", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620948, "uuid": "b3cbf2b2-f245-4e02-b7fb-401f3572da44", "comment": "Malware payload (Mirai)", "value": "2c826d8df656e5cc50813fe788009e1f51a98c9ceab4d4a627284ce0a685a06a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620948, "uuid": "e537403a-1501-4f4c-91d6-37d5697a53b8", "comment": "Malware payload (Mirai)", "value": "e69cde2640845f2022e0d16c244e039c92cba8ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620948, "uuid": "be8f0a76-c43d-4ab6-a525-7f2923554dc2", "comment": "Malware payload (Mirai)", "value": "15dc4887ba6468bd5d9f3af09ecb5c39473b20e8bcb3c30b49721d01d792f122564b76031672cf92abfeadac895b1700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620948, "uuid": "0e74e59d-6b39-40e6-9dae-b8e09380cbf1", "value": "T1A9433B95FC92456AC7D117BA771A968A336223A9C2CF7313CC0C0A5176C9B4F4E6BB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620948, "uuid": "1d43d529-7d14-4645-a4aa-8be9627bcad0", "value": "768:cxao+g6Z6nGYbl8d6s8n3WkZDJmrdDKPkv4f76uwyMRE92FH0nzz:cxao+ZajeAHWU1mrdDKPkiwyXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620948, "uuid": "8622717d-d855-4073-9fbf-e4d48dfba38b", "value": 55344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620948, "uuid": "fdca420e-4b72-4069-8b2b-3f9e28dfb8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620948, "uuid": "dfc650a9-37f7-4bf9-86ec-3ad903d221c7", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8f18d2-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761639961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639961, "uuid": "7430cfe0-99a7-417c-b1c0-338fd0b7f792", "comment": "Malware payload (AgentTesla)", "value": "4aaadcfd3c4d68d42c570e3d642071d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639961, "uuid": "120c91e7-07da-41a0-bdf3-a7aa26562a89", "comment": "Malware payload (AgentTesla)", "value": "2dfc505ca30d1a766520422bae06186f571edd5e6e19fec0659c29cb09b3d88e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639961, "uuid": "fb4b5463-861f-4339-9079-4397509bbe9d", "comment": "Malware payload (AgentTesla)", "value": "f4a36af96b594945c44445149fd5066f2aa19bbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639961, "uuid": "99bb6395-58cd-450e-952f-404c4db8c1fe", "comment": "Malware payload (AgentTesla)", "value": "4e77737c0c1725790473580b4e18ac312b6893626d8cdbac9a309855334eb1454efbcc6922ff382ed46b42fd8c161b07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639961, "uuid": "5037db6a-750e-4764-9be7-5118e7ea4f92", "value": "T1DF45021149C86FB9DF9C5E1D80BE261E93F0068B402AB989FB3BBD46AFFB544410B1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639961, "uuid": "d3108b1a-1e89-4dad-ab34-2588fbb75378", "value": "24576:UF4M/KCtNyql6lQYGEnRfOu/ZwWOUoz5wyKcjmt+YW:bCiBjnNX7xyKcKtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639961, "uuid": "da92d898-c936-4276-890b-375c04cfc34d", "value": 1249926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639961, "uuid": "2d6bfb40-c84c-4d4f-827c-0b717d28c66f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639961, "uuid": "d4b0186a-f89a-4ff2-b769-3480171dbdba", "value": "SWIFT COPY 00017161-27-10-2025.PDF.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca5b5bc-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654027, "uuid": "0528db0b-06f6-4318-97fb-b2f055496a95", "comment": "Malware payload", "value": "d946af41343c65278a8513a85938c7a6", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654027, "uuid": "fe69aa92-bd67-4055-8844-5cc7ed278e46", "comment": "Malware payload", "value": "2e174bed224b9433ed8d3cc0f922b626a541c528edd1e8be79338f727151aff4", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654027, "uuid": "3193a166-5541-415a-b442-e7e59d2d7685", "comment": "Malware payload", "value": "ac2e47c6405640657f94e072772153c960512cab", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654027, "uuid": "af5e3f30-9985-41b0-907b-4b1fc91adfbd", "comment": "Malware payload", "value": "83d39efa66b32c928b3f884dd8cd8fd14990561c3330c6913cdcf87732b6bf3f07a81716a823b2e136e44c208dfce42b", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654027, "uuid": "f1387833-a19b-48a5-8ad2-12a9cace98a6", "value": "T141A252393D9BB404A93DE616957FA315E8A9348B9D018CD334C3399327037DA6AC35BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654027, "uuid": "43d26bab-3d24-4045-a54d-f5eeafbcfe2e", "value": "384:P9nTAxQTKm+XcV/2ljKfft7h/QYwdTy+euo3/mFoZ8y9:P9nTAxTxpoBhY3dIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654027, "uuid": "609d25ba-655f-4fb2-b92a-b02a620d3367", "value": 22131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654027, "uuid": "936f165d-a769-4346-a7f8-8c22c1f1cbef", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654027, "uuid": "579105b3-b07e-4d6b-8847-d485618e2f73", "value": "kion.odd.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf33537-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656522, "uuid": "0c544256-a142-484c-86d0-49e1c65be715", "comment": "Malware payload (Rhadamanthys)", "value": "19fd8be88fd48ac11cffa31fb539b0a5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656522, "uuid": "5a2b46f6-09f2-4864-a856-9d996d9151d8", "comment": "Malware payload (Rhadamanthys)", "value": "2eb576a0c46bb8c672aa9835b025d9f88d8837e7508362b9bd0fd2bd6da17dce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656522, "uuid": "4c94048f-f744-4a32-8640-11360adfcad0", "comment": "Malware payload (Rhadamanthys)", "value": "9d6fc38d1c1d000f8ec6ee388c5cb533e6fa21f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656522, "uuid": "c222b2f9-7b34-4919-ac89-47480a39b485", "comment": "Malware payload (Rhadamanthys)", "value": "786136d0a3b74f5ff8bec61341cc93e49e79f469ac8404608494d42f11fd0091c1c4048d53f159daaa7627a3aac52f05", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656522, "uuid": "8238fef8-c137-446d-bd44-74498df1ea4a", "value": "T1D9A30B13A732C874077B59F39A9C0556C3066761A0949E84F14FBBDAEDC9FB0AE802D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656522, "uuid": "fe922d0b-6923-4292-8d8f-4e95f020e268", "value": "1536:GDB7eKg20zlrHrC4OLrs8AWRSM86BkQWJ+aY:GDB7b0hLna6M86BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656522, "uuid": "5f847d91-d671-4b99-a5d9-c8f1e6f9f542", "value": 104128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656522, "uuid": "3e67cd22-a9f3-48bc-940c-68cce1711ff8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656522, "uuid": "4a806523-c1e4-4554-a35b-e2e83a4ea86b", "value": "invoice-1637482117.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0124487c-b3c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1761631915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631915, "uuid": "15d26d54-78d3-43f5-939c-25dbd8792ee2", "comment": "Malware payload (Vidar)", "value": "bb3d76f75c234302cf4beb5eefaa300e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631915, "uuid": "2370bc33-9e9c-4b72-9152-8b0e164eabab", "comment": "Malware payload (Vidar)", "value": "2f2ff80d2fc6ddb9dfcd73725e3fc39d27325cfdacda43ffcdaf2f325e690041", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631915, "uuid": "ae0f84ff-d662-42b2-8a4b-34ab6375296f", "comment": "Malware payload (Vidar)", "value": "39056aaddf601d6cf0cb3788c349c5140bc9fcc2", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631915, "uuid": "af82029e-dce7-4e6a-8f61-cb28f9089a66", "comment": "Malware payload (Vidar)", "value": "b6139cf7d6f0e0bcf7b83ec44bca3b0b8e593231711acb6eeb88870994ca5d21a1ae9566ddc65c7576839d2669a93f53", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631915, "uuid": "0682c6d0-e65e-4a12-99c0-3c056d61309f", "value": "T185D57C077C9408A5C0A9A23088669552FB39BC459B3227E73FC0BB3D2F77AD05E79758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631915, "uuid": "3eafc2de-d4f0-47c1-a752-3801e15a0316", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631915, "uuid": "45c90efa-81cf-4f5e-9eb9-76a586fd6903", "value": "49152:iVlyf3IdAv5zuda7TzNRUzAiPnOt0esKQ/jZm:inq5uUTzXsSfQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761631915, "uuid": "e1bb81b6-5745-48bb-bc28-13aee14f9496", "value": 2805248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761631915, "uuid": "847f347b-a8d7-4928-892a-60fe87665bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631915, "uuid": "e3c2a0da-debd-418a-a97b-4c4c92dfaf0a", "value": "oStarteZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9710643f-b3f5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761652783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652783, "uuid": "32f2b4ae-288c-45b7-b65d-be8143c9b492", "comment": "Malware payload (Mirai)", "value": "3a44599953ab16b35aa4d7360e128a8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652783, "uuid": "33062560-2e1b-4e83-a808-45e7b9f1ec0f", "comment": "Malware payload (Mirai)", "value": "2f36c84ecd116c670a65ec78304566245b985d0638325c526af1d18b5546bc8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652783, "uuid": "70d92636-bb0a-41bd-a920-95da1c95f977", "comment": "Malware payload (Mirai)", "value": "645673c1d537bc2e76b27646ac2b2730863d7998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652783, "uuid": "e920891c-a9dd-4174-9694-c0aa2337cd64", "comment": "Malware payload (Mirai)", "value": "32488b6bfdcdb1e4010d04331ed3ec1cffda5bcffe0a742891732a143fd75864d5b5fd3cda6913b53c95380986e15964", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761652783, "uuid": "efd888ba-13bc-4ab4-b250-4e9d42c36fcd", "value": "T11DD3D021E4046DD0DC2109B93C7D8ABC0315EE7417E662C6EBFEE95A643BD89396E370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761652783, "uuid": "cb6a7701-164a-42b1-a564-359639039411", "value": "3072:aaiNIPAgjyaoBnIv4+Y9GA2H67FJOSahE:aLpaoBIw+4KH67FJcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761652783, "uuid": "7f9c48d9-9a38-4fd7-a40c-5075da72cabe", "value": 131804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761652783, "uuid": "2d01837e-8723-4dbb-8518-b6b1546e2941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761652783, "uuid": "8056cd5c-4fbd-4ae1-baec-2b0577438420", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f88eb5e-b417-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761667400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761667400, "uuid": "41470854-9c10-4abe-8d4c-05ff5c000fcf", "comment": "Malware payload", "value": "8860d1429f42c5da9af57b526bd91aef", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761667400, "uuid": "14e43699-b7d0-4d0f-8043-80e96dc6039c", "comment": "Malware payload", "value": "3066a243dc42eb2040288b56f9311741e0ae58b631959311f1cc5f20f9cd84a8", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761667400, "uuid": "f04d9a1c-d329-4446-b07c-10506df3efd7", "comment": "Malware payload", "value": "17a20dad53272b69aeec92b1e3c444a59d4c64c0", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761667400, "uuid": "002bde1b-e3bf-4584-bd81-6365ce38611c", "comment": "Malware payload", "value": "fa5da0731009c94451d196fd0cff328b4741145c624b6744d8f0956e9a73ae1a5f37353e60baede506fee6440409c5d4", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761667400, "uuid": "2584cc74-076d-4687-a496-11c2b10b6480", "value": "T199337C01B3B0C463EAB506711D3657BB7FBB98216450AF0707A06E5E7C32292DD2E29D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761667400, "uuid": "ec63004e-4c92-401d-b6af-4ef12db54dfa", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761667400, "uuid": "590f328c-2152-4b26-b740-10c3d53049a7", "value": "1536:SOcZR8r/mNh6a3Ba0DF6Lt3uW4Romu/Gd:Fca/q6CDF6Lt3uW45b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761667400, "uuid": "358e00a9-4cb3-46c2-a0cc-543ed0ab8fb1", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761667400, "uuid": "df0a79b4-e124-41b5-b672-5187e7920eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761667400, "uuid": "b5548eb5-b934-477a-afb7-fabb5bfd196d", "value": "Orden de compra_______________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2726b1a-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761646413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646413, "uuid": "79b4f6f4-3e3f-493b-8d82-c7e335c37099", "comment": "Malware payload (Formbook)", "value": "d954bcb82bb68d254bf719657109d794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646413, "uuid": "aa79c429-1644-4202-a677-937636d73a57", "comment": "Malware payload (Formbook)", "value": "316c45f8b534bc2c99b20578da82f9766f437db5109d98756f6247cad4d4fc0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646413, "uuid": "7b3ead14-aa52-49f4-ad93-e3be1492f64b", "comment": "Malware payload (Formbook)", "value": "348f02be34afb97172e2ea6732f9af696e8f6086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646413, "uuid": "e593ac29-8efe-47c5-8f8b-0d2266a4459f", "comment": "Malware payload (Formbook)", "value": "415ded2123f57cb719526bec707b0c9f975f3b9a886928c6eb969de30a6626475e19ee53c71b1395fb6bf80a591de29f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646413, "uuid": "4888b0a6-7441-4f45-9986-23ceb0be5f4d", "value": "T12345BF027391C062FFAB95334B5AF6115BBC79260123AA2F13981D79FE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646413, "uuid": "1b1d6420-94e2-42e3-9f1f-f5c3e8a26a45", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646413, "uuid": "fb6822c1-47b4-4ecc-af7f-ed0ed0e8294c", "value": "24576:Z5EmXFtKaL4/oFe5T9yyXYfP1ijXdaAx11lFlvV:ZPVt/LZeJbInQRaAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646413, "uuid": "d37d6ea2-caff-4cfd-91fb-4ef8db0b9428", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646413, "uuid": "c2950123-8777-4d7b-8cfa-0f662c081cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646413, "uuid": "827a0795-04e0-4009-94f9-52164c856938", "value": "IPES - INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdf7c9f-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761634618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634618, "uuid": "3ecf5683-e128-4ca0-b049-5eaf560b15b9", "comment": "Malware payload (Rhadamanthys)", "value": "da173922486f3844c79b0214f83712cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634618, "uuid": "f16fd083-78fa-481f-abb6-4fe86f178455", "comment": "Malware payload (Rhadamanthys)", "value": "3243a2f59f30a2116c85f7817349e3be67d773b728cf7ace1b37a315f0ac6443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634618, "uuid": "bdb888c0-28f4-4381-8faa-8142f2653ac1", "comment": "Malware payload (Rhadamanthys)", "value": "d2d1fe5471e4486ba284b3b4c0a473d36f56f73b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634618, "uuid": "725271b1-b68a-487b-8730-382f5b1f64c1", "comment": "Malware payload (Rhadamanthys)", "value": "7f1a7f700c39cd0419917e56c42b9bd05b0581592190d2fe960aabe5500e89414a083b070c918bbfda93e716ea11a84b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634618, "uuid": "65250d9a-810d-4cea-b85d-163207318b00", "value": "T1489533AF5BF3FF2DE9D48F363C950986945CAD1D006668C41A44F2EEAB17BC117B2086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634618, "uuid": "a859d44a-b800-4831-bf6e-bd7b2ee75982", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634618, "uuid": "b5242875-3869-455b-b5cf-ae4a2773b7d9", "value": "49152:cha6kp/RDq+1Sr5byLq+seh+w7psz75DYQQp8MDzCW:qaPVRDqoSrAciEpYhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634618, "uuid": "e928c62e-7fb6-4661-94d0-7dad71f3eca2", "value": 1992704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634618, "uuid": "c8c4a666-9b06-4357-9cf9-c15b0d73ea79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634618, "uuid": "ccb82cf0-2917-42f6-9315-261c44acee3b", "value": "3243a2f59f30a2116c85f7817349e3be67d773b728cf7ace1b37a315f0ac6443.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eda0b32-b3fa-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761654889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654889, "uuid": "f2516e2e-0ce5-4585-9988-d60847b63e28", "comment": "Malware payload (Rhadamanthys)", "value": "cd7d0ac1371e10f1b28f0212aa5d6254", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654889, "uuid": "24328b81-14b1-49cf-a817-a9f94928174a", "comment": "Malware payload (Rhadamanthys)", "value": "328480a342e113a8f89078d4ce6b015df498c3b27c4dc2fffc9d4cc6c1430090", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654889, "uuid": "d6ba2d17-463b-4f27-be52-914cd4b36235", "comment": "Malware payload (Rhadamanthys)", "value": "f6af6a00b703d3028de34f8f41aae453bd07d392", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654889, "uuid": "85f4b070-bf34-4548-b42c-caca46290dfe", "comment": "Malware payload (Rhadamanthys)", "value": "c3c20bef565abb6bf59c95f176a4018468e19b0c14b9ceb3560c2bf57955d3d60a42f154674fb719dd1093502b5dc832", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654889, "uuid": "2d61b065-4f7a-467e-ad53-38e07b847163", "value": "T116F533216F69AD2E07BC663DA03F1E1D4A654A5BC08CE5DAF38490CF1B7DB11416BC2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654889, "uuid": "c04b994f-e30d-47fe-8678-463cc017dc78", "value": "49152:9p7ksW7nsBI08KwIr0Khk14pbQJfjzWuABQHSuVeO7EyN:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654889, "uuid": "715e5595-4570-4a9e-9021-a6d501ef1d08", "value": 3466625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654889, "uuid": "d85ade2f-74ca-4f79-804d-f227f4d9866d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654889, "uuid": "2decfe68-c3f6-4ab2-9594-5810598fd18b", "value": "eiden-sol-interactive site.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0759c8-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1761640367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640367, "uuid": "ba40ff46-b407-4ae5-a077-54e6f4ba8cba", "comment": "Malware payload (DonutLoader)", "value": "0d0b204e44581a8839df1d46727ba30f", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640367, "uuid": "c981540b-8b35-47fa-a940-7b669ee89aa7", "comment": "Malware payload (DonutLoader)", "value": "32d605dc2e89607318b9039a6511ca4c91d770f9dfc514d89fe5232c7b269008", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640367, "uuid": "aa19a346-0938-49e5-8819-0fb9dd75108e", "comment": "Malware payload (DonutLoader)", "value": "9edc9dae1e4c240fcca41a36415fd54c3b8076a6", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640367, "uuid": "58334966-ca2b-4b71-a272-1f89b9acebbe", "comment": "Malware payload (DonutLoader)", "value": "2e47e66295566a76f58c9d923ae0477c0f8ff9e6443fe577a6e77964ce1279c9c4d0e3c38c1cd6c61b96e62217619ed3", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640367, "uuid": "451ebf8f-95c1-491f-b2a5-1075bec5a823", "value": "T192F49E224B76F6E786243C5B94647D4922A1343EAF53FEBE9C6283CB591325CF441ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640367, "uuid": "d611a237-9557-433f-973b-db089ab54c43", "value": "12288:LyiWR7CGA2wNlhO19Rd6V8iLt45eomplYZbyatCLUP/3/803ID:Lk7CfUYVwLmwd33cD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640367, "uuid": "8e6de09c-4e60-489c-a440-5ae21df49bca", "value": 738855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640367, "uuid": "08935f5c-dd3e-4aa7-9ee6-d766c7b390b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640367, "uuid": "27cbad2c-567d-4231-b28e-f50aeeb72145", "value": "LC Proforma.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac2ab7a-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620952, "uuid": "86f244e0-1369-4f9a-8988-1dcbc034bf85", "comment": "Malware payload (Mirai)", "value": "3cd8bc2874c578a24fa5c760ae2201e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620952, "uuid": "0e404c4c-1db4-4691-b45b-439c4d5680d6", "comment": "Malware payload (Mirai)", "value": "33145a434135fcf53e3b9021962369255e76e07b642175504226077a2b20cae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620952, "uuid": "67e95b11-8cf1-4657-9d3e-54f52512116b", "comment": "Malware payload (Mirai)", "value": "b563529e4c71ed5d3563363701cb78c249301b88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620952, "uuid": "d3cb6b0d-a2f3-4fc3-9973-6b460378d96e", "comment": "Malware payload (Mirai)", "value": "a8ab8587562b66d9d75b46125879f5b3fddaf4f89a542ad9612cdd925b2ef6a58334dcc08b2c8ab8630ecd1c239f67e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620952, "uuid": "9bdec87a-76f9-4b33-a762-fb517c305750", "value": "T166936D42B70C0A43E1574DF02A3F57E1C3AA66A120F8FA89790EDF4996B2D325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620952, "uuid": "b1767a35-6caa-415d-a61b-bf0ac3714c96", "value": "1536:qf9jbHKubuZqESdJmL00CZ0MaIy3qTfl3GwT1fm4ymM/0l1WrFVfTAeG2+c:6/DHTfhGaymMyWr3+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620952, "uuid": "4db5da2d-e38f-41e7-9aac-08762e91bcf9", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620952, "uuid": "bdbc79be-c0b0-4509-a93f-549e9e501e51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620952, "uuid": "c4d7def3-a703-452d-b85a-f6987b6ae794", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccce9a1f-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636122, "uuid": "236deda3-428c-48eb-abbf-da8ee149ba01", "comment": "Malware payload", "value": "a00e921130a72ba035b9697eaaaf9baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636122, "uuid": "2bd78a9f-14e8-499f-9ac9-3f70b995b6e6", "comment": "Malware payload", "value": "3341ccf4f8cf4480284a27c1caa73fc4a4e42509f279cd073b87010d34eea1f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636122, "uuid": "4fb64893-e75a-4768-9a27-ae7d993fc834", "comment": "Malware payload", "value": "939dc279a104816e06099babdf62ddbf4d1ebf94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636122, "uuid": "1d9d5f20-ab40-4a83-aca0-3103477f449d", "comment": "Malware payload", "value": "af8ece72d373454e16bbff0b427c38d10a69875c41fcc77291ce0ece3ccb1e1d7efe5aca95254f7bfd9b92195e31d4dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636122, "uuid": "b320f2ac-4da5-47d8-96a5-13ce3908f922", "value": "T1050633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636122, "uuid": "769a3107-89b2-453b-b122-2980583ecef0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636122, "uuid": "fef171f6-80d4-47ff-b0a1-c8f834d2a40a", "value": "98304:a3T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:E2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636122, "uuid": "7381f6be-5f8a-4d8b-814b-f1578af23dd1", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636122, "uuid": "3a74aa16-5c71-4fb6-b675-a409b084c31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636122, "uuid": "93598fe1-37b8-42f6-889a-437a34d244f2", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917c1e7f-b3c3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761631298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631298, "uuid": "b958bd6c-b708-4e48-a751-e498499837f0", "comment": "Malware payload (Mirai)", "value": "02d03682613f599c1ef78b7165fdf829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631298, "uuid": "fd22c263-48ea-4c53-ad87-aefea6992a18", "comment": "Malware payload (Mirai)", "value": "3355e0e1089c7f56e7d89ac87e9726ad9132d773c120342787eb2113e6956f32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631298, "uuid": "6d06b4af-4dd7-40bf-adf7-6594143e0033", "comment": "Malware payload (Mirai)", "value": "827ed4690ef806b61114750684d368df08694875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761631298, "uuid": "da1877e7-8b9c-4eee-a187-0892ccedcbe3", "comment": "Malware payload (Mirai)", "value": "cc3e79603fb0fca0f34f4768f23b03fa35454651552ea952bd036eafd96aebd8b5fd948f105c899097190cda0fe9b92d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631298, "uuid": "fb930794-d2eb-415a-a947-5aef8a87438a", "value": "T1444301DA43E28990E06322BDD99FAFC5CCE838A26626BCDE45DCA1791560F5C6334941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631298, "uuid": "7d033365-4cd5-48f7-8e37-930d343af51b", "value": "1536:VKbjy0nYaFYORtcHhW+LxW/md/cZ3AUUnouy8HyD:YSqYLUc3LOumARoutQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761631298, "uuid": "69c9c4e4-7b75-4def-901c-09b78fba11a1", "value": 57416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761631298, "uuid": "bad04caa-26bd-4f90-8d81-6446d8174b1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761631298, "uuid": "e9857e94-9a7d-4c35-9ff4-b4fdb858d554", "value": "Orbt.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd80663-b42e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761677165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677165, "uuid": "6babef20-dd41-45c3-bb0d-20ab968f889c", "comment": "Malware payload", "value": "05d4dd227161452455926ca64145bcaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677165, "uuid": "e133ef00-60d1-436b-9789-ccf477d01a29", "comment": "Malware payload", "value": "33e1e49c79bf62ed7b32f55fb9eb69502ffc72a53f314a0a1cc8b730c689e397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677165, "uuid": "94ca637b-7526-4956-91b0-f1003cef6f29", "comment": "Malware payload", "value": "0e6935f5ce9d87e8cb524fe6fa03e94912e50a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677165, "uuid": "973a5eb5-d918-4e1e-9a10-c7509b64261b", "comment": "Malware payload", "value": "531824c12b5267d6e86fddfcf7409d7833c4b1fb123896b2219b2fe4180b99853ef2bc3ec22a85246634b87b0af44e77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677165, "uuid": "d5818905-26d7-49f3-a13c-3250a9a4f38c", "value": "T1FC83028FF7C28676C72A6931D11319505D7A0D82F65872A7ED4FC236C3A0BE9A4E14EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677165, "uuid": "f2891ffd-bc12-441d-812a-4b480009eef8", "value": "1536:6cui8FAU8wy7Gu8QV/sf2GjLcwJfiqTUWbr216NA5lqY0qgkZ+tum/8QAHJxRn2h:bGAAyyuTsfHLViMXbhC5/zZ+TAHJafCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761677165, "uuid": "85863d8c-8ca7-445f-985a-f904333c3a0b", "value": 85976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761677165, "uuid": "686f5b49-ea73-44db-b3c7-8e74ddc43ab1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677165, "uuid": "a713b3b8-f9c3-498f-8016-84494b0fb4f6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626a7670-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761639809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639809, "uuid": "3d56c60d-3a65-4b84-8fe1-9134f0fa55bb", "comment": "Malware payload (AgentTesla)", "value": "62f1449eb60cc07c2a1c12fdba0d68c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639809, "uuid": "f49f9d8d-5195-45ad-9c9c-7649625462a5", "comment": "Malware payload (AgentTesla)", "value": "34d613d18fd8a0c329ddad86b243015c4178c635540827fef992ed35901398c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639809, "uuid": "4f44e3b8-2730-413e-8cfb-07700a594695", "comment": "Malware payload (AgentTesla)", "value": "847e38c28b6941f4b6b28cba9759af651bc86316", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639809, "uuid": "d8ddf7ae-226d-4052-bab2-74802c1b2bb5", "comment": "Malware payload (AgentTesla)", "value": "e513fbe2a27e20a37aef6badf142f57a2a20d342e1e3cf4c10494664ce96a3c37033deeeefc3c21321171fe0f921c321", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639809, "uuid": "83d95c04-b4b2-4285-9470-e273c06b71a6", "value": "T1E045F1158EC46FB9CFBC5A1840BE161E63E04A4F506A6589FB3BBD4ABFFB544010B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639809, "uuid": "275a686f-2ffe-4224-ad5c-d65d5efe7ec2", "value": "24576:FfUI6JfzzfUIA4mY7MFMiV6xz5hJp69s42iZk7cvs:UlzfDRphr42iK7qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639809, "uuid": "5fd641ac-ae1d-46a2-ae68-321bc6e655a8", "value": 1261546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639809, "uuid": "dc9c566d-f38d-4309-a40d-f0c4af4a6dcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639809, "uuid": "aa9d42ec-4307-4cb9-80f2-78100b5e5f80", "value": "New Order 264418.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc91154-b420-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761671420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671420, "uuid": "ea1881f5-bd28-41c4-894a-f8a0af553d7b", "comment": "Malware payload", "value": "a585bd115fe406327bd2e81150052926", "object_relation": "md5", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671420, "uuid": "33726af5-6d8c-41f7-be22-21322fed5303", "comment": "Malware payload", "value": "350be6dedca5632a6ed7164c160480fe009707646e02256704ddd3c92c7a3edc", "object_relation": "sha256", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671420, "uuid": "28d4bfa5-22af-4afd-9083-603bcfbe1872", "comment": "Malware payload", "value": "4a28fa7d66fd36cb70e39432c2612af6d7a302b8", "object_relation": "sha1", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671420, "uuid": "7c944484-a68c-433e-832a-351104967279", "comment": "Malware payload", "value": "e5bb70b8edc7ec584cb4ed6d231d40c7c2e774896207f0e73c0845c03ff5a4d3edde36fda934af695abb73d733e50ca9", "object_relation": "sha3-384", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671420, "uuid": "ece7163e-dc24-45df-9ecf-7c93595648dd", "value": "T1C1755C23FE5585EAC559C078835E522EBAB2788A0720B6EF1BDC0F243E56F915F1C364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671420, "uuid": "58c34765-b407-43f6-a9d3-652b81579a0c", "value": "af0199946ed5f2b1b5fec75e379d5a86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671420, "uuid": "469dc02c-0b8f-4e7e-9f6b-dd65410b3512", "value": "24576:sXGVP254/rLFaJClcW+vGfjDWE1+s1Y2d/W4wExAfW0qvIt:sXGx254/rLsJIcWTHWE1+GY2doEiSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761671420, "uuid": "74a61df5-4365-47f1-937a-b68c94a67c22", "value": 1673096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761671420, "uuid": "7c6b65c8-2759-4250-a422-bf755cedfee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671420, "uuid": "0f4d573b-7bff-416f-9d5a-738da75cf9d4", "value": "updhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b191520-b42e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761677163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677163, "uuid": "9a694dee-87de-41d0-b0f0-df798684ef9a", "comment": "Malware payload (Mirai)", "value": "52c955064d1c94eb51014d721b773a87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677163, "uuid": "bb9f01fd-4f67-49a0-bf0c-ffa5f69f60ac", "comment": "Malware payload (Mirai)", "value": "35526decee139f93ae802148dc5ceaa660160ee38359b813fb040ec2319750d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677163, "uuid": "32a470de-30ad-4b19-8dc6-bfa1323ddd99", "comment": "Malware payload (Mirai)", "value": "21bed57907c3ce65f6eef23ea9d05a100c59070f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677163, "uuid": "bf616fa2-b38b-4b66-ad93-2ece3ecc639b", "comment": "Malware payload (Mirai)", "value": "bf0a3090a71ab8a38a3ba629ff0be8ea931f6711c80fdd0a864a4a67ea93e58ba377311fe1864b9805def09af0cd0861", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677163, "uuid": "846eddaa-18e3-4aa9-8cfc-ecac073a11ad", "value": "T1A3D3F85AB8819B12D5C615BEFE4F528E331357BCE3EE3203DE245B2427CA95B0E7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677163, "uuid": "0a9b6dfd-bf97-4803-a799-ca2d9efaff9f", "value": "3072:g0uJ7hIRtZRnUoSfsUZsPXeoh5XtX9r/eeEX5vaDEIHAiern1VP:ruJ7iRtZRnUoSf9ZmeshtX9r/eeu5vak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761677163, "uuid": "1c021c55-e21e-43fc-917f-254691588fa9", "value": 130484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761677163, "uuid": "97602e40-cbf2-4a5f-9a54-7fdf7530d3fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677163, "uuid": "b6202b35-6c7e-4c0a-90f2-b9f4ac2a2775", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741f5e13-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620941, "uuid": "c12b7238-e176-4cfd-8541-f47c57c0748e", "comment": "Malware payload (Mirai)", "value": "17942dd8f7a7f91ceb8d2cc954558314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620941, "uuid": "8ffd3d02-7e1f-4f63-97bd-274a8ce001e5", "comment": "Malware payload (Mirai)", "value": "358ad6a038f7cd610edff0b4b5bb8f9d5373da0afc36b46df43f5238b34afd5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620941, "uuid": "45421f76-e18d-468d-b800-d848dccd4408", "comment": "Malware payload (Mirai)", "value": "b88bfbdaede02f9881b9055eca3655e90079ca0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620941, "uuid": "913625e8-ed3a-4fc7-ba88-9ec81bf60649", "comment": "Malware payload (Mirai)", "value": "5d071391b24947065762980062be41027f61beb0325d651ee8bec90d6080e9a91bcfa1c299d3b102a30c068524726aaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620941, "uuid": "fd43727f-fd6c-4b22-b33b-59a7938c51cb", "value": "T17A433C95FC92456AC7D117BA771A968A336223A9C2CF7313CC0C0B5176C9A4F4E6BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620941, "uuid": "54af0d1c-3171-45b2-b5ab-7860d6244e4b", "value": "768:cZRao+g6Z6nGYbl8d6s8n3WkZDJmr9DKPkv4f76uwyMRE92FH0nzz:cZRao+ZajeAHWU1mr9DKPkiwyXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620941, "uuid": "dda26df1-e4ec-4f73-bccc-ba8bc533af09", "value": 55344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620941, "uuid": "a6b7eb4c-10d3-4aa1-ba1e-2d44d8992f7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620941, "uuid": "3ebb2b53-d26e-48ea-b200-b24367d47a3c", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878503b3-b3dd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761642449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642449, "uuid": "57e053dc-3a83-4395-8617-2e245e46e717", "comment": "Malware payload (Mirai)", "value": "4bfdb1542096023a7d34e920831aa95f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642449, "uuid": "685d2441-1fdb-4647-bcfc-595c9287d956", "comment": "Malware payload (Mirai)", "value": "3603af9e23dde6c26df9ce10dfd954add74790926f4df983d0d77919b9a897fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642449, "uuid": "9158a346-efdf-4861-8797-c64907f61456", "comment": "Malware payload (Mirai)", "value": "ddd73989654da824b98022974ded6de55d9b6d63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642449, "uuid": "d05412fb-50d2-42b4-af31-350d3fadca96", "comment": "Malware payload (Mirai)", "value": "670133188ba4fb410ee2579345f47aa9b92f2d2c99e1c0c996876f15a748c2c8b22b80cdabd6ba70eea5823e6bbc95bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642449, "uuid": "73135acd-824c-40e5-9a06-3a6fda34f999", "value": "T14B04A71E6E228F7DF669873447F78E25976823D627E1D684E1ACC1101E2038E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642449, "uuid": "7542fbe6-babe-4ddb-9df0-5e05684e1c6a", "value": "1536:5FusXuIShIzSRjmMeYeVm2wwd8TdhLkyPXP5sgAefIg1SMONTo2MCGiIxg3ksv/A:5nubiN4duyPXxseIg6fjczsvb2tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761642449, "uuid": "3f07c3ea-7b9c-4846-9713-260d679efd36", "value": 181980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761642449, "uuid": "9e2aee4c-ac37-4475-b847-9489ea3dfb34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642449, "uuid": "7e02aca8-e0be-418d-b2f3-0a18bc62efc2", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8077e338-b3b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761626975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626975, "uuid": "407027fc-b4b5-474f-b524-a3887686c955", "comment": "Malware payload (Mirai)", "value": "4272f5f54b3b6655373fd8c5390fa8fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626975, "uuid": "561d12bf-d91b-469f-a576-eea9c9a3a7de", "comment": "Malware payload (Mirai)", "value": "360a0c7247b024d028ffb9f9631ef4220e92c7c070ac014b9fb6ddf0aca6fe32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626975, "uuid": "601d6f53-63fb-4082-83f8-a71eb0718ebf", "comment": "Malware payload (Mirai)", "value": "795367f27976477673306e2d334abcda88ffc382", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626975, "uuid": "e5eaedd9-8d72-412d-8b59-36cf5261c7a7", "comment": "Malware payload (Mirai)", "value": "4b7e2b6d088b117e622edb30a190272ca74630e866485baf82e2b1bc02a37e1cbb77e78c927c2f236a7311da7ee5d237", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626975, "uuid": "c782cacd-44ac-4065-9ccc-f91da39fc104", "value": "T126F33A2F258582F0FA411B746BCBD3976C290BBF519990DF6B416329B6E0B7BA03C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626975, "uuid": "29add1f0-96b9-4046-9171-6f8a9bb304f8", "value": "3072:6K60nFC158leTYpz6d/ZHWZg/Nl6T8OsNDbIKUIdN2j34Ao55uWUVy:6KiJozqEg/Gb+D0KLf2kAo5Mj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761626975, "uuid": "7e2af3ab-878b-4bc7-be27-de274d807ca2", "value": 172756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761626975, "uuid": "9596d5eb-451c-4f4c-b4fc-1b981f4e0a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626975, "uuid": "d4713444-33b8-4c31-bf9e-809baeee40fa", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78aef9f5-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656597, "uuid": "3d1ce275-db9b-4a05-acb9-95e0cde7a151", "comment": "Malware payload (Rhadamanthys)", "value": "90dc0e12c58d51714f0701a8b92144f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656597, "uuid": "ee75d326-64bc-45ac-8aeb-a97327354b92", "comment": "Malware payload (Rhadamanthys)", "value": "365f0d740161c54aac8b0e3553425a59537f84b84e627715319bc290a52fd157", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656597, "uuid": "bde768ba-233e-410c-acc1-eb7889cc1767", "comment": "Malware payload (Rhadamanthys)", "value": "5db4632ce88402d88158831f3c476e16a84611c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656597, "uuid": "1dc38188-80f9-4b0d-aecb-c0a46a98efe7", "comment": "Malware payload (Rhadamanthys)", "value": "3728e610fe5671ffa85667b7caae767cb49cd9ff1a4e05d34ec55a600a884b1630f5c4ae35a2b93d6194ac7d9f955e09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656597, "uuid": "db51719d-c659-4d95-9f05-8a618477970b", "value": "T1FEA3F9AD1E867BE0329712BABCEC35A1D4D905CC489E16C5880DFAB3B7E48455F352CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656597, "uuid": "a0b29652-9de7-448d-a2b4-22dfb64181ae", "value": "768:GDhd0i7J4sYKgY/CMNfWdC58LiWg9u6PZIMjImIuxLiM8x836AuCA/EKG3a4eSvb:GDB7eKg20ErGra4G1HAnNl6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656597, "uuid": "04fa0d6b-82b5-462a-8ab3-f85cee1354d0", "value": 106686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656597, "uuid": "a28c2fc8-46bc-4c40-8f42-152e275fcd08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656597, "uuid": "c5aece9f-1183-4edb-85ef-da9bd5d22e6a", "value": "invoice-1637482117.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df16ae8-b3b7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625951, "uuid": "025896a0-7556-43a3-8f62-8ce501714353", "comment": "Malware payload (Mirai)", "value": "19b772fe07b10f5f6455ed36fbdbf59b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625951, "uuid": "b54e5f6b-02eb-4261-8f90-b9cab516c60a", "comment": "Malware payload (Mirai)", "value": "367d2f567b2b318282e3cd5a389b481205d4161bd2811f7cc5f728eaa154a3ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625951, "uuid": "1992bb89-4165-4660-b2aa-2c5c56d07ab5", "comment": "Malware payload (Mirai)", "value": "6a5ec95f85712d853951d590f3f1bb9522717a84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625951, "uuid": "87314f4d-58b6-4e8c-bb93-db1024e64890", "comment": "Malware payload (Mirai)", "value": "9ead980c3d07cd02a1a0b295877d9df38382494d067fcadcab856ba679026a54ae2bb4eeb1296968ce7f5b540a742d0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625951, "uuid": "5eefb5d9-0884-4b94-9eed-9d0190935753", "value": "T152D2F17B04BB25B2E3506975BBED4408F3A2AFFAD2FAF9503618E900794611585BC34F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625951, "uuid": "75739788-4647-482d-bdf5-0928f36682d4", "value": "768:o5e+o6v9QOdVSpSQaA66faeZtqeMvBBms3UozBu:6o89QOdKsA66fj3qeM7zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625951, "uuid": "a5b1d8c1-5d1e-4b31-a23c-f6ed141c0419", "value": 30584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625951, "uuid": "2cc8d6e4-837b-4227-8b11-ade96bfac954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625951, "uuid": "4c4e330b-e6e8-4196-a456-d0ba330720ca", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55d6630-b424-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761673047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673047, "uuid": "1bdf80b0-b6ca-4b4c-941b-eb001e8da3b8", "comment": "Malware payload", "value": "9fb3a5de46a4af25b41650fd83f4be9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673047, "uuid": "c0e400c0-6d7f-4afd-809b-6eb1851ffffa", "comment": "Malware payload", "value": "367e3d7e6d78f6b4f58b24b38a9ea240a15e7a6f5784d620a5b9ece5393f20f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673047, "uuid": "716ec202-76d9-4cc4-ac1a-4265e8e14675", "comment": "Malware payload", "value": "0793750c89a0e6d620b1b511d01008168ae0110f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673047, "uuid": "970caac8-b854-4082-9f4f-acd3d95db9c7", "comment": "Malware payload", "value": "f7c026c716139a359432ca8d5cfb17224bfdb25db8168d2f59084d076ac4d401a190eae002d2fd053d771d1fbf35f248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673047, "uuid": "753f7ac9-a438-40c7-a1ac-f29fbcb89456", "value": "T1F8E5F52EA894016CF359553B8F65B0412A627E8DBB2312E32950B674DBBD6CFBD35F00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673047, "uuid": "9b8d2272-b5e9-43b9-a165-e6f6b8545180", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673047, "uuid": "f937f12b-65f1-4f96-b54d-efcd1f04bebf", "value": "49152:qziXP+rkVFtplzFFeCR7VcZPobDTQRX/NZWa:qSPplneCQZPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761673047, "uuid": "0af548e1-4af9-4c23-a6ed-9fc1e76c876a", "value": 3020600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761673047, "uuid": "75e0fbc4-1e0c-4f4d-b47a-889a9506afff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673047, "uuid": "3171877d-3734-453b-9d88-844491b93734", "value": "DropCheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d89544-b41c-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761669316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669316, "uuid": "d13af07a-3251-4b41-b5e2-df8fe61d79e4", "comment": "Malware payload (ValleyRAT)", "value": "23b1bcd605a8e8411d355dbde1f10ffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669316, "uuid": "6fd52e61-591d-4900-8e8a-836107fb7034", "comment": "Malware payload (ValleyRAT)", "value": "37d27fc9336fd3f8cfe7aa2250f00e4e61320aef8a39542c8eb79a853150e692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669316, "uuid": "9290dd06-ce79-42a3-a614-66986286996e", "comment": "Malware payload (ValleyRAT)", "value": "c3129d04b62a65c51c463927675abd458df08d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669316, "uuid": "e7a7ee83-8137-4172-a234-2431a549ed63", "comment": "Malware payload (ValleyRAT)", "value": "6d92e78e08aeae68ac75d66e0af6d1b9dd0fcfcc4351c3ba1fef6d406b93d907b043f29f8228c1f33d966e6c4ceef7ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669316, "uuid": "1ef6dda5-4adb-4be3-8e87-d3dbda4ed7da", "value": "T1AB460812F9A50EEEC76052358AEE16862374FC041F37A7971E06763CBD7329A9E34391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669316, "uuid": "9d9c261f-e3ff-45d6-a104-12785cb32fa5", "value": "1a733893f17330a2cd9cefe59730b35c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669316, "uuid": "e2a2de4c-58e2-4767-ab89-1483ff8a8b80", "value": "49152:G/o1kQ4Ya53oWfZi2bhTljGZAfaRIxmIx2Ir0023ta9Wox+kxub7VBsUDx:G4mwCiRIxmIx2Ir0023taWkUb7VBTDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761669316, "uuid": "46246596-0aed-46ef-9f58-a2ee9c72bdeb", "value": 5728792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761669316, "uuid": "12ea90b1-3a1d-4dce-9eec-bce1ba926a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669316, "uuid": "5bcec65c-a63c-42bc-a73b-12a3d3d1147c", "value": "37d27fc9336fd3f8cfe7aa2250f00e4e61320aef8a395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae548f5-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761635824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635824, "uuid": "78b5a640-a4fe-44c3-99e1-75cc03ece8c0", "comment": "Malware payload (XWorm)", "value": "8e82a765efdef39552f0b89cc2a5d588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635824, "uuid": "db0b81bc-4c24-48ee-9aaa-7b489a157fb8", "comment": "Malware payload (XWorm)", "value": "3936bcc208f5f650f3e15181e6d548f877bb7044dde04a369f10332c483c943d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635824, "uuid": "de3bc437-f1c4-46ae-ab9a-c02cc722ef21", "comment": "Malware payload (XWorm)", "value": "1426d6e75850d0b68e0bc23302b7d6399f401f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635824, "uuid": "c50c8d88-efa0-4e4a-a9bb-f801fe02d284", "comment": "Malware payload (XWorm)", "value": "caf180d03c21563a2d63a955dc1a3d583192ba73a49aa9807d1db2a867107909ed8bc704856f3146f71fe9641cbd1c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635824, "uuid": "6616bdce-388e-48fd-b2bd-598c440e83e4", "value": "T14F35FA2E9A742027F19BC2745AD8996BA8155D373500BC1EFBC25F9A23356C3B4E132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635824, "uuid": "e1efb92c-220e-4785-9bb3-fd8526330946", "value": "4bc42344b2162829504e3a30dd031d34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635824, "uuid": "2c12fd8f-9002-469b-97c5-400aae558b04", "value": "24576:MwSrjhAk+KsM+YCCjyD6atrz9ZP7DGhqSdXFIlBb:rSr6k+KsM+YCCjG6atrz9ZTDGhqSdXFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635824, "uuid": "b3032760-e5a0-46c6-8be0-755266c0542e", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635824, "uuid": "a553957d-964d-4ef5-8074-e903f4094cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635824, "uuid": "7831204d-76fb-4b40-8ae9-d645d366b39b", "value": "SecuriteInfo.com.Win32.MalwareX-gen.41185839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338ff83b-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761634577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634577, "uuid": "82359290-d73b-47cb-a949-ec5fadee228c", "comment": "Malware payload (Rhadamanthys)", "value": "b7cbf93c87d34cc15e1e6182b5b6f89e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634577, "uuid": "1ea92ce4-5b1d-4b6f-ad34-bfe3f3def89b", "comment": "Malware payload (Rhadamanthys)", "value": "3990c9e75e5538f4665549e85e7b9299bc24779f9f75768a9c87eaafb7a37ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634577, "uuid": "5418fca1-64f2-4aef-880e-3670eb9e4bde", "comment": "Malware payload (Rhadamanthys)", "value": "e85df7356db03d8de420193d67f386c86c220494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634577, "uuid": "07e7ad38-2eea-4fd2-9b15-6ea63cd95bb9", "comment": "Malware payload (Rhadamanthys)", "value": "40269cb6946245dc8eeda403725cd815dd1585b7095d704cde26f5990b8dd48c6ede1a71e72e664178a0677e4169eac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634577, "uuid": "416ba160-4fa7-470f-958e-67df3882a483", "value": "T13C95338E2EEC662CE6C302BACDBE75023DB4BD240D3E9D85105ADD641B5BFE72230565", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634577, "uuid": "30eced93-502b-42a4-b0d0-71221dfb8b78", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634577, "uuid": "24eac5b6-e4d9-4a66-b6bb-f7a3bb410dd9", "value": "49152:kha6kE9q+eHL0cizSjospCBbcFVOlCN64:CaP2erfo4KYFs4N64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634577, "uuid": "d28e3c5f-08e9-4337-b308-2725606a0fa2", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634577, "uuid": "462ba529-bfd1-4e16-8d95-38b84b1dc10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634577, "uuid": "a224cce8-adc3-4488-a0ad-f9d41061de48", "value": "3990c9e75e5538f4665549e85e7b9299bc24779f9f75768a9c87eaafb7a37ab6.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd36c58-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (MetaStealer)", "timestamp": 1761636154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636154, "uuid": "176da5b8-3005-4966-b282-e16fc6a18b56", "comment": "Malware payload (MetaStealer)", "value": "36f9ef1c2594e6c20d78611388703abb", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636154, "uuid": "bf90c28f-508a-4a32-81e9-443930a93371", "comment": "Malware payload (MetaStealer)", "value": "3a9651409dad8212889ef296dd670c6b2f797fc31ca27ff0ea70165876ee9e4c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636154, "uuid": "b77f455f-03fc-400d-8f18-765f0797f54b", "comment": "Malware payload (MetaStealer)", "value": "ac23ca802b5c13fb3b74c49ac095add6d53ffc27", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636154, "uuid": "a5f1ff27-4c0e-4914-a9e7-89618583f11e", "comment": "Malware payload (MetaStealer)", "value": "140208176abd76ea111f58057dae44abba874818f403e973dc6b417d87794028e69c30f520400a4590d76166933d6f19", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636154, "uuid": "76793878-359b-4833-aa0f-1fd32c927031", "value": "T12551F11127E90769E3F35E3F58B6DB158937F886DE21CD5C029141481866B41EC34FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636154, "uuid": "114440c0-c5c3-4bc2-ab92-1a5a93cbe0df", "value": "24:8tJfIA5f3JMAyx+/5++y2Wnm2YLMu/Sbdd+5Cww9dsquWgncWgssqMmkZ:8T3PNnyxnmpLMu2dyRw9ducBBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636154, "uuid": "a196a650-f853-4a16-9f14-76269a6b471f", "value": 2965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636154, "uuid": "c4ae5f51-09c5-49ea-862b-97b48841eb7d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636154, "uuid": "871a4506-e3e8-4274-a56a-57b88f72087c", "value": "manual.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8632459-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761640356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640356, "uuid": "1a0a65d0-72f9-4188-9d99-c4cb13c5ff20", "comment": "Malware payload (RemcosRAT)", "value": "628902913a4f173ba8c8a590e6d20322", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640356, "uuid": "c3100e47-eb57-44fa-ba8c-6f31925ca1fc", "comment": "Malware payload (RemcosRAT)", "value": "3aa368339720e867c6853c6157828e58a2ad5d19281e9f09786aeb0f3918366b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640356, "uuid": "79dbe6d1-838e-4953-b4e5-b42ddf18dd08", "comment": "Malware payload (RemcosRAT)", "value": "09d67043fad08fc82190b38bf3b9f469899a4983", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640356, "uuid": "9127596b-8d0c-4777-87aa-a86e314dd639", "comment": "Malware payload (RemcosRAT)", "value": "d79b504a73f579c510fce15e9149378fd6a4966d7b6adf8f7ce73076af6c845ebec5a98fa5684f619d62453e9c31d694", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640356, "uuid": "26d14eb0-84c4-4bf0-a69a-371ad9838703", "value": "T1D29307B2D92C03271D87279DEC42ABD1C5AE89A51D1300E0BDC917CE540B5ACE7BDA6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640356, "uuid": "b0e4eae5-3f15-41cf-bb17-291b4e72439a", "value": "1536:qQ00JmB512lL8Cc2wCaivWDd1K3JvG88fV3wu33hH1bwxRNvf2YcFFdaBijAa6:qAc71qL8Cc22ivWDd1svGndv33mNXId8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640356, "uuid": "3b0b84f0-4642-4a26-bf04-f952dc4a8376", "value": 95791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640356, "uuid": "6706fa5d-4748-4276-89d5-5e151476b0a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640356, "uuid": "28504f2f-b156-454e-9456-c12d1992080f", "value": "SKMACPATCHTECH116456437673474344377.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76231a04-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620945, "uuid": "d9dc19fb-a22c-493d-bc80-b899205323a3", "comment": "Malware payload (Mirai)", "value": "125956a3b6f8d2671fd5c4410d5c9917", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620945, "uuid": "5d35317d-c4b4-4bbf-9ccf-34de8203c078", "comment": "Malware payload (Mirai)", "value": "3ad2c691fe3f6234ce74c0c353daaca6ab7d3e0f398be5707f6b1bb11cefbf7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620945, "uuid": "39b4de64-170c-41e5-a1ab-acbbda2cabe6", "comment": "Malware payload (Mirai)", "value": "236d7d80782bab1f17143cb600cb046e8f2eb687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620945, "uuid": "2b47c9b6-010f-4eea-995d-784f832bb2b0", "comment": "Malware payload (Mirai)", "value": "87fc6cbea37bd8a3284b3dd4f9b28a1a8e699cda01c4730b30060996d69e041eb1a2fcdfcc741347254b45b1c558be70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620945, "uuid": "3960161f-52c5-47b0-9d96-6698f3da3eb5", "value": "T12FC3C85E6F218F7DF768873047B38B21A75933D626E1D685E2ACD6005F6034E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620945, "uuid": "f6791b97-5041-4c35-99e9-d93373bc8623", "value": "1536:Y88H1Lkwwe4eypjkqJ2IzjvCLEu7Qpa5VB4nbHGvcEtueK7N5mt9puW6:Yr1L/wvZkyD+B4nbHPEthtiW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620945, "uuid": "d9c5a59d-20b5-47b0-8393-086958b8bf1d", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620945, "uuid": "fb751ca4-e0d4-4049-8b96-dc58ae8c61c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620945, "uuid": "419ddb6d-9d01-4709-bf1a-9a6476476ea8", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9034f61-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761646397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646397, "uuid": "4659a1cb-2f6f-4100-afd3-6b152d4970dd", "comment": "Malware payload (RemcosRAT)", "value": "514a6cac147a0605cdaf0f13a47227ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646397, "uuid": "f8d8ccef-d390-42b8-a31e-0f8d9a586886", "comment": "Malware payload (RemcosRAT)", "value": "3ae3632d7f687acf67c869b0dc08c49425bbd9689f9dc263546226ded355a451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646397, "uuid": "7c4c6dd9-3e1c-47ad-bc87-2a3e5cc68524", "comment": "Malware payload (RemcosRAT)", "value": "421fc2149ec6a6a09cd2686b759596bd146d5bce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646397, "uuid": "6132b4aa-4263-48e8-958c-d7f90fb8c439", "comment": "Malware payload (RemcosRAT)", "value": "0cc76691f68596c32ec91ca5320ac8a59a9f2449fcca16d7ef543a0aa390df9931558266c296bcbd480249ff1ee3c1e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646397, "uuid": "a30267b5-b649-4fe1-82e3-b6fae66d9d0c", "value": "T10DC4F161721ADD07D85217F018B2F271023A2E9C9861E50E7DEC3F6FBAF67121C46A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646397, "uuid": "f234fd26-e841-4d28-8f3d-1478e2f21add", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646397, "uuid": "54c667e1-ae4a-4d0f-ac01-f5d5e00df9c0", "value": "12288:CcVbQ/Vy/oe8koYEPTwvBxvNMS1hNlszZWfHrbcPIzbbNs3yREwDLHEAmD:CchQ/u5UXEvBxvNrfszZWfLbyw3Ns3yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646397, "uuid": "6209bf6a-a23f-4094-af30-082b8896fee0", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646397, "uuid": "4c7a3d9b-a262-401f-aacd-458cf13f2e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646397, "uuid": "0f53f7e7-11dd-420e-ad88-f800c3859e90", "value": "964727_Pending_cheque_payment_receipt.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1549bc-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656682, "uuid": "fa8e22fe-8f06-4ec1-b17d-b45fca11f1d4", "comment": "Malware payload (Rhadamanthys)", "value": "223eb2878cb17dd45ce8c04c34338c9e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656682, "uuid": "c9737c7b-c03d-42a8-b1db-717d2110e87c", "comment": "Malware payload (Rhadamanthys)", "value": "3af5fded066eee75b6599c8493ea7b0e2ded13aeaa5aabadc3d56c5ab9644893", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656682, "uuid": "14e9101d-1ba4-47c8-82ed-787f4ac17475", "comment": "Malware payload (Rhadamanthys)", "value": "b37cc0cc4e716e95a9be0d83c7831b1ce1ed9702", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656682, "uuid": "0e88697c-3e2b-45de-81a2-a9b7f0d19c8a", "comment": "Malware payload (Rhadamanthys)", "value": "f6416008347965775e33c931430a34f3cc8eb5b7f46876d88499d511bbdfb5a53de44e3d79b380d6d73244a4c2e0021b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656682, "uuid": "cb5de04d-b227-4e93-8711-de18a2ebb4fb", "value": "T1CFA3E88C140ABFA84BC8B43C1D8E01668C6BEAD9D337E964C3EFB7A05997724D4185D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656682, "uuid": "3590c122-b016-4a40-8bb1-ddcd2aa196d1", "value": "768:GDhd0i7J4sYKgY/CMNfWdNVNlrX5NrFVC6H9WJisAH16USLAuAAroQW+FF+Ec+0G:GDB7eKg20fr7rFVCYsAH0U6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656682, "uuid": "98751cad-eb09-4e39-84bd-c9cd7c569a34", "value": 102700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656682, "uuid": "5cd2144f-ea70-4bdf-bdc0-0d59fe67f054", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656682, "uuid": "e6b2c6c9-ca17-4171-afa7-2e08ffe56c8b", "value": "invoice-1637482117.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5a915b-b3da-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761641145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761641145, "uuid": "c1ac3d93-b17c-4ee4-9f28-6ba1e24ef10f", "comment": "Malware payload (XWorm)", "value": "41464f517d0cebad9fd9282347240106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761641145, "uuid": "f14fdfd8-461f-448c-97e4-3efdfc5ddcfd", "comment": "Malware payload (XWorm)", "value": "3b8a9b0dae33231ffbcd8be82165f9e28547cc79ae52678808058886ce4e8e9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761641145, "uuid": "49f65343-1542-41af-a291-a3aa0d0fe61d", "comment": "Malware payload (XWorm)", "value": "2b16dbc369b66c0e7ffb7fd7601b94a0ed8c1b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761641145, "uuid": "67a73024-d51f-4570-a867-6bc325840406", "comment": "Malware payload (XWorm)", "value": "5b0c96a3c1ebd592ade9eef3d0c9a174152cd9993ed6fb55c69731abdded518c6b6b5533e21fc182d3f386e6cf1659ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761641145, "uuid": "b6d6a78f-48d3-446a-8500-bb6a4913dd39", "value": "T18E350B2EAA742027F09BC2745BD8696BA8155D373500BC1EFBC25B9A23755C3B4E132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761641145, "uuid": "66561d59-d052-4cdb-a193-d1d1383192fb", "value": "a297368fa98cfdebbb8825b18caf4d31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761641145, "uuid": "1b5c95d0-6cbb-479d-abfb-89bdd6f9179b", "value": "24576:+7rjhAoMCOK0t2tcnz7d8mDx+bl6FaKaw1itX:0r6oMCOK0t2tWz7d8mDx+bl6FaKaw1iJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761641145, "uuid": "f399ecb8-273e-45d0-8f84-366074092442", "value": 1114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761641145, "uuid": "80d00dae-691d-4e64-b15e-287f46904275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761641145, "uuid": "7dd8a994-6008-49e4-9670-9bb0503a79c9", "value": "SecuriteInfo.com.Win32.MalwareX-gen.49848356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c77864b-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (GhostSocks)", "timestamp": 1761635827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635827, "uuid": "d0f744c1-d15d-4d85-802f-09804cc71be0", "comment": "Malware payload (GhostSocks)", "value": "e84cd0da971df54b0adf93431ee1f3dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635827, "uuid": "55e853c3-344e-4d59-9bb3-05c4cfc86c06", "comment": "Malware payload (GhostSocks)", "value": "3e9f2ba5503a3a9ba04d3bae7432ed39a430bc30b0554808739997f7cb136114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635827, "uuid": "ce1a9664-5ef0-4d86-865b-d16b7d7c2622", "comment": "Malware payload (GhostSocks)", "value": "92cc177c9d2271ca4029da83d400f6acd724cd52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635827, "uuid": "1b2f4daf-28d1-4c33-ad89-b10ae6ce705d", "comment": "Malware payload (GhostSocks)", "value": "4e9ba5c0e08b729de11d1307e4f8b20184493cf2707c66812889039666cee461a9cbcaf20dd7003802277d3e5b2a7b85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635827, "uuid": "1b6b5b40-6ec4-484b-b883-d057f8961ac8", "value": "T1A5C62311AB619122F2FA3D73DABBD6D1C42ABC6E2250454B11C4BD1F399C617BE9323C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635827, "uuid": "06a2c42e-e83f-43f3-8276-3eef112fdfbd", "value": "196608:ELZXhMZGr00OSs3WRhP/5MH2d4jhlA5AoH/iMN8WRmOxPMxgmBhlFZ:QZKD0OSsWPxBAoKM/2xg2hlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635827, "uuid": "1d110d59-3299-4fc4-9954-9843cfbf14bd", "value": 11804672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635827, "uuid": "32c0f140-c0ba-47df-b3cb-b0f7665ad7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635827, "uuid": "cd1f5495-ec41-48f0-9386-6cf617f0f877", "value": "e84cd0da971df54b0adf93431ee1f3dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1845840b-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761635820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635820, "uuid": "9bc0407e-ddeb-403d-b267-25d998f10430", "comment": "Malware payload (Rhadamanthys)", "value": "dca54298307832c655c07af797060504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635820, "uuid": "9869eeb4-f29e-42d9-97ab-871c2ef0c244", "comment": "Malware payload (Rhadamanthys)", "value": "3f66e4abc5e49e0f6f5dfae3c76e8cf8d87e7874b68050f7aa2589d6d7d5c76f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635820, "uuid": "6f6d35bc-c21e-43e5-80f9-47fc2bee17d3", "comment": "Malware payload (Rhadamanthys)", "value": "183629f8e0779e4462d1fbfb6fdfdb7e9e381350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635820, "uuid": "f8fa3661-c437-4f9e-940b-9362392d3d3a", "comment": "Malware payload (Rhadamanthys)", "value": "a78734f8b32a162b540f4e256c3a16277bb66f1c58f8f9f90ab86644fb94b49840a9bec4aeaf912fa6a6182aac72f8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635820, "uuid": "ff3f73ea-a03d-4071-91b3-ab58da137f08", "value": "T1F8D34A9BB3F530F8D177853985920A05F772B87657616BEF03A4426A1F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635820, "uuid": "9a2322ae-64dd-4aca-8714-a712f3c8b336", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635820, "uuid": "ce37552c-68b1-48c6-9158-a6c7bdde7749", "value": "3072:iv+zxFifIup9RzJ3oZBysYCbpPbVTGbbZUGqWDA:mwQRzJFdCbppszA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635820, "uuid": "ba052819-179e-4a22-a100-6edd33eaaf69", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635820, "uuid": "e122fef6-3588-488c-a283-cb692aa531d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635820, "uuid": "f91c6a55-7f34-4d3a-bbe1-1f4eb463f495", "value": "SecuriteInfo.com.Trojan.Siggen31.64782.10061.31643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f4ba36-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761639787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639787, "uuid": "7e35ed77-06c9-4633-8618-c890a1575f66", "comment": "Malware payload (AgentTesla)", "value": "b71f9aae7bf33cb0e64557e8d18a2fd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639787, "uuid": "2a5c392e-7158-4c62-b92f-4222a6487bf3", "comment": "Malware payload (AgentTesla)", "value": "3f7ac7e60df9a3c6997533c2a2532985c689e53300fa9503d7179dba93f7988d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639787, "uuid": "a5fec606-0312-4370-82e9-08014a76890d", "comment": "Malware payload (AgentTesla)", "value": "78411412238761505191036ac37fca1fb2fd0ae6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639787, "uuid": "963ef2d3-ff19-4e50-866c-a22be575282b", "comment": "Malware payload (AgentTesla)", "value": "04fed82b839e30ecb0b5911d878361436214fc473cbcbca0fdb14e8abccd2bc6d22a63846d7531fcfcfaa2eba0095a97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639787, "uuid": "b7704a6d-0327-43cf-8a00-c24194b3a7cc", "value": "T1C0A533F57102FF6596C25419520050CB772336232A3FF36167A23A6FA1EB4E66F6A122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639787, "uuid": "48d0988e-ed5d-437b-8cc5-1595b8d1168f", "value": "49152:G0vQfrWojVhk3WGktktUXpeOHTwdk1DnBBO1:GZT1U+wUX/zwdYnBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639787, "uuid": "f0335c5e-7c2c-4273-b543-a89cb165df3f", "value": 2097757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639787, "uuid": "066dc6be-d717-463b-8afb-1637ff022dc4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639787, "uuid": "a54d1aaf-4733-41a3-9075-fda753a821a1", "value": "Payment Copy. 35kusd.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d7d633-b3bd-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761628803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761628803, "uuid": "a748b53b-c79c-4777-ab33-0dd9b107b026", "comment": "Malware payload", "value": "933fda87d4e96d2b836abd28d4cc3e89", "object_relation": "md5", "Tag": [ { "name": "BlueBrid", "colour": "#D39089", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761628803, "uuid": "a235fe59-4314-447c-92a2-1e88150bbd4a", "comment": "Malware payload", "value": "404f3111d97de7afeb1cd4f3c8b338381b7d1347b7e45ce55e218a08c2e99502", "object_relation": "sha256", "Tag": [ { "name": "BlueBrid", "colour": "#D39089", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761628803, "uuid": "c22344e0-91c3-454e-bf58-9309bbda56fa", "comment": "Malware payload", "value": "2a3b39bf8d75c4b7f4231a562a96534804c22e5b", "object_relation": "sha1", "Tag": [ { "name": "BlueBrid", "colour": "#D39089", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761628803, "uuid": "912ef13b-23d7-4d10-8ab3-5171b88226e9", "comment": "Malware payload", "value": "e64b6b5e4f110377381001dd9b7f42ec80ccd5eccc530705aba4b2445aa60157911bedfaf2708e9e3805b351a03b0928", "object_relation": "sha3-384", "Tag": [ { "name": "BlueBrid", "colour": "#D39089", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761628803, "uuid": "b3f5766b-1931-402f-8baa-238c68f86866", "value": "T1E4135CA38D146CD2ED4AAE70F1D88527BEB672822E8184C7706C85C55F833D53FB819D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761628803, "uuid": "c4780ce8-f15b-4857-bcbc-9b712133f6b2", "value": "b28b9b353aa8985c6c7b7db3091e7346", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761628803, "uuid": "3bdbb4a0-5750-437e-88b4-09e191ae093a", "value": "768:rrL0f5zLlhnX5CeNEuLSoQujmzLlhnX5QMJv:w5lRcepL7KlRWMJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761628803, "uuid": "e58be56b-cdb2-44f9-b963-aebafea2e434", "value": 43088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761628803, "uuid": "163301a7-1ca2-4339-9e63-a621d53b254e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761628803, "uuid": "6934d74a-caf9-4137-a4c6-a6077cb2bc42", "value": "404f3111d97de7afeb1cd4f3c8b338381b7d1347b7e45ce55e218a08c2e99502.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f277b9-b442-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761685686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685686, "uuid": "a0c309e2-5451-42f3-9d88-b799362557ab", "comment": "Malware payload (Mirai)", "value": "3ef9d75fbadbbcd23b17311a935a208c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685686, "uuid": "bee3c742-0810-4278-8dad-f7b42fb3183e", "comment": "Malware payload (Mirai)", "value": "406487d96cf20f42e17b06300d7369fe005e8a822213d7641e8201f235a7493d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685686, "uuid": "8a3501bd-40e4-4239-b966-191fab97c217", "comment": "Malware payload (Mirai)", "value": "44b87671f9109a9d14835a2768589ffbec4f54d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685686, "uuid": "4925b5d7-daa6-4106-9b68-8ce60aea1e8b", "comment": "Malware payload (Mirai)", "value": "505f42069179aec346b4f5ee95518e44612e11823ef297ace60801286d322848d75b8faf9df68c7a9e10d1b7ccfd6ec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685686, "uuid": "2476bcd8-cd97-4c67-b885-f53eaa808077", "value": "T1DC532942B69180BEC18AC6B447AF857BF931BC241214393E7784FB752E36E316B1D662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685686, "uuid": "53b0a94d-f86d-4600-b30d-51c1a14af99b", "value": "768:HLC++g1DRSKjpHePt0BuFWd3M7xxqQX8N8hc5XlABbm15ZcsQ6cPEzEro4Nu:x11UtanYxxqQX/O5XlA4Zu6AEorK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761685686, "uuid": "b4287400-bcbd-4681-a086-3f1858c5ee12", "value": 63336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761685686, "uuid": "b9320f41-6834-4084-8dba-a1dea8b40f8e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685686, "uuid": "4d9196fe-9344-435d-b6d5-78f9f09743a3", "value": "frost.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef9a469-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761639777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639777, "uuid": "c4573d95-a4cd-4c47-abe6-2a904cce4e0d", "comment": "Malware payload", "value": "10eadac2ae9c9eeef3f21efaa0c87bed", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639777, "uuid": "65406cb8-bbf7-4b4e-991b-ec17e1eb518b", "comment": "Malware payload", "value": "413485aa2a8cf887e201cccd1ed8fd58cb5d26081d17d7fde44cc0f55f1c9fc3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639777, "uuid": "59d55525-8192-4f16-8333-3125c4696fd5", "comment": "Malware payload", "value": "ef510042183b8662409c062678b711c1ed75cdc4", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639777, "uuid": "33bd7f7b-155b-4568-a04a-6dbc9edd9d36", "comment": "Malware payload", "value": "db9a4cdb8cc76aa71fa62b86bc059ef69cc51b5cdcdca5d1be9c8c76eceb1215237f8d39de15f4111a44cad7c5f81acd", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639777, "uuid": "8f7a58cc-a4d4-47dc-9349-24814a0cf0dc", "value": "T1F412C51ABB01037A557302A2220D71F1FB28906493629640744CD6BD3FB7DA99BFF6DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639777, "uuid": "76a684f7-c557-4544-885c-57e2dbacc084", "value": "192:lNf9vy+WNIh31bbDkcrA90KZYE8NaWhoTBqpits1dlPamwvP:v0+sI7XDJ9j2jts1LimwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639777, "uuid": "a4d883af-6683-42c2-a5e3-523100beb14f", "value": 9362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639777, "uuid": "ddcbdaca-f348-4cda-9aa5-ce4b05c6e04c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639777, "uuid": "8523e3ef-b1ae-4409-86e0-33af5305fe49", "value": "Factura_20493944758.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d623ac-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660166, "uuid": "8c09a292-899b-4863-843f-53bbdab001c2", "comment": "Malware payload", "value": "099725c4c8323270189d20e4e3b54cac", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660166, "uuid": "e8b67721-db96-459d-9eb0-0a6edfdfc192", "comment": "Malware payload", "value": "415d2c5368987e7ee51961a95b322897d654a071b6c4c7f7badb1ba83331a1ee", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660166, "uuid": "d4d929d5-2644-4c89-aa37-df8a443995b4", "comment": "Malware payload", "value": "542e4f14895cca2584b5609ec881c5bbdb39c088", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660166, "uuid": "ff61186a-5a2b-4a7b-9bb9-af21e2c54df3", "comment": "Malware payload", "value": "5520b3a37c70e64fd00e80778efc533cf4f70b52af9424041c61fb1d77b6ab953dfbc68c74ff477b0de8413d8884648b", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660166, "uuid": "70ffed4d-53f8-4737-91cb-84bc4bfc483d", "value": "T1C5715715EA0E92EA5177866BE681AA49FF57406BD2430D80B1DCC0DD3FB1C0E4B5E8F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660166, "uuid": "46f6181a-cb28-4521-b8f4-2411b95f84ca", "value": "96:1F6wX7tYdKrTXQ2oHcxk8AlIBYCOn//DoKnPgvRn:uwhYMrTXQZf9lIBY9//DoKn4vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660166, "uuid": "7fb5787c-817b-4e53-8d80-1f2310117504", "value": 3798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660166, "uuid": "a029edac-a76b-4456-b07b-1f70d13ede7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660166, "uuid": "e56d4a46-1605-49d7-b1af-344f882ea02d", "value": "remove cursed.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3a1ca4-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload (HackBrowser)", "timestamp": 1761660044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660044, "uuid": "c0ebb307-27ae-4516-bf14-c3a296bb0060", "comment": "Malware payload (HackBrowser)", "value": "7a50a4016da9a6705d99993cf9787d7e", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "HackBrowser", "colour": "#D45147", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660044, "uuid": "1d3adc20-8c69-4d57-be46-fb3d065c0beb", "comment": "Malware payload (HackBrowser)", "value": "41a71ca9391bd41ac188bde25e45ae6e82a15b6b4d6fb4d496cdc70b7ab70fe1", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "HackBrowser", "colour": "#D45147", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660044, "uuid": "46e6a3ec-2880-40f8-b282-e760c62124a1", "comment": "Malware payload (HackBrowser)", "value": "ebe1a422059d131ee0039e801d5197ab38d9625a", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "HackBrowser", "colour": "#D45147", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660044, "uuid": "8476789d-e58a-4e6e-bed0-b52b08a89e93", "comment": "Malware payload (HackBrowser)", "value": "69d7bddd3faf48f4dc0d1734e2dd6bbfbc7de47f243f8d38d60f329d3edce82c51cad02c2797f36103f19dbee03d8c14", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "HackBrowser", "colour": "#D45147", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660044, "uuid": "c9b38598-a4cd-44af-b0d6-ec1153399caf", "value": "T100963330AA2EA88DEDDF51F2043DFC777A05AC62618778DAD27696531F841FC082AD17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660044, "uuid": "6f12c720-83af-4358-9981-a38bed8df465", "value": "196608:HGJ/PaNXBNjj2YmlXaB+GGWDKHQyVEUSydVR:HGJ/PaNnH2YKXaUcys8VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660044, "uuid": "07860606-8672-4bab-9533-03ffc1270c17", "value": 8662274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660044, "uuid": "0d27f430-48aa-4ecc-b81c-c5277bdfbbd4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660044, "uuid": "989f54cb-3a65-4b35-86ed-e8f4e3c784e6", "value": "i965652f-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ecea59-b3f9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654613, "uuid": "7bb9ccbf-3b2c-490b-95d1-fb505cd0db61", "comment": "Malware payload", "value": "628cd6ff2aeb44f0a711deb67c7004b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654613, "uuid": "14272bcc-0e29-45e1-af44-2c5c7293aa8a", "comment": "Malware payload", "value": "41e0051f5707adef55d2256ccdae0395241baff93f91be828b33393e6851dab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654613, "uuid": "b9975881-aa10-4fdc-be8d-9d760023a1d0", "comment": "Malware payload", "value": "cbaa251b5edc628b1a3a58d33257886a15dfa6e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654613, "uuid": "6b8f495e-312d-4702-9e49-b16d669d73ea", "comment": "Malware payload", "value": "42f085c6a0a6099b08869ebae1005eb2b5e01d0973a51798a51dd3b3de4e707d8c086f8a3c2a30a8bbd666ddf7e06170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654613, "uuid": "ae19195d-ada4-4d5e-8988-3af0c7b7cdba", "value": "T1924302EB93928EE2EEB11532D51F33D1E2FC282D929CD33E85FE2419890355D1A1A9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654613, "uuid": "107337a8-1fb0-4f0a-a372-a46d32225393", "value": "768:M2AFaWFMC3NMvNy55/+PUclOaZla1cAhMCkMsoPwrGRWenJsk0FE9prKHwvsEk9t:iIxs55AlOtcuMCkho1JsXELAH9XdIAQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654613, "uuid": "ced23c70-7fa1-4f2f-a06b-0bb455d2833c", "value": 60288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654613, "uuid": "90264fb9-47a6-4de9-ade8-e44cf356bdd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654613, "uuid": "972f7d71-6afe-40e1-9673-ace3e979a8dc", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb61603-b3f9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654381, "uuid": "96e5fc93-5795-4298-9210-4a5fb7fb6b1f", "comment": "Malware payload", "value": "db2eb60ff650291c2d8f8ecab00b5984", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654381, "uuid": "3be83cb1-e338-4912-b299-5e5538b7bc52", "comment": "Malware payload", "value": "420af9a98b45cb8a83e4333e8f2d433bb0697bffd40200bc904d609861abc2aa", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654381, "uuid": "185ba228-17b4-4045-bb84-3c4da9dd6145", "comment": "Malware payload", "value": "4127f89fae44735c7b4cfb325175fcbf72ae39ed", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654381, "uuid": "c4b4cbc5-64c3-4c5d-964e-64fc873c8324", "comment": "Malware payload", "value": "c835d08b3b6bed0abf4edaea48acff343fbf7ca03ac0f0115c0ceedd37304a8a53d3e22f2a172375453bf1d5f0220845", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654381, "uuid": "90911e00-1418-417c-9c52-e5ba4c21cd8e", "value": "T14DF13F393C6AF004A57CE916A52F6605FD69389FCD10AC8735D639A72A033D259831FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654381, "uuid": "66e3b636-c0ee-4555-9864-aded3cc5688c", "value": "192:mdl8d0qdhlb45q9jALOrGCYePLiA27zT0+nhFoF8yG:guPb9LVALhCgVU+nhFoF8yG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654381, "uuid": "e5259cda-8d54-4530-bc21-f0aec514fa88", "value": 7936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654381, "uuid": "865b48b6-9570-4836-828f-f2d2f5c3a3da", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654381, "uuid": "976707ce-9f94-432c-bc9a-ee2aff3556fb", "value": "420af9a98b45cb8a83e4333e8f2d433bb0697bffd40200bc904d609861abc2aa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dc6da7-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636139, "uuid": "1b86892b-a7bf-485d-94bb-d78abc1d3160", "comment": "Malware payload", "value": "e9c702b91b495cea5915af62e223989c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636139, "uuid": "344b6add-dace-4d10-9632-707ad8f2d5b5", "comment": "Malware payload", "value": "42c3e304aca8a3c6d74728eb0dde5a006a0f6f9073437ed0868e38ed8f486175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636139, "uuid": "0eb1776c-0a57-4968-a9aa-1da603c0f5ce", "comment": "Malware payload", "value": "96159b4bcc6505af0c9d2f8e8f701eb80913019b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636139, "uuid": "5b4ae7cb-2016-43e4-85a1-3ee2feb2f82e", "comment": "Malware payload", "value": "e0695e3c9eddebe02e66908a31f896423ae43a46afc0cc0cdc6761b654f53240c142785d93a3f8a1028a8a1109863441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636139, "uuid": "c74a5743-0df8-46c7-8d77-13ae3f957922", "value": "T1D4F522B0BF86EFF4E02FC7706192145D72293F755A3815AF5A98E0295EB68B41D3328C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636139, "uuid": "0f1d48f2-f0f1-4ab6-9883-88418dfb649b", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636139, "uuid": "7512bc3a-4d30-45de-bcef-9d85e257c10f", "value": "49152:ylA9QruzQ4XeA6t9jMu4e86syvzGb7aRxm/CRaaYb0ajojZG4cZghDD2KF/xP/ks:f9xw5EyvzGv/CRatb0OoNRcgDiQ/x/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636139, "uuid": "d9e0c9fe-fb86-4320-b435-958c05079dad", "value": 3556272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636139, "uuid": "f45e7502-9b93-4921-980c-24751f604639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636139, "uuid": "569cb5d8-f0f2-426a-a1c0-d1a0fe4c515b", "value": "8GVk01wwWXHHto7BJ1pwBajM8YOnUuQf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f56052-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761634603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634603, "uuid": "949d4618-547e-4cc5-9f0a-f76186fff2b1", "comment": "Malware payload (Rhadamanthys)", "value": "a2ef7573c5c68f275f914c16c9e18caf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634603, "uuid": "2b4b1723-9102-4ccd-84b5-33f05a38c6d4", "comment": "Malware payload (Rhadamanthys)", "value": "42ec7a7365b48cda8bb44be259a149f3307b73ee2cd178c206ea5eba215c5b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634603, "uuid": "a1801335-7a13-4ca3-bbe7-1613b3362a47", "comment": "Malware payload (Rhadamanthys)", "value": "130567ff5d6cb4a800f851b89bcb4948aaefab2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634603, "uuid": "159bd895-4447-49b9-8c92-bc76b9ac4d48", "comment": "Malware payload (Rhadamanthys)", "value": "a9879cad9526a090578d88c7aa4525baaf786478c4ac4928ab2d83cb76c5349833562afcdac84fe479db900aa2951fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634603, "uuid": "f81dbe1a-0c88-4ed6-86a6-1cfbedb7ab07", "value": "T11A9533569F28A5DCE708C473497FC6E196BE3828944F3ECB140B94E95E1F3A16722C74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634603, "uuid": "6d536145-e11b-4b6d-bb0e-b5e185c4bd30", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634603, "uuid": "5e1c027a-e91e-4798-97f0-51a15472507a", "value": "49152:Dha6kc60x62b+nu9GFYZt8D/+itviHh3riPpqa:FaPq6w0AcdtKB0pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634603, "uuid": "1c374f23-123f-4162-b5dd-8e152bee8fb8", "value": 1998848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634603, "uuid": "80fbb772-882c-4cfc-9141-eb699783b7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634603, "uuid": "2b2dd236-f515-4671-8288-d36f4bb70b65", "value": "42ec7a7365b48cda8bb44be259a149f3307b73ee2cd178c206ea5eba215c5b8a.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696ddb3e-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761634667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634667, "uuid": "f6fb72f8-65ad-4012-8858-8d2a966a6e16", "comment": "Malware payload (SnakeKeylogger)", "value": "84dbf83e72934ad14e9ca7660a63346e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634667, "uuid": "3445cf67-311b-494c-a29e-5ffd528cb2a3", "comment": "Malware payload (SnakeKeylogger)", "value": "42f5cbb12c4e13fb288fa434f31141d11f75f6a886623668d2d10f883dfc912b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634667, "uuid": "01256cc9-a671-4aff-8498-464edaba3e9b", "comment": "Malware payload (SnakeKeylogger)", "value": "dae4ed745c1bb155417beea15cb06d5c7e5e0804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634667, "uuid": "6f7b194c-bbd3-4218-b0ff-271469729ba7", "comment": "Malware payload (SnakeKeylogger)", "value": "5aed5405d1a44d3244ca28337f6937d01bd1bcaf1350873e93a45fbcc4e0aa6f43a2b9db51c946f8eec4e46c2ef5c575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634667, "uuid": "789ff8d9-aa1b-4ca4-8c4e-bef02006b89d", "value": "T177C4125537B1E413DAF667790DB0F6B442B8BEDDEA20C34BDBD86D9B3966E158800302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634667, "uuid": "b022ad5c-1f51-4ea1-a825-d67f0e626d20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634667, "uuid": "0c387f22-2332-46bc-ae80-eda1bdf5734e", "value": "12288:bgLmqXiNGERGk/yxydBWTqx+c1m9sqtYX0T3C:bImOq/yMdBV0YX0TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634667, "uuid": "ad6c97f6-998f-45e0-a5ad-801a0dac55a5", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634667, "uuid": "bf0c960b-710f-4554-b988-9d97e19feff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634667, "uuid": "c62899d6-44bb-4b4c-a5f1-d195e8d7a77a", "value": "SDF0987654567890000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b7dd07-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636142, "uuid": "843e4d15-db19-4230-b9e1-66e9b0916b0c", "comment": "Malware payload", "value": "6efec59f986386c20ce60799034192d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636142, "uuid": "831da236-953a-4814-9ac7-177398e2ed2d", "comment": "Malware payload", "value": "4340f89698a9bb8c5026a2844bd585297885fe7c861f308798268e737a06897b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636142, "uuid": "0d7b2fc4-b1b7-46b0-8d2a-43afa085e86d", "comment": "Malware payload", "value": "77852e5993e323147d43751a2a9c5e685fa7604a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636142, "uuid": "ac26079e-0f29-43ed-ace2-29478cb8b87c", "comment": "Malware payload", "value": "4095f4e954e578dcc8552c7b5b1e255393d55d7d27e20549da3a70dd6058bfc5e22f8ec74c72529fd80fbb8b482af17f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636142, "uuid": "04ca92a9-4c3b-4c4a-8de7-ff19b7c4257c", "value": "T16C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636142, "uuid": "b34982b3-9d14-46c9-99ad-46bb038489ab", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636142, "uuid": "15e1a63c-1c4f-48a7-990f-7881742a9797", "value": "98304:aIT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:L2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636142, "uuid": "84f027cf-df4c-4ca3-9d99-ceb16a8a416a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636142, "uuid": "adf5f949-f26f-493f-b7de-85fe8a072097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636142, "uuid": "ceebf752-8cbc-4869-8375-e245650e34ac", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b987d969-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656706, "uuid": "8250e029-75d7-4262-9a3a-9ce8a6dddb78", "comment": "Malware payload (Rhadamanthys)", "value": "b0f35546338af09231b64ea645fcafb5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656706, "uuid": "d0359e4d-2c95-434e-b451-ebb76fcbc1bb", "comment": "Malware payload (Rhadamanthys)", "value": "435dccf2f678576ee932f2263a5cca35bdc83915583fa857db8a8ccc8bc3496d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656706, "uuid": "59d3de86-4be9-416a-9306-90841222574d", "comment": "Malware payload (Rhadamanthys)", "value": "9c4cfe42c6f790238d26e46937c330ae7265b641", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656706, "uuid": "ac897909-1d72-4884-906f-9ca495d87d42", "comment": "Malware payload (Rhadamanthys)", "value": "f0a2adb7348ce8efd58874c355995ec3e113c447c6772005df324518003d323ed7381906b31a78f9e52f0feab81d0c1e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656706, "uuid": "a4a3291b-a002-4398-8791-0cd0e1f263e5", "value": "T16DA32CF91DEA29C1B04B46AE1EF126B2DAA9F77453DB71848C9D3312D414B0209EFCD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656706, "uuid": "1f5b7dcd-e4d5-4629-81d8-41c50c0b9836", "value": "768:GDhd0i7J4sYKgY/CMNfWdLHQt1tdrXwmr4KNth9t/Hm+YztethtxAFtmtLtDd0pj:GDB7eKg20ir3r4KNiIAUKM6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656706, "uuid": "2c5fea55-1375-419d-a3fa-e7459191ede5", "value": 103378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656706, "uuid": "4878acc7-406e-4608-b1ce-f876aed40e8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656706, "uuid": "ffa47f36-c6cc-426d-8feb-5879db5fb9b9", "value": "invoice-1637482117.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6263d3a-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761646392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646392, "uuid": "fa527277-6436-4cfc-8a2b-880f90ff56aa", "comment": "Malware payload", "value": "56a9a3c039156be85c3b907601064253", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646392, "uuid": "12657ed7-387d-477e-b855-587001bd5b2d", "comment": "Malware payload", "value": "43609f03274c4816abf18780eb3f4502061468d2d8b4bb2487b526008e981c85", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646392, "uuid": "9c27dd27-ed0c-449a-b44c-c5c5a92a77c5", "comment": "Malware payload", "value": "b1714f56a2f6e604cab60af93aab5ea746546f6e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646392, "uuid": "ae17de5e-7afe-497b-a51f-d61c8f5efe44", "comment": "Malware payload", "value": "6070f83f979b4b99d055547d993eda059d681dfc270f609bd61a351a85c9be9244ffb0df30b63dc4b1e52cc31e340b0d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646392, "uuid": "acc7007d-8a23-4ec3-910b-20317609322a", "value": "T13BA601D6F7C8992EC8775032CD6A52F5110B5D16CA83CF83A958334C28BB5E40F9ABD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646392, "uuid": "85360b7e-604c-4354-bbe9-c20d00356d15", "value": "196608:eD3OLy9vLKry3RcF3iJVQUJ+pWsa9h8TVCl8ptod2v7S3B:mROrqRcwJVQs+Lehpl8ptoUv7Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646392, "uuid": "24599811-9b61-40ed-a0f5-9a8f397d9451", "value": 10232948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646392, "uuid": "701a8105-242e-46e2-8ff4-6f89f50e5402", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646392, "uuid": "006f6acd-7a94-4b49-aa98-98f0cf0b8a70", "value": "\u0412\u0438\u0434\u0435\u043e\u0437\u0430\u043f\u0438\u0441\u044c[20.10.2025].apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd819356-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761646405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646405, "uuid": "192c2140-6297-4ef1-acdd-bb49d44e3df2", "comment": "Malware payload (Formbook)", "value": "4893f7f55d9e5c677d9644c3899b14e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646405, "uuid": "16b2eaea-8d10-43b6-9a29-496818b9fd19", "comment": "Malware payload (Formbook)", "value": "44a2b2a04288b8a218d80ea21b9b96de167b844fa7481adfbd48cfdf179aa0df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646405, "uuid": "d45612ed-63a9-404e-aef9-7e35ef669997", "comment": "Malware payload (Formbook)", "value": "e0103b3135a729b3c991bcb534cdf07247e0cc99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646405, "uuid": "17b90541-d7e4-420d-b8a7-6d8c65bb5907", "comment": "Malware payload (Formbook)", "value": "a311acfec837b3a87d698d0d528b90cf28b6883e945534193c1178b8c98c557a7310c4bf9973317cd7f119ad18b891d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646405, "uuid": "6af606a1-6b43-4d19-850d-efc5bc7c8832", "value": "T18CE4F1483B19DE12C4B557F118A0D7B113B9AD0AB521E2275FF6BDEBB07AF112909323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646405, "uuid": "6dea162a-e963-4e9a-b0a5-01a0641a77d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646405, "uuid": "bb063ef5-9952-4678-acd6-881bf2954789", "value": "12288:3ho2spkCuFU9PI1bDwhOjhF9AaL25ws3jLCxmOlWisg3tzaFeTreI3HU9C:3m2Uh21bDZnSisT+BlWib9Rrp3HUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646405, "uuid": "0ef635e5-626a-4348-ad4c-db76df5d231b", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646405, "uuid": "e21edeb8-d17d-46ca-826a-a4444ddc5068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646405, "uuid": "91ca7448-ac8b-4e0b-9a16-e3517f65b268", "value": "Formulario de solicitacao de pedido do fornecedor No 25950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0971edf-b420-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761671348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671348, "uuid": "75ad7ec2-273e-4cea-bf89-7bb43a62b390", "comment": "Malware payload", "value": "76712111bc5a0cb7a47b7d179bd4baf4", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671348, "uuid": "ee6b1bcb-286c-497b-9031-daa4e8cb0ad7", "comment": "Malware payload", "value": "44f9ac0daabee65815ed6ee089282c49aa338bcb9f63b0923191da84af0ab691", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671348, "uuid": "bc2ce02b-6f10-483a-b9ca-26a4e54d9b80", "comment": "Malware payload", "value": "f4ae7e7e4afb7370502be7f8b35e2fdd360a505f", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671348, "uuid": "075786ba-5762-46c9-8645-f79c5e1e2e12", "comment": "Malware payload", "value": "79f41bce1792b9708e93f78ef0fe5e75ba64bbc0919d6f59e77262783857a29868982eb2efdcd2444270194f8ef59fe8", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671348, "uuid": "b14904ed-81f8-4417-b9f1-264dc93698c7", "value": "T1F28197E7F2E8DA5F605411E4992A320B64E1C2BF4CAF834455D2250FE62F851AF2B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671348, "uuid": "b5539bc0-4b08-4581-ac59-d4fd5767838c", "value": "96:0eagnW6yuE2jfR/ubkHTotxMT1RytxMT18AC/20dVDae:05gW6yuE2jZCkEteT1RyteT1hC/dJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761671348, "uuid": "5c4d41dc-bd6c-49d4-82c1-9c4dfede4f8a", "value": 4017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761671348, "uuid": "cb84550f-3777-4143-948b-0ad7b83a4b83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671348, "uuid": "8641ebfc-9dd7-4eef-956e-dcb1d91e8fb7", "value": "codebase5533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9390444c-b44c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761690143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690143, "uuid": "28a0f66a-2785-4034-8c76-5c2f9c1d35b7", "comment": "Malware payload (Mirai)", "value": "2424fc4ddca2d768d646e53147316592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690143, "uuid": "61fc7644-abc7-4d39-a79d-4f21a0f4977a", "comment": "Malware payload (Mirai)", "value": "456f881757eb7e552f670609113f8101ae96d99e56ff0b2598e25f29135ffd31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690143, "uuid": "1864e482-fd75-44a9-b748-e453dae5d880", "comment": "Malware payload (Mirai)", "value": "392f7206ca37bac36973ba15dd70477197ed1fdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690143, "uuid": "1d1965df-2795-4ae4-b0b7-64d5a96a6077", "comment": "Malware payload (Mirai)", "value": "c971b6bdf8f659bd955edd3fb16010ddeec8851dcc2ff3a246d2ca30ef424b560b69275f5dafa41656cb27a031dfb4dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690143, "uuid": "73bfe978-302b-463d-9b67-7b00a72bb140", "value": "T1C7B30B46FD946AEBC45FCD30053AC30721ED98DA92E2731E7278D98C7D7D20A89D3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690143, "uuid": "e5ca0b5b-5969-4511-99de-71a2dd5c5752", "value": "1536:dXDQvLJTxYg4YcwIzE8KfxkU9/J5WtYxjjowJz4SiFZPw5NDakKt/4rG9pR:Ytt4YA2h5WajjJMLJwD+oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761690143, "uuid": "bcab4f7c-d260-464e-8293-124a13f5994e", "value": 114516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761690143, "uuid": "475506a8-87cf-4746-ad09-045f293ab5e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690143, "uuid": "10cf69f4-8a48-4766-b5e0-8ee26b50a315", "value": "SecuriteInfo.com.ELF.Mirai-DBD.74319931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40cb86b-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761646416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646416, "uuid": "982fa0d4-2c29-4b15-9872-7b306c9de104", "comment": "Malware payload (AgentTesla)", "value": "7ac235ae55c0f4001e73be0e38d2b896", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646416, "uuid": "8191e362-e95c-4edc-804f-fdfc20daffb1", "comment": "Malware payload (AgentTesla)", "value": "45d6e5b2dacebda7fb57eb80b6cf8d687374093bce58df7ab0d0209ba5581ff5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646416, "uuid": "d4872b73-7cc0-47a6-8220-8ad5480fe3d9", "comment": "Malware payload (AgentTesla)", "value": "8ad56d1357a9a3e2271ccdcbb5c17262a72bfebc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646416, "uuid": "b12622c7-6f4e-453a-b89f-e65430df151d", "comment": "Malware payload (AgentTesla)", "value": "4e404009e3d492eacc80cfeb7b4b7bc8c522adca14233018ae17cfad60d796025d8d49d05a07fdef85cbdcb8b8ae2dfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646416, "uuid": "22d3545f-b8ed-4e99-a7ea-6c8eeaa0e466", "value": "T1AE35AE0273D1C062FFAB92734B56F6115BBC79260123AA2F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646416, "uuid": "a1ffa636-1989-4457-84d6-42b84ba3f640", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646416, "uuid": "c430c576-d0d0-413a-b5de-1d71c052287b", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1ijXdaX2KVmw6WsP24:WPVt/LZeJbInQRaX3Uw6TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646416, "uuid": "d64fd2d1-c2b8-41bf-b78e-fd97172e4d42", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646416, "uuid": "714d8ed0-ca84-41c7-8106-4c84da217b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646416, "uuid": "334ae15f-eca9-45a5-b54f-918094a0a611", "value": "Nuevo orden.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc974881-b41b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761669220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669220, "uuid": "adb6b6b8-56fa-408a-85e4-e83996fef78c", "comment": "Malware payload", "value": "1bc9c33f115e247e0f65b10554c0b024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669220, "uuid": "092d4164-f4e9-4afb-86c6-0a9a98c2d222", "comment": "Malware payload", "value": "4919c7a86c0e70b77424e93a7ffedab6f78efe73f272906f4401e20e17f38d49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669220, "uuid": "88e10868-a01b-4fd0-b96a-186990e1ec93", "comment": "Malware payload", "value": "2944984e3664550fece78c87587141ee6ba972ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669220, "uuid": "da1c31d4-9d4c-424c-b830-f420058b3b16", "comment": "Malware payload", "value": "eabc2a18bc41aa518d78504eb4faacf8582d97c8bfe5b0c58800630e0fc643eb2a3ec5a170b7a0a98864d3760214647a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669220, "uuid": "ab4802c5-eb3e-4c43-a49b-6126713e568f", "value": "T15D6301AAA9B519EFEC903679AAF4961A9EC5D654F0B3FF14371072539B8E401FC000C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669220, "uuid": "4b38ad23-6778-413b-9831-501a8ae8872d", "value": "1536:63oSe4xWn1fhUgOYSDzthOZofDHZAXxiF/dNw:64J40n1fhUgO7DzKofDiXxQVNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761669220, "uuid": "65bc39c4-8995-40e3-bc04-2211dfed10f6", "value": 69172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761669220, "uuid": "6a48a12c-c019-4241-8d1e-b6170944e72b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669220, "uuid": "fdea05aa-a8d3-4251-a2bf-9b316dcdbc01", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990b8587-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761636465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636465, "uuid": "67306347-6fd6-47f2-b4a8-be4c1e59e8c1", "comment": "Malware payload (XWorm)", "value": "c4f1ffa907f3d1bf4d2a171bb025a767", "object_relation": "md5", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636465, "uuid": "b12692d9-ee79-4ac1-b2ac-a5ca087fe643", "comment": "Malware payload (XWorm)", "value": "49adb2ba0f7b69d65978419b690af6ddca5d176cb143e24860decf5d41f4dedf", "object_relation": "sha256", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636465, "uuid": "109bbe29-7428-47c7-a9bb-b1e2b7bdada0", "comment": "Malware payload (XWorm)", "value": "9fe1e2adf63d9375006deeb5b80987841b93a469", "object_relation": "sha1", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636465, "uuid": "df7b65ed-8a42-4bbc-87f5-eeb1ea796426", "comment": "Malware payload (XWorm)", "value": "b5a8f7d568c8367abc97aa9fd8ab979699bc697270d53b37770a710d45972bfb81b2671a497ecd18da562bf2e08f17d6", "object_relation": "sha3-384", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636465, "uuid": "b0e46813-88f3-4179-a242-922dac5397c2", "value": "T10DF30AB4696074FB236772E365523E06D044FA6E9B3805C8FFBA8A57F60EC45B713A04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636465, "uuid": "acd8064e-2863-43b7-aa8e-c6729ee0d1e0", "value": "3072:Ub7XoM+wZ2/oKxFhw5V/7uBv8IbJ/Wwx7bvDzZI6:UxduoKxFhw5V/yv8IAm7bv/ZI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636465, "uuid": "89196d66-104f-490c-9d26-f19daaa2baba", "value": 171271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636465, "uuid": "57516caa-e521-4608-ae87-af5a5ddb3174", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636465, "uuid": "4def2596-f4c6-4673-8015-d76549607162", "value": "Maersk_shipping_document_confirmation_request_0000000_10-27-2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ad89f5-b3ec-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761648922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648922, "uuid": "ae4d516e-38a0-4c9c-9ea8-1215b1284c70", "comment": "Malware payload", "value": "3a3fbed393843817c0968eab9e01b29a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648922, "uuid": "13bd843a-d471-439e-b6bf-d0d0e2b7d412", "comment": "Malware payload", "value": "49b8959fa26033176736308738ed416351de09038da70fdb50a4e985992a6149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648922, "uuid": "37d6d709-0964-42f8-86f4-dc2180bf22b1", "comment": "Malware payload", "value": "973a369d5312411ea01fd3d603ee6399f5f8b613", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648922, "uuid": "fa411539-2ebf-4e26-a517-a7ce8c615a25", "comment": "Malware payload", "value": "4748657ab936177c660db687da7485bac4b5d263d1a97b1e878d426d45af5b7c3999280960f42daa48fcf8eee7ca46d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648922, "uuid": "61bb417a-c39e-469f-b65c-1825cdb01a19", "value": "T15463029B112B62C386E0AD76B0B5478372E306C5887739A3F887D5C436F62C7764D86E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648922, "uuid": "e71618c6-f583-4e9a-b349-15b3dec5906e", "value": "1536:KctSFi9BmR6hSOmT0A1QdedsCbTdS8I/+WrjorT:K4SFi9BNW0A1QdEJS8lYjST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761648922, "uuid": "4a5f67db-264f-4730-b35e-ad3dfd59eceb", "value": 70600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761648922, "uuid": "31f108be-bd77-4f19-9752-33d201afb741", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648922, "uuid": "a4619a5f-1455-4cc5-aff3-f345be27447a", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c8888e-b3b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761626793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626793, "uuid": "255d6298-dfab-40ed-acc1-a69344c32343", "comment": "Malware payload (Mirai)", "value": "97bcdf389a5b4602d8513c026864b019", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626793, "uuid": "04e909fe-db50-4769-b812-ce866f34e99f", "comment": "Malware payload (Mirai)", "value": "4ac822d437a0291d1cdfdabec9dc3f21e52b1d61dee5fe0a3207019be35050e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626793, "uuid": "93da304e-0b56-4c53-89a6-748afbe527ce", "comment": "Malware payload (Mirai)", "value": "ae1b341f5580dc94dbc4571a231ba94bf27c9ea1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626793, "uuid": "1880d5e6-3bda-4dec-8d36-13de9a5aee00", "comment": "Malware payload (Mirai)", "value": "1b096a4433dda414119b04992e42d4f4e2409bc106ef6e0f6e08f56e47ded5f78e2409d7481732b066c04cb628c01f9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626793, "uuid": "55ed87a7-c9d8-4333-9443-3dad8f4cc4f7", "value": "T16F040846F8C18B15D5C111BEFA1E518E33231BB8E2DE7212AD256B20778B9BB0F3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626793, "uuid": "0969c120-2ac7-4513-99cc-30459139ba68", "value": "3072:GIdgr8IFNHwezEWEQXgqwLXjNYGia96neqzcMU45rJZWj:GIdggSz60gvXjNYxa2KMN5JZWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761626793, "uuid": "ed193adc-a827-46ed-992d-fed784baed53", "value": 187196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761626793, "uuid": "2c1c43f1-8736-45a1-8b8d-0a7fbf28727c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626793, "uuid": "b4486673-1cd2-4b8d-9d15-e236bdaf23c4", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be599c12-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761646406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646406, "uuid": "8a9cdeac-28ac-4979-9386-3e1b541289ac", "comment": "Malware payload (SnakeKeylogger)", "value": "524c75163c628189d1b8729aedc4f3f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646406, "uuid": "cae70789-a261-471f-88da-60b1330b2345", "comment": "Malware payload (SnakeKeylogger)", "value": "4af374bbae171062a58c22a6a310fdeb2da768cf2bee3bceb8e7677a51c150fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646406, "uuid": "e68874d8-daa2-4300-b542-9388bf2dc378", "comment": "Malware payload (SnakeKeylogger)", "value": "e8aba92e23ee8637de4783c13e0e2d90a40c2eec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646406, "uuid": "3f264e50-b1b4-4483-a5c5-7c23de70ca41", "comment": "Malware payload (SnakeKeylogger)", "value": "9c795ea285fdf9ce74c5090c44725f67ece7a9ea6da81266e9cf60d026a51d9e2a8ec9b6462a03e8d10bdc916f69ab77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646406, "uuid": "e284539a-0038-4db1-bea0-e96f2efd5d4c", "value": "T182C401642B6EDF12E8E21BF41AA0E3B123749E0DD801D2475FDEBDD77435B562828293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646406, "uuid": "ab80023a-fdc6-4a3f-9e5e-58be05300c46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646406, "uuid": "0e864df4-ec8f-4328-b5e0-b8d429f89820", "value": "12288:aoA2yH+0vwVkldwA4oA9wWki8iUGTc20tPOWrAz03L/rb8Wk:aoA2yedueA49HkdiJTbWPOHzW7v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646406, "uuid": "afbc1abe-bcf6-4668-8bb1-30e34c44c5c4", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646406, "uuid": "3890ecb0-1554-42a8-b312-94e57fcd42bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646406, "uuid": "a28c3337-0084-413b-a5d9-ecfc85e6d20b", "value": "GH9876545678000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40234f9-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761646389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646389, "uuid": "01f0f28c-a2d5-4044-b465-bf96a2798af1", "comment": "Malware payload", "value": "90ae918afedf9be285841f8ab58896fe", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646389, "uuid": "f3e56cd8-edb6-4b93-9304-b67dee899293", "comment": "Malware payload", "value": "4b39a550e10d4c233ca8ed313bbebf73c3d10f3fec9c6d225fc945182f340a82", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646389, "uuid": "56bec63e-0777-400f-8340-a315f41c022f", "comment": "Malware payload", "value": "30f0d790cc9ddab6c5fb9ed8fa88da27ad70bbed", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646389, "uuid": "9098355a-cdae-4e45-afad-ff7bf1f0eb30", "comment": "Malware payload", "value": "6500b4e17e2373a2f5a3f40ca5df7f0e2c229c96acda161ff18011c7c597c72ba54b06387e2e71d7e0b1185cfa823215", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646389, "uuid": "fa5f3a17-59c7-4902-8300-42189c034575", "value": "T12747238EF358A92FF477113688AB1231D6570D52AA42D7F36929730C29BB9D44F0DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646389, "uuid": "3b3badb3-c25a-4f4f-a668-4378a52d8137", "value": "786432:7x8UOHPre7HLl9Uc5JfI/LCRy8FJfvLvJ3XsoJzAi4Wo:7xl8IP5H6y9FJfvLv9f4Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646389, "uuid": "db6b8a01-9224-4065-b999-d3bae349bd8f", "value": 25876401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646389, "uuid": "d0ae30c8-763e-4884-be35-69d5a75f341a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646389, "uuid": "c6c2e8e2-d571-4135-9bab-b5f6f7e2c069", "value": "kalyanmatka.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1def3a2e-b424-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761672766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672766, "uuid": "c5e6b76f-d483-4221-b421-57b2a29f42bf", "comment": "Malware payload", "value": "fd895b92b0ccad5b0614e29362a9dad6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672766, "uuid": "56853b37-91cf-4f56-ba9e-b5e68910ac4d", "comment": "Malware payload", "value": "4c56d215f51f273b1d785417437aad5cc122a97314360af5d4bc1d0f61a11b17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672766, "uuid": "cf417b0a-b5c4-4939-a478-aa58cbb3bfea", "comment": "Malware payload", "value": "b1f33887e3f79dd7886393362cb959982f5c89b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672766, "uuid": "1ec09f70-ab04-4fba-91e0-235a6c83fa51", "comment": "Malware payload", "value": "3b269c2f39ca4c66d9cdcdcc6319e34927caaf6db51d939900d03b4c2c8c733fff07d7b8cce74e194d65deb553ddb561", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672766, "uuid": "ff7369d7-ecca-49e5-aa4d-b4f26fafa608", "value": "T1758312001782B657CFA971B95C2AB106BA217E6AE9D8A102F684EB4C743FC55D73933C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672766, "uuid": "032c4224-9c55-45f7-a952-742c65f80cbe", "value": "1536:ONuSSfA0CHvBTFHla3LCzcPBK9civBVnMKv+HUPs3TDi5NL+nG+zN:ObSfAdDFamzMc55Vi0Ps3Xi/SnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761672766, "uuid": "a6323a84-eeca-450e-a0e2-e8c7b8f85f96", "value": 81300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761672766, "uuid": "bde519c3-03d3-4e04-aba1-f21da3554e75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672766, "uuid": "6c719f29-0565-4876-a1c9-09dcc14f2378", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c346b776-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761646414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646414, "uuid": "929b60c9-091b-4864-bc4b-5a83767cc63c", "comment": "Malware payload (AsyncRAT)", "value": "066343b9481317496fca443a96035585", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646414, "uuid": "5ef5b79b-2c61-4d8d-b267-7311f7b449ca", "comment": "Malware payload (AsyncRAT)", "value": "4c8aec473309871b01adfeb78f2656fe5a4139f1ba6bfa85013f4b699e15d354", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646414, "uuid": "4b4e7ebf-c9c4-4b07-a0f6-e16d12ac7544", "comment": "Malware payload (AsyncRAT)", "value": "de76ba10f6947f45aea956a650e59a5b66e2d8cd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646414, "uuid": "6987d61a-339e-4c7c-a0b1-6e1bbda08de1", "comment": "Malware payload (AsyncRAT)", "value": "5c2a684ea7aa41a6334e4e6cd361db6e2e539ae9cddace40adfeb2bdcf1e5e2db026c42b47298eb636d3d57e183f8c21", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646414, "uuid": "a9c73f1d-d1fe-4bf0-8a9a-612e1b352f20", "value": "T14BB401196399DA07CAB527B018B2E675037C7EA9E832D30B6EDA7DEB35A1F104D00753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646414, "uuid": "c7752231-ad57-4926-b416-5caef2d83ab4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646414, "uuid": "90642c25-2e4c-4e97-a617-8c86119e5362", "value": "12288:tdXE9P/eoqFm98ZwAGl+Mnar6QSXMGGCR4hHFVJbt6kzWHQ6:bODqe8PMaNSXMOROHFVr6LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646414, "uuid": "78b26904-73a5-41c4-b5ae-536da80f1c1e", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646414, "uuid": "e5a4408e-d054-45d9-8fa4-e23df1f4de0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646414, "uuid": "0f6cddfa-c537-4d84-8a21-b8571b991460", "value": "MADHOOR SUPERMARKET LLC_25086.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d393cee1-b41d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761670064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670064, "uuid": "01440fa2-087d-4183-bc2a-0ddfc4846cf7", "comment": "Malware payload", "value": "284025d3384219f9230150430ab0df08", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670064, "uuid": "39d185fa-b11b-4d36-87db-14ddef3624e6", "comment": "Malware payload", "value": "4ce37f755c60ae07ec3918b72c74eb9ee22cd96a469078a20baae572367c3ebc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670064, "uuid": "5b3616a9-6931-4689-8ae8-b697221c0cff", "comment": "Malware payload", "value": "904eb662e8eab220201807ab0984cbc21195d59c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670064, "uuid": "8c0133bc-1aa5-4004-99e3-963651997eb2", "comment": "Malware payload", "value": "edc3e545e145a9e386666c5589988bd0bf0e2d93b8c8190b98cd643a05f10f2029f00cadc04a2f26ca0b2c9eb1d0170d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670064, "uuid": "40b1db30-6334-4397-8137-eec5a5f929df", "value": "T15531B48F41D0126568C0FE84B5E3482CA8A8B6C62CD01EDDDB6D25E1735CB84B41EF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670064, "uuid": "625ac181-2ab6-4659-a33a-68701def7f2e", "value": "24:ToWBGhBh9Mk8QopCZKCyk/GU5k/Lzoz4k/JN3k/U25k/c0k/xk/Y:ToGGhL8QopCZKCyk/GU5k/Xk/fk/U25N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761670064, "uuid": "04ee2ebe-c6ec-4704-8119-ea04076e4f6a", "value": 1451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761670064, "uuid": "d17a77cd-3969-47bd-9214-ae005ba29d1e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670064, "uuid": "702f1366-cd69-4c13-921c-c681e47fb9c3", "value": "toot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a91c67e-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656627, "uuid": "39992ec5-70fc-41ba-8eb1-e1f6cba50269", "comment": "Malware payload (Rhadamanthys)", "value": "03d02d6000b7c98006501115ab30d50e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656627, "uuid": "4caa76ad-3ffa-4d58-8243-0e4365dda562", "comment": "Malware payload (Rhadamanthys)", "value": "4d4c7b738a201a796ab2484db2e2df1a0e6f516166622898735933d5062adb3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656627, "uuid": "8b973197-1dbb-4ec6-a43a-2b171e33cb88", "comment": "Malware payload (Rhadamanthys)", "value": "0961f7d27fb868d3ef3d214da6e96c1f855b01a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656627, "uuid": "011a9cd8-7f47-432a-82b1-16116886ea72", "comment": "Malware payload (Rhadamanthys)", "value": "b6627ccd5d2f75810abf2d632addb4cbfb8780625ae383c2c41d9edec83bbd6a334361c93dc777a34d479a367d1f278c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656627, "uuid": "8f2b30e5-9494-40b6-a9a0-f84dcc982b32", "value": "T190A3FA553FBAE8B233175668ADCA1D90FC5480BF51453386203EB7124A3AB167C7ABD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656627, "uuid": "0a4320ed-ac2d-4482-a76f-797d97f3779d", "value": "768:GDhd0i7J4sYKgY/CMNfWdHEcGeIE6rX2yru4ya+MHKsW/AAqmPM1SlSLAuAAroQD:GDB7eKg20SrDru4XyeACQl6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656627, "uuid": "f1e43962-fe6a-40ee-b8df-03710c42d241", "value": 106001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656627, "uuid": "33aaf14b-dc03-470c-90f7-5d947bdbf172", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656627, "uuid": "68e8c70c-cd3d-44a5-9b7d-9bd3a1180a79", "value": "invoice-1637482117.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b591cd60-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636083, "uuid": "8ea9c92b-7b4c-4d2c-b4d0-85f63e08b9b4", "comment": "Malware payload", "value": "4e6b39b1f9e41ad344712c7dcb41854d", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636083, "uuid": "3af274fc-f6eb-4719-b930-1c834f6da7d6", "comment": "Malware payload", "value": "4da20312b4ce6e9afb415292b6bab313a65793894ae13e296e4982beeaf469e9", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636083, "uuid": "cac25ba3-0dec-47a3-a26f-cf195772fb67", "comment": "Malware payload", "value": "8ad5c524df0d52593ea3831c6c3fa2c31486f492", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636083, "uuid": "d2353621-81e2-4036-9d91-25d96886a6b5", "comment": "Malware payload", "value": "b63f983a15c7c239df468eabf0813a5b46eebb1b63292beecfd6854b9fb6eb0c1b1c32fb880e2c0a804b2a298fa0f71f", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636083, "uuid": "aa810a8f-fd29-4a86-ba15-d8cb955bb00f", "value": "T109152300BDE7EB6BE463A0B580C9C4A1639C5E231B1B9F3B2B06774E7D319D5958386C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636083, "uuid": "6f09ffd0-42a7-4d67-a47b-1a5f7be648d8", "value": "24576:6L0olAdPFI+pXcaJBdCfU81SklSnaV1O7Gafdjhr/sP0Z:6LKW+pbPCUmS+SavGGahhrs8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636083, "uuid": "4b35664d-72e5-466f-93e0-035df44da9df", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636083, "uuid": "bb23d353-4063-4a64-b2d6-ee92c444b28d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636083, "uuid": "65d77e50-f12a-4dc7-a871-25651ca406bc", "value": "pedido.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebddef66-b3d1-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761637463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637463, "uuid": "2b17b86f-6611-4deb-ae4c-c16d337cb2ac", "comment": "Malware payload (AsyncRAT)", "value": "97879c76fc0ef8f0fb78b2be8e440f99", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637463, "uuid": "018a5f6c-72cc-467e-9506-1cdec1938e32", "comment": "Malware payload (AsyncRAT)", "value": "4e12323d957c2b29d873e8ac7acd749b18c2f862fdeb28503041ccb1cbac9f22", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637463, "uuid": "ff1a160a-bd59-4a21-8224-4fb00bc96122", "comment": "Malware payload (AsyncRAT)", "value": "bdb371f66716121cb015106bfc6acabd93998a3a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637463, "uuid": "c3ca7a6d-78d3-4286-a74e-d32f7a11ea13", "comment": "Malware payload (AsyncRAT)", "value": "f18499b90e6d46334510641fbfae575767ee73643cb3446b3d51ff8f013bf91c59fff8108643d5df8bd1091e8c731cdb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637463, "uuid": "06af092d-3f81-4eba-b0b1-2e0572683871", "value": "T109A4012877AACA06D6B647B406B1F07517BA3D8AA931D3164FD97CDFB672F018800B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637463, "uuid": "bf8b43ca-d648-4d19-804a-136263e59e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637463, "uuid": "ad2fc91e-3ea3-482b-9c04-6e90591510b4", "value": "6144:NAmTWLUrD0QuoxGNqjzXzjgEKA+I74F2d43l9/NTrF9PDZix2dN+F5+Sjw7o95:NAmqThbqjzn1Ktb3l7vDkx2IFgIUoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761637463, "uuid": "298932b7-9c5c-4c8a-8a19-d832589379c7", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761637463, "uuid": "587a3506-8fb7-4c15-bc45-21fb2233eb77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637463, "uuid": "9acac816-63ec-41b7-9836-63e922ac18f3", "value": "HBL# RAF0058328 - (FW 102974 ) HAI MEN V.N685 SRAF0058328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3dfd18a-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660159, "uuid": "1581e559-0af7-4844-a4f9-5b67812c59c4", "comment": "Malware payload", "value": "6a802b1042af67cd8add4bff5f9f6fb7", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660159, "uuid": "08983faf-8f1c-4eb5-9ca8-56e9d2e912e8", "comment": "Malware payload", "value": "4e78813b9580d0e45d37e6847faf12e266f80c495470348f52f2eb574962f7ac", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660159, "uuid": "5651b98f-19fc-4bf5-9618-c55443a89238", "comment": "Malware payload", "value": "2299ad897bf461c9b789878b6c25777d93802b9c", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660159, "uuid": "bf6ab628-454a-4fd9-9ea4-7e19f86f8f7e", "comment": "Malware payload", "value": "0b32aa014e804f272ce979dd2861873b40bf403a3f924f8944b90fb0f1fe1a5f27e8bbd761fcd258655b28a350f655c0", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660159, "uuid": "65e45e4a-ffcf-4a87-a6a9-a136fff6d8c2", "value": "T1C3C13409994AA11D76F313AE9D459444ED53083F530A5A907E9CC0E87FB407DC3AAEF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660159, "uuid": "3eb70b3e-10f4-4bbd-aa27-bc136282d6dd", "value": "96:V8AQHeYva6bb5+lbjBAqKZBIqvM1PVW5dpqIYep:6AQHeYe6nHI51P05dkIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660159, "uuid": "31a17640-bd61-4729-bc9d-149c39ef3e06", "value": 5622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660159, "uuid": "c20347d9-8bb3-4dd7-bf87-85c17a33a119", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660159, "uuid": "9406d324-aa05-4f8a-8969-fbe2c996ebab", "value": "mfile.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7776e446-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620947, "uuid": "dae7cf9d-e3d8-4f11-bae6-013183db298d", "comment": "Malware payload (Mirai)", "value": "7bd200288cd266c71bf17d15fd0db01c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620947, "uuid": "61bdba44-632f-4686-ac74-bf8a664f1249", "comment": "Malware payload (Mirai)", "value": "4ebf1dd6fa6438fa23b5293f25bd4f7ed6a011870ff712fc6273e2531aa5583f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620947, "uuid": "fab7e473-e1d2-4a67-9796-d8e2699fec41", "comment": "Malware payload (Mirai)", "value": "ec9627849d01e0737d004369f0fdf6e2d136eff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620947, "uuid": "b8e02fd8-4c59-402c-8788-3a9d15edfa74", "comment": "Malware payload (Mirai)", "value": "d464220e7af018262b04af1f2783b9f09f49351c6dc28b3da8014840286f2a35976e56b3dfe89fed8610afb60d99e83a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620947, "uuid": "7dc34c5b-139a-4d68-933b-61d74331f579", "value": "T1B3C3AEC3FA8714A1C46206F003C71BAD6F93A121CE5FE4E7AC1DB63B5A7A4DB1916781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620947, "uuid": "7e7a869c-73ff-46b8-a99f-1b01288c8ede", "value": "1536:gcjBfdqDkFJ9MStjbEI5WOoP/9U/D9Qzld8a2lcqxs5Rlg9iEQ/LWJ:g6fwDu1bEOn+/9Ub9Qzwa2lcHgOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620947, "uuid": "7cf33ad7-de82-4493-9394-2d3398e436b2", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620947, "uuid": "eb0066a4-6395-4ffa-9ea6-cd1d0685e6ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620947, "uuid": "e4a6916d-c8a6-4398-9286-cb6aa6458575", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50cced4-b424-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761673127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673127, "uuid": "879555ef-b03b-4b4f-98f3-ce1ca23986a8", "comment": "Malware payload (Mirai)", "value": "e120073da3745d54655b53baf6e03a46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673127, "uuid": "1ce2b07b-d731-4fa6-84e8-2900f5a80c8e", "comment": "Malware payload (Mirai)", "value": "4ee68a0324780ca8d6d5c84508e888f5e5275622239a40126da8f326bf907ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673127, "uuid": "ab9c1e2c-779d-4d5d-8c15-6bbf1ba51fe0", "comment": "Malware payload (Mirai)", "value": "156bc320ac2588c7ed53601d5dcefb76e5792de7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673127, "uuid": "e58d256f-2739-4d80-9123-cc4a6cad856c", "comment": "Malware payload (Mirai)", "value": "8786deb0a3366bb785875caae3e640f024e56c405fc03719a13cc2f0bb1f20e9e997ece868a6ed4b009d1de9222af682", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673127, "uuid": "21060c68-b312-4c88-8075-cd27cf3be3c1", "value": "T11F148220FA0663F1CC721A38A7992E4A6E7704555FEB26312D1F533CDE628509B31F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673127, "uuid": "d7ea9612-850f-4ff5-b8ce-f7983259b900", "value": "3072:mfTcX3bq2B53FLEJlwnKAsDMRJncjUje1PhtiUKH:mYf5xUlABJncgjGNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761673127, "uuid": "ef87ed75-e35d-495a-a8d3-2582cec58b83", "value": 201320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761673127, "uuid": "cacafb3c-65d1-4737-a9f2-86a025bd6e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673127, "uuid": "768814ae-44df-48ff-bf08-a3228489b3dc", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43104f8-b3b6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625827, "uuid": "157fe76b-7aad-4724-9545-a98ed1948423", "comment": "Malware payload (Mirai)", "value": "8d103c020b82d051eff5c9615c1edc05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625827, "uuid": "1fb3ce03-28d6-4891-92d1-12a2e6f97537", "comment": "Malware payload (Mirai)", "value": "4f7ea3e11393cbe8863cadbcbdeabde5a091dba32cdb22bd8ef3bdf3c2b615b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625827, "uuid": "d17a2a5b-859b-47a4-bb4d-8cbc5c90df1c", "comment": "Malware payload (Mirai)", "value": "f3ab64b18a8446d7160192c1ac88f66f527c5276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625827, "uuid": "cd9319f0-8d5a-46f5-94f4-3850009de5bf", "comment": "Malware payload (Mirai)", "value": "47dbc358d364f5c8824c3eaa9e18a17122c65b7c1f89dbec9ceda40caabd494502bbfd552e5077d3280fa1fba0ec727a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625827, "uuid": "e571ab64-0438-4764-9344-92793578a811", "value": "T14893120FCE3396A08A30AD7DD6DF590FED986774B92EF13306645C446C568821FFA882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625827, "uuid": "ffc6e15a-72ac-4e76-8edf-5c77890059df", "value": "1536:2IAkQKOYAYyc22k90IgrRmQjP9zZvbLiaLKON/YIgVs:2IAxKOYTyAkCBcQz9dJLN9YIgVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625827, "uuid": "73a7547f-6cde-4200-a8ab-5cc5a59cf6d4", "value": 89368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625827, "uuid": "69f33954-c9b5-44aa-8b02-2b3ae85577e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625827, "uuid": "5b4ff342-ffe3-4ea4-9225-d0954897eac3", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ea37d2-b3cc-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761635009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635009, "uuid": "711f75c0-1644-4db5-a00c-6ccd4f4b0e05", "comment": "Malware payload (RemcosRAT)", "value": "5f46f701c48ca7042d453adadb0ca42e", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635009, "uuid": "c93979df-4f14-47be-8a2c-af3f3eb81e9a", "comment": "Malware payload (RemcosRAT)", "value": "4fdb8db4dfee34e0bd6086546fa3814df9d05f25149c83e5afe536d244fd19c8", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635009, "uuid": "f5afc3b8-076b-4a65-b227-d050b9d2fc5b", "comment": "Malware payload (RemcosRAT)", "value": "b4fc094f3fe09b819a5ad4709bc7f55fa0dfb751", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635009, "uuid": "0a56f4e4-c43e-4c80-bab1-4f8e94eeb1bb", "comment": "Malware payload (RemcosRAT)", "value": "a9d9ae9d53198c29799c45e4325966dc2cbcc6fc6fd08a9ffbe59c968a6f60bca2bbf765fc7f3ed227dababe619998e0", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635009, "uuid": "8215ce8c-4ca4-486d-9ee3-1bdc2336d8ad", "value": "T13D358DA2E74D6EFFC368B1FEA6E4191719A558C1D1E2C4D5BFC20A4F804EB34016A376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635009, "uuid": "c9f811ad-64db-4312-b82a-42b79d9f9626", "value": "24576:AFR4SGHC5OTPCIwf1JbRlWQm4fN/LidBTiWhb4L8+qflAgdtriHwV7rp+XKL:OeSO8OTPC/PbRlWQm4fN/0ZBhb4o+qfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635009, "uuid": "0f72ed76-e2ca-4102-9306-908a0afa29b0", "value": 1122892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635009, "uuid": "d531d471-0a38-48c9-bfef-704f8b871fc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635009, "uuid": "dfe214f9-96c8-4023-9aa7-9237a0bb1f05", "value": "Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c282d0f-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761636229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636229, "uuid": "646d7beb-af85-4442-bcec-913df3efe710", "comment": "Malware payload (Rhadamanthys)", "value": "1b55f0480fc57dfb8acace9a52a5ac10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636229, "uuid": "e10e1f95-5b21-4578-809b-08fd39738c37", "comment": "Malware payload (Rhadamanthys)", "value": "4ff718a709a4fd1d820ba3faefcf822f2cd2871b79918421cb13b93fad028c51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636229, "uuid": "e460fb46-7a4e-4cd4-b60a-48150852e246", "comment": "Malware payload (Rhadamanthys)", "value": "b639f4421636039140130ea969bcb545150577f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636229, "uuid": "7b0d04f0-d8a6-4b2f-8895-1f1f5f495593", "comment": "Malware payload (Rhadamanthys)", "value": "9ae2f78f1be38422b115f140d57cc2892e97db3247ebbf17232389fca94dd4de4edcfe89f3859f369321cdf2bea6092f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636229, "uuid": "e9248f65-812a-4a58-bbfb-314b43662162", "value": "T1769533B19F22521EF6C2D2F192BE4E963F219D6D04E7AC73B14D5334A612702237B936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636229, "uuid": "7009cdfc-3e04-4c7a-b292-dda1853fc4e1", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636229, "uuid": "6b400288-a3f0-45ba-bfa0-068e7ac59570", "value": "49152:Jha6kvXI6omvL4INaqP6MKRDXw7eVQFdnLAi7OMx:naPvXiaL5JP6PXwqyHLAGrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636229, "uuid": "c435511a-351a-42f4-abe6-75a95f20d45d", "value": 2019328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636229, "uuid": "2363066f-7131-41f7-864e-9a2dc530d4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636229, "uuid": "19a4513d-b2a7-4ec4-91cb-1654e5b85452", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6a145b-b3c2-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761630755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761630755, "uuid": "19e5e696-9fb9-42c6-849b-b32963fdb405", "comment": "Malware payload (AsyncRAT)", "value": "a939ed75311151375ea485f2ecbdac72", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761630755, "uuid": "e04d77d4-8b4c-4914-8852-3d616db8f2e0", "comment": "Malware payload (AsyncRAT)", "value": "50bc637d09d5520923e70f25d7325483f81a00061f883278bd68b94d93917d9c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761630755, "uuid": "3927bb40-7bee-4858-b84a-4821864fee1f", "comment": "Malware payload (AsyncRAT)", "value": "a479468f037b07cf58a9ad3b75d60dfc7831b703", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761630755, "uuid": "34ffbc90-aaf4-4e59-b5c7-21e83511ebbd", "comment": "Malware payload (AsyncRAT)", "value": "e6c231ffccc46c3a74cfc1b78714c9ac4bbe313941ab89d0df785fe9167cfe89f76e190447531e5d2e6c6eae29bf9f1d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761630755, "uuid": "b3307237-6437-4e32-8821-94e186278d8d", "value": "T1BFB4025467A2D413E9F643745AB0F3B447B97DCAEA30C20B9BD86CABB975E408D40363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761630755, "uuid": "bcfb4ca3-4667-4983-b58f-70927ed119b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761630755, "uuid": "e74ae6aa-9d85-4e48-86a0-59875a9299c7", "value": "6144:XPYRAmTWLUrDmx/11HdEkOTxojlfrOuIWT7i2nkxZo9x3JZyqP4znEtRUIPXW:/Y6mq/x/11HOQjl6hWvirG3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761630755, "uuid": "8d9ad6f2-bda6-4eef-b326-de260fa2dea5", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761630755, "uuid": "a22e761b-2194-4b9c-be49-08ed0919fe62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761630755, "uuid": "43dbfb28-126b-44ad-ac6a-3876ce0e3d55", "value": "INV PK - SO.4205- SEA-3\u677f- 3,550pcsTPES25100755.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfbd1a4-b442-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761685808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685808, "uuid": "ded20773-f612-4a1d-ba9c-4355dca63822", "comment": "Malware payload (Mirai)", "value": "3dc8b7f345ee51e6c697b4e1ae7e3812", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685808, "uuid": "7c33499d-e773-45bb-a156-99fa392d293d", "comment": "Malware payload (Mirai)", "value": "510b9037be77e60ee87433e71b37378faa64c5045e3c3ed2c92fa1cca1b15958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685808, "uuid": "acd40836-e204-4a4b-b09d-b90b2dbafade", "comment": "Malware payload (Mirai)", "value": "cbbf1a22e69f4675a3e9fa0b90fc9c96710e92d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685808, "uuid": "73d7775b-b380-4d87-a621-a9be441665aa", "comment": "Malware payload (Mirai)", "value": "6a79a10a6ab94ed2111e9ad134fc0f7ff96d04da223bce120729df3ed3d567bfeb5073a47a42e2bebeacd7acff7ebf4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685808, "uuid": "b6bc6443-a378-454d-abf8-62555d7aabe3", "value": "T10DB30946FD906AEBC45FCD30053AC31311DD99CA92E6631E7278DE8C7DBD20A89D3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685808, "uuid": "798600e4-107d-48dc-b429-4a22fb505c7c", "value": "1536:Liyf9FUgW4k1lIdKxr4Kf/bpevXAYuPj08Rli8kmnr4oUq6rKix4rGEpgm:pe71ll6vXijLRlUmr4dFKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761685808, "uuid": "c20c8649-de45-4720-882a-ccbe8868f4a3", "value": 114512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761685808, "uuid": "44b5c54a-7bff-4875-b105-10b157afbecd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685808, "uuid": "0c25bccd-9065-4096-9163-e0b964d4f8f6", "value": "frost.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47af14b7-b392-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761610129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610129, "uuid": "33c7b8bf-b2a8-4b7a-9530-f56cee7b563a", "comment": "Malware payload (Mirai)", "value": "cdb7df5dfbdf51cd52aa9cf265bcb556", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610129, "uuid": "77d417e5-c927-4916-a54f-1e0e81435d9b", "comment": "Malware payload (Mirai)", "value": "51b9fcbe202c2403d7c8f889bbf17d0ca941e842244c54d5ff11b8bc3faeb7a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610129, "uuid": "7dc760d2-9b10-4b04-92df-938e2bb9bc9b", "comment": "Malware payload (Mirai)", "value": "79cdc5ca1e08dd181faf6de5f78acee9d874c3a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610129, "uuid": "becc6995-46ea-42a7-896a-909db40b1761", "comment": "Malware payload (Mirai)", "value": "491ebf0160b28e9178441214023666b668af4d50fa7b1989fb007edbef13fb2c9715ca5e5b30d8962b99060c61b7ddfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610129, "uuid": "8a763bb8-eb3f-4a1e-80c8-433ae6abe1fc", "value": "T130A3F295B114FB56C01661FC70460980E3F16EB61F9A6A065473F9B8AEB8CD83F07EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610129, "uuid": "34902bac-5023-41b6-a5d3-fda4e153b467", "value": "3072:unE0RBu90ENru/U2X755MVTaTclS8wIFmwuu:uee0y/U2L5tyNwemwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761610129, "uuid": "949d6799-3ce9-418e-83b4-6b24fe7ee8d7", "value": 103824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761610129, "uuid": "3959f805-c602-4322-9238-674c6b5cefdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610129, "uuid": "d5d0fd31-6610-42e1-813c-55c139bb8fc5", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0ca9fc-b3f3-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1761651910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651910, "uuid": "363cb967-0c60-469d-86ea-0c47d53ec2a3", "comment": "Malware payload (njrat)", "value": "0bf315b1f351636ab1650cea5ed1c237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651910, "uuid": "17eb9cee-78a2-424d-acdb-4d461382dae7", "comment": "Malware payload (njrat)", "value": "5268eb7932bcc8729b17bfe1d0ecf42bd052493c57f203326bb9f6a0d6ad8436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651910, "uuid": "aae3ca08-c042-4473-a17c-7a5ba3ea1112", "comment": "Malware payload (njrat)", "value": "72ee9088e8fb9b56c576f313a69add5d4bbd7bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651910, "uuid": "9acaeeae-382e-4b3d-a3e8-7e21395f8fcb", "comment": "Malware payload (njrat)", "value": "bd9d5196292714e512d30eff61643379aa3ccb3a10d8c588b11b9ab4de2683344f50de7ee2707fc122c944e94f7ebe0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651910, "uuid": "ed7c7dc5-7b1c-414e-8ab8-b84d23343005", "value": "T1A5E208067BE94225D6BC5AFC8CB313214772E3838532EB6F5CDC88CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651910, "uuid": "ef5863f3-afa9-49fe-baee-bae3bdba0888", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651910, "uuid": "e530ea04-4f9a-4904-96e4-b7ac37ec12c4", "value": "384:60bUe5XB4e0XmO3fw0Q0mS03AWTxtTUFQqzF0ObbJ:jT9Bu1o55dSbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761651910, "uuid": "29bbf63d-bdba-481f-9f61-0213d64a1188", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761651910, "uuid": "0e758443-eb66-46c9-a410-9695f5e6c7fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651910, "uuid": "e4d2d981-a214-477e-a837-add2dddad086", "value": "1761651372bfc1a9a1c297f2e47cbdcde7fe622d5588a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa2d014-b3eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761648628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648628, "uuid": "ad34b137-ef64-45b5-85c2-df0bb8475ee0", "comment": "Malware payload (Formbook)", "value": "1a09938f23fe83b135ba3b157912b2aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648628, "uuid": "4db6a231-ce10-49ce-aaea-b9b948a6964a", "comment": "Malware payload (Formbook)", "value": "543b79100c980122ce6bfa54b78765da0089ff34b33ca6cf5e9ecdc7ba5e43b2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648628, "uuid": "5a703591-f252-4bae-b235-6b84a3fc8d4f", "comment": "Malware payload (Formbook)", "value": "22668d49124aa0674ac00718d846d7b59623f7a9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648628, "uuid": "d7e56b1a-fffb-4e36-94ff-1a0e120ddc37", "comment": "Malware payload (Formbook)", "value": "7d0a5242e415283ed9fa9d257f972e41fa32386c9bd20de5607479955f507459f84cb50e3167779c8a20a58b2a944867", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648628, "uuid": "bc3a6ca1-479a-4a91-8211-050e3250db63", "value": "T18EE423BA473C6290934A9EDC6140F25AC4384CEFC1DBC975574C663D2F8CD62A6C8B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648628, "uuid": "65f78730-1cca-4918-967c-4d8ee78ecc26", "value": "12288:k/YaiwSpyIz3Kp/5H+Z6guqONkvnq6Oqfw14YdtCd0iSV0pp58KWCM/3S:kgNwSpyISJ+ZoqO8hi1DdtCdkqD58FC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761648628, "uuid": "850e1e85-12d9-4307-8eb4-d28429c1374e", "value": 700399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761648628, "uuid": "3447f495-2f0a-4290-ba42-7a075cd6a525", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648628, "uuid": "a8ae10ad-9243-4d81-ab54-bc679451bdc9", "value": "Doc Proposed Checklist.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb1a733-b44c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761690136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690136, "uuid": "6f8806a8-b304-442f-94c1-a9293f177a92", "comment": "Malware payload (Mirai)", "value": "a2619516209e030a58585f84568487bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690136, "uuid": "8006ecd1-8628-49c9-9d4e-299b64d1ea85", "comment": "Malware payload (Mirai)", "value": "546d9bee1752d1eddbd681f067ba4fcbbebea3d7805682722f9c4f3c52695346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690136, "uuid": "1b5096aa-7a4d-42fd-88b5-503e7d7c408a", "comment": "Malware payload (Mirai)", "value": "0096640638d7c0fb65633208be7e664856a32e73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690136, "uuid": "08eb61d2-cffb-41ff-a2bd-340e1b1c88bc", "comment": "Malware payload (Mirai)", "value": "d9687d6130cc1e5f91ab56a750b0bf6251f436fe4dbd7bdd610f856450dadf12b84f3fb7d8b18e343156630dfdb7de12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690136, "uuid": "bc29b2a4-6925-4c63-aa03-af44aa089b9d", "value": "T1A3737B68FA0EBC41D2D7E379FD558BA2712B3C94931A81B23D01A34DC4F6ED4CA91927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690136, "uuid": "1ab145ea-401e-4e4b-9e77-17f425a44869", "value": "1536:+P/b4Kbuc8jclPX7OYtRmEHHRvKmN1LsxpUM+oMgKauTJIrhHr:+P/b+cyW/7OYG0HRbRuKM+XgKWhHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761690136, "uuid": "050c2715-b56c-4fa1-85fb-0c13f72c8cfc", "value": 79488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761690136, "uuid": "a044ea4f-ecc6-4429-b94d-b3329ef94110", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690136, "uuid": "754431ac-1822-46e2-88a5-7174db7106ed", "value": "SecuriteInfo.com.ELF.Mirai-DBD.27616443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788daf01-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761634693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634693, "uuid": "c7fb172e-2f58-4c93-a9c5-0f582749d6b2", "comment": "Malware payload (RemcosRAT)", "value": "f37bcbdee42b8ca6e103bd92f1f03305", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634693, "uuid": "bc659fcd-5fe5-4336-9148-f221b6991964", "comment": "Malware payload (RemcosRAT)", "value": "54b32bcf49895b56cc5a2f15fbefd0ed30ee9aef1aafbcf4eaf2f288e8384617", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634693, "uuid": "874f5ca2-de40-4740-9f06-38a683914bc1", "comment": "Malware payload (RemcosRAT)", "value": "d7a0916952016ebd5a270c1754a734eca2218459", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634693, "uuid": "925d35ec-1733-4608-970f-a182d8aa900b", "comment": "Malware payload (RemcosRAT)", "value": "3844deb8725b9edbc8a7b0545e11ca993d9e85d9e8551901ccb738e6ee7d51f7187b559cf438525745902c4aa26514f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634693, "uuid": "7e20e2ab-840c-4163-b5df-71c875e5cfd3", "value": "T1CB259D044B88B8FDB7EE7D8F17FBB90512110B71E5AA380D629163EC2D8B5CD7639219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634693, "uuid": "0332e434-ee2c-4cde-9138-5f346a0b2a63", "value": "12288:52lHTIvkb9dn0XfUJB4tkZ6uqIyJA0zyWSJi/Ed04zFpJyG0r1lV+Vu5iUGhlzSV:52CWn0XfUSKye0Hoi/X4zJyGcLVcubRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634693, "uuid": "a78d8f4c-dd05-4ca1-a6e4-8e98658bd09a", "value": 1005229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634693, "uuid": "8573c32d-d297-4ecb-bf35-42d4076ed98e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634693, "uuid": "c26a1ff4-1053-4565-a3f5-a3fdf6b6642e", "value": "Purchase Order-0010.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6ebd0c-b39a-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761613816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761613816, "uuid": "0b72db6a-5da3-4617-883d-92b02b594493", "comment": "Malware payload (PureLogsStealer)", "value": "12bfbe5fe642a549541282b4c6e06f8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761613816, "uuid": "b855ec62-6bb4-4e66-91c5-febd98d29284", "comment": "Malware payload (PureLogsStealer)", "value": "54c9a7b2d0118b16cc093ffe52bce2018e15fdee6827cb6deba928d71d67c93c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761613816, "uuid": "7aba3bf0-2ac7-4ee4-85e8-0d51fbde3155", "comment": "Malware payload (PureLogsStealer)", "value": "be56283eb946cbf81c7fac7543e2d12590be5760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761613816, "uuid": "dfe8d3cb-68eb-4296-91a5-d7620b3bd86a", "comment": "Malware payload (PureLogsStealer)", "value": "832274c4c6bbdc8d98f197a66184bdfd75430165bfbc8d4641a04c57ec067b9a0cd5a5b0b2a42f6bbcad14d21284eb84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761613816, "uuid": "7bbcede6-3f67-4abe-988a-10de02af5b8b", "value": "T1BAD54A0FFA864BB2C1344736C5DB452CA3B4DA817B23CB3A7549235605CA7F97A4229F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761613816, "uuid": "3f5a7bbe-4317-4b28-8449-24b1ee146756", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761613816, "uuid": "73db7f22-3e93-4eb8-beff-c8534ad4be02", "value": "49152:2EC3O1moX2nfWZGJB46V2E/T5ZWBTpHLHaQg:23K36LlZWz6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761613816, "uuid": "089d8289-6937-483e-b501-4ee40d5c7d5f", "value": 2757120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761613816, "uuid": "21c0dc0e-d7ee-4aaf-8fa8-a78e0b5d7a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761613816, "uuid": "1657626b-61eb-4087-9f30-e570d4ab6502", "value": "October Payment1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a98cade-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656573, "uuid": "bfdf6127-07f1-4830-a093-a3294d09013d", "comment": "Malware payload (Rhadamanthys)", "value": "b7e396cbd9eb7403b980332f47ac9578", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656573, "uuid": "8b1456b8-399b-4ca9-a9a4-dd17f3e20e94", "comment": "Malware payload (Rhadamanthys)", "value": "5549d89ddc04df7a140dae0f4c7a72f6f9430dcc50d3aa5381e0824188b262a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656573, "uuid": "ebc3d9d2-5058-4042-8469-2d814f9db371", "comment": "Malware payload (Rhadamanthys)", "value": "6bede497b03af91cee024fde2eeb0f72e0e5086f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656573, "uuid": "ffaaf426-1f08-4ee7-b123-9a3f2f2d1232", "comment": "Malware payload (Rhadamanthys)", "value": "d2e2fc7c0c9e4eb88acc10bc189478f70c009dabaf82b2a1bdfd694c964f56aaab93bfaf3ea4d0cf0b9ca46fae6033bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656573, "uuid": "06b7c620-af7f-48a6-9766-d2629f5b0096", "value": "T1DDA3F9D87DB3E8B93093578ACB1164D0E817A57345F05010981FF3A681E93AF5BEA8E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656573, "uuid": "5f35bace-1348-413f-b206-e95017f03f8b", "value": "1536:GDB7eKg20trFrKZ4Jf5NAh/96BkQWJ+aY:GDB7b0V5gUf5E/96BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656573, "uuid": "13918170-2547-4561-96c7-016772d6e7dc", "value": 100699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656573, "uuid": "7c3c4501-ac1f-4eb2-8448-395bcdeaeb85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656573, "uuid": "362f6454-dd57-400c-b54d-bbdec3e60670", "value": "invoice-1637482117.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc45510-b3b8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761626725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626725, "uuid": "733ed5da-4576-4c36-8ef0-09b6d4b108d4", "comment": "Malware payload (Mirai)", "value": "eb5a4b153e673ef40c128de48824415b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626725, "uuid": "7b371042-31cb-4250-82fe-155dfed72ecc", "comment": "Malware payload (Mirai)", "value": "56bc93c42245723780b706d193f7f1a3a2c46d4665c333f22bf9c58116b9cd18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626725, "uuid": "917d540a-46b9-4f52-913a-b571b0d89766", "comment": "Malware payload (Mirai)", "value": "4ef05293930b544b7365dd1a764e39442358f494", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626725, "uuid": "c3f86a1f-154d-434e-82ff-b579e8579c00", "comment": "Malware payload (Mirai)", "value": "ab5d33db85c870282ef8c62635f9b2821da2ad6956c159e69723c657ed95c0b2912258d5081d5adb4932566312bb5bb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626725, "uuid": "3d0c36e8-942b-47bf-bf41-716d4bf11fca", "value": "T193630211207B3DB7D9C1C833E6752D85E397BBB43082F2B411685996EC5DE086EBD0E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626725, "uuid": "837c0247-4f87-485b-9be8-fec93407b56f", "value": "1536:NlxccCt5/OHfvo54ISQgpi+dX5Je2mwLBaC8GhcUxfSt6c9cuLB:7xccC+no54ISQgI0J1hcISIsLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761626725, "uuid": "d5ff7490-b6e7-4aac-abc0-16849a136562", "value": 70348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761626725, "uuid": "c01bff03-58ac-41a9-afe1-ab2bec98884e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626725, "uuid": "dd120d63-ed9b-4b21-b6c8-f2bcb8ddfae4", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fd2791-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654041, "uuid": "e88357c7-df3e-4133-bf51-fa9bb6654928", "comment": "Malware payload", "value": "5dc6b57ec701299c28860b4070bd76b1", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654041, "uuid": "e9465983-9c34-427d-9998-11075cffefec", "comment": "Malware payload", "value": "56dfe48a8e8294e09d07f23138ebfd5f31a9f1a29f2111c2200ded92aae0da37", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654041, "uuid": "664a59e7-5df8-45c5-ab2d-ddc680fc34dc", "comment": "Malware payload", "value": "96ac6cc0367c86834db0f4e50a2a3b4a497a9163", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654041, "uuid": "32a1790a-63cc-4c08-81e3-5d867e569f9b", "comment": "Malware payload", "value": "5cb2b44ef3852374dad4589ac2395373c346f32d4d037c73bff797f68acd075fc8a702a458536b3a2cd32be9a471a5c4", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654041, "uuid": "05e159be-798d-4710-a3c7-a099a35c7174", "value": "T1F512AF24A7CA45A0F4EF05FE3FC8515BE42E5A46B990285D904EC3227E504F585B8BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654041, "uuid": "e1e71c1d-adb7-4239-8aba-c8c90500a740", "value": "192:E8W7V7WDT5vMIGYHB2CaXey/57cC8BlP+j9iWV+/UVWYULlrhp43gTJI/KtA4:E8eJkvBhDauccCqIj9M/U4Yg0QTJIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654041, "uuid": "e39ae47f-2a90-42f6-94aa-7bdb7dffa87b", "value": 9645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654041, "uuid": "e0a3d0ff-9d49-43d3-8cb2-b7566bbf4895", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654041, "uuid": "7486b6ec-8f04-4b58-b7bc-a738b985aaa7", "value": "kion.odd.vbs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bf2b5d-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620939, "uuid": "b9fb080e-6da6-42b6-8a4a-df2d74cd9b21", "comment": "Malware payload (Mirai)", "value": "62ea48eb9c08492feb0a4497f2954b22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620939, "uuid": "8e81bf85-2e7c-4594-8b28-a2f4182bc00d", "comment": "Malware payload (Mirai)", "value": "570a7d7cec9170763f38767eba4d1acb6a8e7e2700b1bc721bb7cd8657202a55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620939, "uuid": "cf6ee355-7602-4df3-ac35-837c5a3c5c76", "comment": "Malware payload (Mirai)", "value": "052fedbaa49de2d4c20d1891f9b04fc41146c04f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620939, "uuid": "6cd3c419-1f88-4e43-ad05-b5379103a612", "comment": "Malware payload (Mirai)", "value": "15fd8dd18475927d9c693b63b7a29b84325a7796e06ed7165b8f7578cd5db163d2d60cb8c7e609f56e99362fee539529", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620939, "uuid": "6c6c3053-d0ef-4b81-9da8-a6d48871cf4a", "value": "T11E8328C1BA4BC0F5D90748304067F33FCB32D6394061D66EEFAA9E65EE73642522629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620939, "uuid": "4908c877-3877-477f-bdca-65d566d54ab3", "value": "1536:8l8IhK59kLMSbs67z1WAcanWC8f4TxdgoXF6hKal9:8/hU9ktbX1WnfgTxddX0l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620939, "uuid": "d5495d01-b00d-4b7f-a7f3-d8120b5554de", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620939, "uuid": "0730bc86-d472-4277-b75b-476adfc50a5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620939, "uuid": "63b6c380-8b90-42e8-b819-c9584b7fbf11", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f946551a-b419-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761668409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668409, "uuid": "ee264597-7efd-4980-ab42-f40bb57b2846", "comment": "Malware payload", "value": "931a0fd7541d46166ec665abe24a0a9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668409, "uuid": "5ad9bd98-3804-4853-9053-74cf784cd2f2", "comment": "Malware payload", "value": "575ef1797c25179f4919405ecadc71b6c66f7eb5874751975ce9a927ffcbcbe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668409, "uuid": "1f3b57a4-728b-4b94-bc7a-da795885a661", "comment": "Malware payload", "value": "1f1c1e28ce454d384a3f692f9fe3ca16717c2627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668409, "uuid": "3e4c70e3-00c1-4423-b1c2-4b9be0c3889a", "comment": "Malware payload", "value": "499d081e196203c8bb11f39fd13cd99e9394403ec78753eb4c62694b8ef234ddec6393d6fb5aa6ddb0315db23a088dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668409, "uuid": "a491c21e-9e22-4190-a65f-baf79f9822a9", "value": "T18A32D543306C0F5ACDB18634053A41B087BEA95924F87B99A51F9B764FB9E2B1086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668409, "uuid": "05dbed3e-caf8-422d-857a-8236160adb92", "value": "192:T3H1/kqGQdnjPB4lORhGGJ8ZQN2r+WYwQjjMy3rRot6Cge5XRGPYmp0DuCXk0l+w:T3H1/kqGgrRhGV3Y90SYRGPVSDu4l3uO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761668409, "uuid": "beee555c-db52-454d-b9c6-a375f940b0c7", "value": 11865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761668409, "uuid": "fc673ed5-fe11-4f64-9471-331a97972b2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668409, "uuid": "81707b97-3da8-416b-8381-61ac3ae805cc", "value": "SecuriteInfo.com.Trojan.Linux.GenericKDZ.453.2095.16630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaa301a-b459-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761695631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695631, "uuid": "90d0399f-531e-45f6-807d-ed45a7a1d27b", "comment": "Malware payload", "value": "bb4e5c37811e3ac0d950b36227b20713", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695631, "uuid": "81dc5658-639b-4838-9b1c-3d92ab086dac", "comment": "Malware payload", "value": "5787bbb99240daa317c72428a3ac67e09b373e330d9ed5ded028dbff0cad433c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695631, "uuid": "dfada221-ce52-464e-ac7e-2739c666e936", "comment": "Malware payload", "value": "82d7aff24a2447ce06116e5386e641c4505692ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695631, "uuid": "bec63675-6c7c-4686-8022-5282945d207f", "comment": "Malware payload", "value": "ec3ca741009c8cec2a7349239987bd25041d7e02b69973c4fdd3dd0df733119e16f2906ff1f5657aa2ab2bce263da1ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695631, "uuid": "82b0cf99-2e4f-457f-b6d2-2350ee92bc59", "value": "T196433B375692CA7BC0D747F517D796218133B8391F236209B3D8BDAA3F269C82E59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695631, "uuid": "20b2b027-ff74-4ba1-b45a-73e33c7faf8d", "value": "768:UEmQ1KeSZaLGjuL3GoxVbsVFWnyVZSgHo3Gk7IfuXYYYnC8439qS/DDrWMCLsZ:K6/HGSDjbsVFWmSg+7QClKNsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761695631, "uuid": "1fa5b824-c04c-4204-bc8b-3b75335d9bee", "value": 60197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761695631, "uuid": "9789af9f-fdec-47f3-ad45-5e0ce3d0b96b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695631, "uuid": "0a80a54e-f992-4a37-9dc1-40a2d8010d36", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e1985d-b419-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761668378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668378, "uuid": "7bb3743b-956c-41d5-b5ea-c1cdfe0e1041", "comment": "Malware payload (Mirai)", "value": "be15d193cb6b3833cbbc67b3e1937742", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668378, "uuid": "2d1c7741-945b-4983-933e-9ae05fa2d865", "comment": "Malware payload (Mirai)", "value": "57a118c474cdb8c7fefb7995a14db626ad4ef30aabbe0180422c6761e8e355fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668378, "uuid": "46f12c36-7727-41e1-b048-b12f92364742", "comment": "Malware payload (Mirai)", "value": "1321607f7f6edd87cc9109a5ea3494f48e658443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668378, "uuid": "25c663bc-aaf7-4bad-88d1-bb7b1616e873", "comment": "Malware payload (Mirai)", "value": "b593778ed4f0b8d555a8526b70a92cd7e3b7d477d1945601b1e5cd46b1a0bdf5c57c360b7d07ff1c2b5feff5c75f9ff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668378, "uuid": "7a15f645-43ac-4989-9899-a4699edb9d55", "value": "T149D3BF32F0046C90CD21167438B6967C1340EFF416E55283EEBEE5DA28BBE6579EE760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668378, "uuid": "0285f524-147d-4c74-a8a3-08c3473c75ec", "value": "3072:eVaiBYMAc9mkvZuqmz1OHrO5aAZGpnhZs10hSZV:eVa2u71orObIlTs1E4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761668378, "uuid": "390125e4-5b81-4838-8ab4-222ae1f54b3f", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761668378, "uuid": "26b6b37f-f7ef-4178-865f-6ce6f2beb02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668378, "uuid": "7ef29367-9a84-4131-81cf-e7af03351fdb", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158fdcd9-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761635815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635815, "uuid": "e5fa10ab-1119-4157-bf3e-a9cdd920a3be", "comment": "Malware payload (Stealc)", "value": "58aae7123431b23f47b517c229bf1e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635815, "uuid": "83b60d51-b84e-4445-bb13-d5f6d66e511d", "comment": "Malware payload (Stealc)", "value": "581e67ecad1f19be4e34d8b43ed2db992f0ad8fa6b44f8568b4c24d12cfd15a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635815, "uuid": "032bd7a8-3ed2-47f9-938e-968eee272f4f", "comment": "Malware payload (Stealc)", "value": "ae82629e51d8d6feb8bf04bca2b3ce652bfd032f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635815, "uuid": "27a1910d-65ea-4135-bf97-b51361310f2d", "comment": "Malware payload (Stealc)", "value": "d550d0aabdc7c291afdb5e4a00d29f948a17fe8eaf55bf709dfdb076695c77c98feee650713eefa54c0fa74a559c6be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635815, "uuid": "e7bc3092-941b-4353-8b60-fc661ec32a51", "value": "T11BF511CFE383C403C96C2FB265946A5BED31FC0E78A24F299269F1753632E193199E45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635815, "uuid": "5cbaccb3-99c8-4893-904e-bd51994b6c5f", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635815, "uuid": "349e690e-2666-4155-b9b7-f51caed4d02e", "value": "98304:UGVHUFqOJw26MO3QawcCknZu76IKJ3YX1PmixDJiZS:WqOfOhwDGhodDJiZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635815, "uuid": "d319ea1f-111a-4ca3-a14d-cde70bc12d10", "value": 3456960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635815, "uuid": "d74a5339-8016-485f-9637-8eb7c0d052a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635815, "uuid": "415953ef-b683-416a-81cf-3e98bc50276e", "value": "SecuriteInfo.com.Win64.MalwareX-gen.35339287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56806d47-b44d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761690470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690470, "uuid": "680c6674-15d8-4e11-990e-8c2e61760806", "comment": "Malware payload", "value": "af8c8a880b31e79d00e518b6720720f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690470, "uuid": "f1dba595-443b-4db8-bb8d-fd437046ab1a", "comment": "Malware payload", "value": "58f124c84ad21073aba57d686d295566890a25f1b88fe899a58af192ef934574", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690470, "uuid": "051cd65e-9628-4ea8-a94c-eb706f948118", "comment": "Malware payload", "value": "a4c8df4ef367549add544fa7cf304133c45daaa1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690470, "uuid": "092dce43-d942-494c-995f-2b68408b822c", "comment": "Malware payload", "value": "3052c80f62f20b7747ffa605c76f9f6115a9dd2058ffef2ec52c4322b6cfef69abce768af48ff20fdc8e734d0aaf5f7c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690470, "uuid": "1294ea8d-dbb3-46e3-ba3f-8a6d5fea44d2", "value": "T1DB0112470D719FB08D74C7487CE50A5C5408D3C163912F79E58B1B76B698E247533F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690470, "uuid": "6651a26c-1399-4737-ac80-76b031fb274f", "value": "12:784HqyQnp4HiQnp4HIyQnp4H+yQnp4HXwQnp4HtQnp4H7bOQnp4H7kOQ9:oSCpS1pSIFpSepSzpSGpSvJpS4J9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761690470, "uuid": "f66720de-54e7-404a-a618-fae886e0e3ba", "value": 784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761690470, "uuid": "659e9d54-1b5f-4e53-8a28-0024c85e7ce4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690470, "uuid": "92f47f52-e229-4ff4-90e4-04c31704d184", "value": "dvr.jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ba305c-b3cd-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761635661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635661, "uuid": "d241a9f0-e995-429b-8255-d8eef355405f", "comment": "Malware payload (AgentTesla)", "value": "d6d5b4677130676ec93938576a3600e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635661, "uuid": "3bf9ea18-8c52-469f-b10a-fe98db67f9f5", "comment": "Malware payload (AgentTesla)", "value": "5937ec8f18e55b4cf85388c886992ecf7ada1a3a0ba17688e4fa6ecb2f9f81f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635661, "uuid": "ff67233d-8db1-45b7-b24c-3c1ecccaf77a", "comment": "Malware payload (AgentTesla)", "value": "69ba154ca4068c6a16b6bf945c4630cc0145df6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635661, "uuid": "c579ba80-af51-47a0-b348-b69b18ba4469", "comment": "Malware payload (AgentTesla)", "value": "edf70d4784ae5bd601c60ae1ac8af626a6bd4e97225cfe7897b0556bc5084a9e6a0fa6cedc65ae14ce4f54a9e1717e6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635661, "uuid": "3ac56f02-bdb3-40a0-bb95-d69ae01fdd10", "value": "T117E412442BB1E403D8E6A3314DB1F3B84774BE9AE920C71BDED46DABB979A504D10723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635661, "uuid": "56291cc6-f219-46e1-9b68-b7f82b846f8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635661, "uuid": "156e60f0-27cb-4072-a126-2c1c29ba37f6", "value": "12288:q7gmq4dldiz5a3W5VI4lhylNaC3Plc/UeNRDtH:qkmbdiz5a3uVIghyZtc/Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635661, "uuid": "438d4b1d-5306-4d8d-9f10-cde356fe977a", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635661, "uuid": "9c6391c6-2951-4a13-b925-5dc5a2026ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635661, "uuid": "103d27bc-fc6e-4c70-88fa-6e8d1b37d69d", "value": "KHN250045 Booking 1-case305kgs2.53cbm ETD.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c152a0ee-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1761634815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634815, "uuid": "29e73a56-03a9-4206-b4d1-5fea9e9291d9", "comment": "Malware payload (RedLineStealer)", "value": "70278c60597b0460e365c6923d3cb488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634815, "uuid": "50ec3373-5d5b-446a-a97e-24ba13b5881d", "comment": "Malware payload (RedLineStealer)", "value": "593ce4cdc76392a894b3cb77beec4352b0be6dc06b4f86b9a7352d57041c1b4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634815, "uuid": "56a45c44-3ad4-465c-83c0-c52539e678b4", "comment": "Malware payload (RedLineStealer)", "value": "ecbcf6799754a68cc4a41233bbb16dc5160e4ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634815, "uuid": "8919e1e0-cb3e-43a0-b70e-516f51b83e8a", "comment": "Malware payload (RedLineStealer)", "value": "6cea9cd3c968a7dcd9e1e6f7fd5dad67ceaa086b9a0b6b6c653886145159e3d01c630f30a70b4f4a74a04bed5e420850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634815, "uuid": "892084b5-d50b-4495-b5a7-fb4d832dd13e", "value": "T134B4E054267ADE06D0A687B719B0F5341FAE2D6AA861F2468FCA7CDF7D32B010D80753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634815, "uuid": "5a19aa85-dc89-4450-a5b3-ac23afbe1c6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634815, "uuid": "2890da0d-4c1d-4f36-b1e9-e44cba12108f", "value": "6144:QkmTWLUrD41r4oim/ciiuxhjrafyhQEdvtMyj41qMK4g2fBEw7ufHBzv:Qkmq/1rsHibhjraK+2E1qnloBEw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634815, "uuid": "b050750a-5a98-491c-9816-05978e4bb410", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634815, "uuid": "7da1a957-ea78-4664-87f1-d722fd9b6a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634815, "uuid": "4bc4cb8b-2ba1-4268-8d70-f50e71d3a85c", "value": "MACHINE QUOTATION #NIIGATAMACHINE8976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca73d1d-b3ef-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761649973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649973, "uuid": "2882da70-28a1-4f3e-ad03-1a820be57e20", "comment": "Malware payload (Mirai)", "value": "a3eb0d6e22651389ac552d5a09d76d17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649973, "uuid": "a0abe711-d20b-4538-99cf-c926452ff034", "comment": "Malware payload (Mirai)", "value": "5999df7dd3b3f890f2b97db6be94dd05b29351f74d0f096371ef9d1ca44e1fdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649973, "uuid": "bcf10d9f-09f0-477d-b515-db8d394fb317", "comment": "Malware payload (Mirai)", "value": "d04b1563a613a307301965a93aa10df921fc56e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649973, "uuid": "f89d6e61-98a6-4890-9241-309b39503507", "comment": "Malware payload (Mirai)", "value": "5adfe30615133d286e2a81c3f00c6be3400cc6af78a970ce30ed44451388127d20f35fadb6bb6c0eb3c3ce5e30f84676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649973, "uuid": "55412f46-3dfa-4588-bc3e-e544f5216fb3", "value": "T17BF33A2F258192F0FA411B7467CBD3976C291BBF11A9A0DF6B415329B6E0B7BA03C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649973, "uuid": "50d69d35-7ddd-4e4a-bc0e-ba15802a3334", "value": "3072:KlOzgiHwOFbLhx5pXq+a1jUuQ6ssNtU7G5N6HTAT855UJUVC:K8HhxXarUH+SyL6sT85uqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761649973, "uuid": "1c549e82-ca97-4a29-8787-5e429edd4df3", "value": 172756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761649973, "uuid": "13afd0b5-9227-43a2-906e-ff3b3cf49913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649973, "uuid": "1a664adc-768c-4544-b0ca-b80e894cfa36", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb9718c-b41b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761668979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668979, "uuid": "f454b8d9-4fc3-4470-887e-e7bddb2fe692", "comment": "Malware payload", "value": "357cd7ad51e5b7fcf9733e39d9d70889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668979, "uuid": "dc073e29-2973-49c9-95cb-9eb04f9dbca0", "comment": "Malware payload", "value": "59d05d35df3c19e3c7faa9a0c3c3b9fef663ec5267a633edf8cead27dfd00f30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668979, "uuid": "92a809d0-7e31-43ab-a346-f48602702d66", "comment": "Malware payload", "value": "f64620c0d36e6ad327a8462d97cb2378105da432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668979, "uuid": "0b745259-6d34-4660-b897-d97182e187a7", "comment": "Malware payload", "value": "17050615cc60dab3c58b2a3f44ce9b49f75db7d470a97d4c414a0f8e6272f805eba63b67e53b7db0c1166be215a1e19a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668979, "uuid": "3ee198a8-dc50-412e-a2d9-a896abdf15d0", "value": "T148C3C40E7E618F7DF3A8C63847BB4D35A39D23C626D1C685D1ACE2111E6434E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668979, "uuid": "bc7f1e21-14db-44f1-a572-f6d3e606788c", "value": "3072:fiW04+zGo/0ctkxpP4hjJ15yn29RtxvG9YoMDcWB:D04KGLKhjJ1En4vunWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761668979, "uuid": "8a78da35-f1e0-442d-a6ac-6ec1da23e765", "value": 128464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761668979, "uuid": "9c8e7880-8f16-4069-bfd2-f84a797a4baa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668979, "uuid": "9753cd43-9577-4e79-8066-7f85ddac7336", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731c1c6d-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656588, "uuid": "17916af5-a381-4a44-9d4f-9242b42ea6fb", "comment": "Malware payload (Rhadamanthys)", "value": "9c6cc37d04207f37d955eba836ce4a95", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656588, "uuid": "d2914a7f-2b1e-474e-871e-22bedfd7ec65", "comment": "Malware payload (Rhadamanthys)", "value": "59f3628e1ff1146ea6d2c7d404e48819226afa35f132fbc85b79120f249311c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656588, "uuid": "5dc50f42-db48-4eff-b2c1-cc98343b2f91", "comment": "Malware payload (Rhadamanthys)", "value": "01284ad5b19449ac31d036b91a901aa175b51d34", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656588, "uuid": "c462b409-71bd-4b45-9d1b-a0d42fb94bbd", "comment": "Malware payload (Rhadamanthys)", "value": "d22b083af7bf2cac77719e74fb19a203a8f77dd48cc320f571a7f2f52fb6ee0cf661462ed29ec5be41e9624cb1906070", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656588, "uuid": "37f9fefc-36e2-4db6-a1e5-b43cbe0cf473", "value": "T1EBA30A09CEEBECE430A2F6824DEC05A1A72C81E6961B747BF01557D75B1D71288B1EE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656588, "uuid": "0ad89053-8927-442c-be82-449a1d5254fe", "value": "3072:GDB7b0dw9SWTPx8GRquowP3hjvDcEbSya9lphK2hNyqttiRwSlydqEsvjR8UQwqe:0Cw9SWTPx8GRquowP3hjvDcEbSya9lpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656588, "uuid": "91361246-d80f-495a-bbc5-ca21e866773a", "value": 104126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656588, "uuid": "173f3fce-d31f-4326-aae2-d57335a16f15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656588, "uuid": "5cdf2b7d-c115-488b-ae35-47e6d240384f", "value": "invoice-1637482117.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d664ae-b427-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761674230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674230, "uuid": "0106433e-557d-402f-ad95-44f6be188ca9", "comment": "Malware payload (Stealc)", "value": "d47b742719bcf65fb5ee3898f461a84c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674230, "uuid": "245f489a-337e-4b43-ba84-903d0f4736b0", "comment": "Malware payload (Stealc)", "value": "5a4a506bd9bef25b31aebdc7ee588a7af4c2ea507bb6cd3de1453c60fc6d053a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674230, "uuid": "32b84a78-37ff-4b29-b29e-04650edef357", "comment": "Malware payload (Stealc)", "value": "18b2f17eb28baa9ebfba701eccf8ace95c589def", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674230, "uuid": "6893273c-4b14-4854-9397-9dd34a24fadb", "comment": "Malware payload (Stealc)", "value": "ae364b0edeee03e3021ca4937126d293333ca8c3c583e1c8d30fe5146f5aceb2439bc563663af32dff836611893eba8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674230, "uuid": "28c0e7ac-f129-4624-add5-4eb35ac7244b", "value": "T1BB06115E20C6A417E52BDE318EA4B46337660EE3C4619DBD11FB3D6B2EFC3896516083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674230, "uuid": "d7cfdba9-f843-4d04-92b1-1cf14c40d1f5", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674230, "uuid": "a31c06df-12b2-4f41-96b9-19cdde89d69f", "value": "49152:0oVerGI9snz/PRDkWeGhSIfCzUW5qpq5wXMQLEWTRSb3RUyQUWt0guuYdP4Q5b1:0qIeLCWHBfZWyqmXtLEWTCO15t0guE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761674230, "uuid": "a320d8b7-a517-4cc5-afe2-4070382703a8", "value": 3742144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761674230, "uuid": "a3d10d05-5e7f-4b8f-84f5-02016be0fa7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674230, "uuid": "93c4251f-835f-448f-afe1-f9330707eb8e", "value": "SecuriteInfo.com.Win64.MalwareX-gen.19763393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f381051-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761636449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636449, "uuid": "af28f8f7-4561-43ae-b5c7-97ea7ad12113", "comment": "Malware payload (a310Logger)", "value": "9d3d2eb47c229b986626c9e02760ffd1", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636449, "uuid": "b73303e9-3579-417b-982d-cd09730e5c60", "comment": "Malware payload (a310Logger)", "value": "5b3e77fd20a7cf117f2808112403368d97e16e5569fbb0541f2fd9aec8a23dbf", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636449, "uuid": "e074e278-183a-4046-8bb2-d71a1ff75f6d", "comment": "Malware payload (a310Logger)", "value": "ecdd9f8060840652014924100bbe543d9a3a279a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636449, "uuid": "703f9fef-5e12-44ad-90f4-59385df68679", "comment": "Malware payload (a310Logger)", "value": "6e74c2fd483ae366b31dbf11c8397c3761ea6f661435fd0e4ee8798488146e6c7de4c284b3cbd7b772fdbecccd20001d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636449, "uuid": "ecfe32d2-d88b-420e-a58b-b160dc5c8429", "value": "T1BF1512582359C901D1BB4BB84DB2E27807FA7EADF831C20A9ED96DDFB665F014901B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636449, "uuid": "25a87292-7c01-429e-bce4-f3639d1fd2d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636449, "uuid": "e01a496b-80eb-41dd-a2d4-abf040621bec", "value": "12288:yFmqGH1h1Ts5zHlQTKjEAVWV1FlxA27NRHBlps5raKJQeIsoeM2cdpdCGb48pgD:um75TsJFQTWEAe5AoNRn61NM2shbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636449, "uuid": "a89eb79a-6137-478c-8909-321afe139a50", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636449, "uuid": "40985417-c8c3-42ec-adee-ed55cf4c8c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636449, "uuid": "4ef4d814-efc7-4bf8-8ed9-695c11dfd247", "value": "TEKL\u0130F \u0130STEM\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6361f2-b3e9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761647768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647768, "uuid": "5108a463-e089-48ed-b665-58886f232d39", "comment": "Malware payload", "value": "489df1f6be2c9f8d98dedadd68f931f2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647768, "uuid": "fc85d523-edd1-4e87-880c-2adb13e3310f", "comment": "Malware payload", "value": "5c3dd390340a7c7f2536f469b3157be47c3957eccd4ceeb83cd2405e458e2ce0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647768, "uuid": "1764cc0e-2b55-4521-b871-10ab4d9952c2", "comment": "Malware payload", "value": "a3ebae3256930759297d890be559c24165df50bc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647768, "uuid": "09a8d383-d2a4-4734-beac-07e5568dfdda", "comment": "Malware payload", "value": "aab692ebb5751ac0061bc49efc5d7b1ccd34099b7ba4fb8e315e4b25d4bf9819189c8e05c5a1c43e5e9bedd0dc8a7bae", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647768, "uuid": "c4863fdd-32c0-488a-a734-89d0fdedc2ec", "value": "T18B36D057F708A85BC4FB53F2457A632141478D268B439AC36D18723C29BB1D0BFA9BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647768, "uuid": "e0dcd282-e68a-42d4-93ab-f9550f184d5a", "value": "98304:uTLbdDtlndMiYv55Ay7AUk2t/sjzfYFWEtOnn4ufS+o/KrazD:uvbDrMXv7vk22vbv4u6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647768, "uuid": "9e1b7767-fdc5-4977-8e65-92328a91530c", "value": 5240055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647768, "uuid": "1f8aea31-aa68-46c0-bac9-ba1302d1e2f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647768, "uuid": "6bec3211-88b3-4f39-a631-fdaa52549f8c", "value": "AiAssistant.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9239fe1f-b42f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761677685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677685, "uuid": "e2c52de1-2a01-4c86-b7b1-e866cba59fb8", "comment": "Malware payload", "value": "18140731f64f12147b414be0a840c557", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Sdum", "colour": "#650903", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Dwn", "colour": "#803D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677685, "uuid": "70fe7c60-4932-4bad-860b-2cb4931f0a36", "comment": "Malware payload", "value": "5d94b22f295a6e93d6e3a57b5525a830a419b520c8f3744a3a52c9e7d504f2ed", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Sdum", "colour": "#650903", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Dwn", "colour": "#803D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677685, "uuid": "7eb1e744-61a9-45dd-885c-109f84ab6c00", "comment": "Malware payload", "value": "d516c2686201739f7975d50ae42d33637bbca1dd", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Sdum", "colour": "#650903", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Dwn", "colour": "#803D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677685, "uuid": "1c3764a0-54cc-4e6f-9572-ee697edde11d", "comment": "Malware payload", "value": "5d4bd76b825ead0f53f068cd0482cf228af2418ff6cc0bafc44b25d6d29673a5cdd38e8c21bb922be9449eb0b42aebc5", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Sdum", "colour": "#650903", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Dwn", "colour": "#803D5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677685, "uuid": "fcf53a15-b976-495d-b3a7-377dfabada14", "value": "T165F733A7FD824126FA7060F689DAA9F7112FFE832B55488342857B19EC3F69453243F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677685, "uuid": "b2611024-3b30-4ce9-bfd7-f35efe0b42ad", "value": "f67c2d48a0d9fae633478c7ae08a5655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677685, "uuid": "7eb1f549-dd14-4713-ad86-c006df8564d9", "value": "1572864:cpgDGok+BWFY0WRdBSGg4aP+J+MHFDPZ8/KYcW5OmW4+YalhPa7Fq:cpgDi+EFY0WRdBScamlvBWMfYalhPag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761677685, "uuid": "6325de9b-dc80-4e87-85e0-67a40acf5c73", "value": 76927117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761677685, "uuid": "8e624214-6bee-4f22-980d-efcc98e39a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677685, "uuid": "7f54a262-997a-4069-97a7-0f0f1916db8f", "value": "OANAN 3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc24824-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654109, "uuid": "4a143de8-488a-4afc-b313-13a10992269a", "comment": "Malware payload", "value": "89eece65b9d91c8e504ea142bcfffb4e", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654109, "uuid": "0f713bfc-3737-469a-9a9e-d7035420367d", "comment": "Malware payload", "value": "5da6890ba29a2ce093abbc7648d9e96336a9f45dccc596d60dfe9c63e67ef167", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654109, "uuid": "bebbf770-23dd-4226-96a0-e743baf25bf1", "comment": "Malware payload", "value": "0f1664046726c34636c1309352713e8779c1f35a", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654109, "uuid": "3b7311b5-497e-462f-bc67-a8c8b823a434", "comment": "Malware payload", "value": "374a447cb5a065d029ff8ff7bedea473c7e361bec73a8c28aab36c1e2178a7729931750bb61e092aa857c5ec37d5bc6e", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654109, "uuid": "993bb7a2-f29f-4c59-9962-826fe76451e9", "value": "T1DBA01234D4000C37110B2484A1989A351040508240001341D89D042D78CA845244D100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654109, "uuid": "5305c2c2-65a2-4b7b-8bb7-8989a1dd5c1c", "value": "3:wdJFI2NFtcoHYsg9DxhViwxRyOZHTA1:s82NFtcoHYsKWwxRFZHTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654109, "uuid": "5a39d104-89e7-44db-b234-80e04fa443af", "value": 85, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654109, "uuid": "3af764be-9923-4bd5-af29-3ebb8e5418d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654109, "uuid": "95507894-3fbe-4479-b6ae-1868ef18b9ca", "value": "5da6890ba29a2ce093abbc7648d9e96336a9f45dccc596d60dfe9c63e67ef167.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de66abf-b3f4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761652365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652365, "uuid": "695586cf-d21a-4fce-8093-8d450c7a13ec", "comment": "Malware payload (Mirai)", "value": "266acfd645616f0fe6e946145445281f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652365, "uuid": "4b296dff-e242-41eb-8274-e2fe84cbd48f", "comment": "Malware payload (Mirai)", "value": "5dcf5848969bcccff5fbb62394e8a8a5b7f5b23df297631c7b32c3b7609ee278", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652365, "uuid": "b8a60ced-1e2d-4d61-a0ab-9535ab85d549", "comment": "Malware payload (Mirai)", "value": "dae85134ce35992397953513e32a2a11fa910fdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652365, "uuid": "0cdf1e4a-a625-461f-a749-653ef166ad75", "comment": "Malware payload (Mirai)", "value": "792ac0142e1c40f13d7213f5e46b463b034a302c69f5decf50d6d2e9afa2979e192519a92bef134b6fd383b686dab97b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761652365, "uuid": "f5e9046b-5a87-43ea-9be1-4546af03ba6f", "value": "T1E9A3AF87B560BABEE4D46D3FC4134E26B751DF6005835B2D66BDF9906A3A3803252F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761652365, "uuid": "016f2ecc-985a-44e7-8c41-abbb35b101dc", "value": "1536:XNJSjqReatpC2PdkqX1IQIwuLGUaay++buHkpDhV+TY0OwiUD++8rYi:XHScea3z6QBuLvs+kxhVUiUFUYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761652365, "uuid": "f5317a2b-ab60-4d74-81f0-d59a6a1b22c7", "value": 107064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761652365, "uuid": "e4a6a1e5-0bfe-48b2-b940-eecdbe29589a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761652365, "uuid": "3ab59fb9-8728-4e0c-a946-195cfdcb2686", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bb1da2-b448-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761688586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688586, "uuid": "5d2ad48f-2b63-4620-a39e-a75becd6aa73", "comment": "Malware payload", "value": "0347f3ebf28887fa7c618e589b394a87", "object_relation": "md5", "Tag": [ { "name": "AutoColor", "colour": "#FDEA06", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688586, "uuid": "02718cc2-f8be-478c-9bfe-9c6c11a84cdc", "comment": "Malware payload", "value": "5e07bdba9ade46211f5086e851c1fecf4d5d5fcebd0512a2400eb12a56f09c2f", "object_relation": "sha256", "Tag": [ { "name": "AutoColor", "colour": "#FDEA06", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688586, "uuid": "6db88a9c-1ee2-4ea0-bd6b-519cd056be1b", "comment": "Malware payload", "value": "9f724e80fc8f2c2da30d99fcb2d2261910e6eccc", "object_relation": "sha1", "Tag": [ { "name": "AutoColor", "colour": "#FDEA06", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688586, "uuid": "8ec73c03-1e67-49ff-aab5-dbca7806b782", "comment": "Malware payload", "value": "eab41767a80adbc613e3934067698a6edc603618f9d11e29c26744a5961ff792b188dd879c848bb31d8f76f02ad46643", "object_relation": "sha3-384", "Tag": [ { "name": "AutoColor", "colour": "#FDEA06", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761688586, "uuid": "0c751ffa-82d0-49fb-b585-69461e9c2d7c", "value": "T13C24181BB2B199BDD09AF0708ACBD1A26871B0F42735757F37829C732D27D940BAC661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761688586, "uuid": "66cf7de4-448d-4947-b084-67bea514cf8f", "value": "6144:23HD06tAFvXJwKwVyfDm97Hjf7fffffffffffff6ffffffffn6ffnfffeffffffX:23jlCXJZEyfDaf7fffffffffffff6ffE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761688586, "uuid": "0b4789c0-4c39-4ac1-94b1-ef7ed2e2d0d4", "value": 229160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761688586, "uuid": "c3511491-4914-41d3-86aa-917a21ff0a1d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761688586, "uuid": "3419156f-e569-4f68-a04e-c85bab651585", "value": "java", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c395a989-b3fa-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761655005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655005, "uuid": "77f0651a-c825-4be6-8ae9-a45b8744dad9", "comment": "Malware payload (Formbook)", "value": "02dcc90f33806f2b07949eae7bad71d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655005, "uuid": "3a41089f-02a6-4ca6-a2aa-fd4e26cbd481", "comment": "Malware payload (Formbook)", "value": "5e27f2b3c75919a11c2416d0e4d936fcfac01179bb649dd250be75d0dc096707", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655005, "uuid": "54491297-dc07-4fd5-87d8-3ea9cd60de7d", "comment": "Malware payload (Formbook)", "value": "fc51fb1f7777da33c3142a1171e85f4cee76ca02", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655005, "uuid": "c97e2f8f-da92-429b-92d7-9657b93b44ba", "comment": "Malware payload (Formbook)", "value": "e270c689d40ceb2889ee8be27468811258a57981ae99dc2f36c3c3ac3c4917ca4e92e8cc9dc0bd7330d90fccf81189ec", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655005, "uuid": "0b424827-c11d-4de3-826b-c8bcc4a11264", "value": "T1D7E4231781B7C3FF0C609CC1106D5EB7D2AB5454125AEC204FEA8A3FA859E29B52C9F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655005, "uuid": "95c6e9c7-fbac-4efc-b7f9-60aeae098e40", "value": "12288:PqVEObBe2xidyqzVbQgTsLYgySyxtT+5U/cV+i2Muk3VM3DnN8uOKLaDQhMT:P8Hxi8qJbQ5LVySyxtT+5UnMuEV+DnKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761655005, "uuid": "16bcee63-5127-4f19-b65a-0236a2e928b9", "value": 682556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761655005, "uuid": "4730cc1e-eb24-4aa7-9d48-d914df04f2e0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655005, "uuid": "0e9595ce-0e7a-4231-9420-c906696e0eda", "value": "y6JpZX20JbOHoJQ.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b9d33f-b41e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761670309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670309, "uuid": "0f38e00b-20b0-4101-bc93-d1ad472204ac", "comment": "Malware payload (Mirai)", "value": "5414c851e3e6008fb9ab27d257ffc5dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670309, "uuid": "45a96a90-6f85-410f-9273-25fad47feb0d", "comment": "Malware payload (Mirai)", "value": "5e5684195b4195fb3213ded585f3d739936d45b6ea088aa774c7fbdad867b923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670309, "uuid": "05ea86a3-ea66-4e98-8098-3a2097ae78dc", "comment": "Malware payload (Mirai)", "value": "d918b0abb4d11af7aea4fa8b1f1486ffe514a2fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670309, "uuid": "f883bd75-cb47-4f1f-a1c8-337302fb5662", "comment": "Malware payload (Mirai)", "value": "220e2eab212cdd3764177c5d7fef2f31590d56875360500e1448ed40a2404b186aee9bc798245bffadd62d59feb905d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670309, "uuid": "300b3a7c-4b28-4645-b801-c62b79335102", "value": "T135F33A2F258182F0FA411B746BCBD3976C790BBF51A9909F67416329B6E0B7BA03C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670309, "uuid": "248b847d-df9b-4048-b992-9b72ae269c19", "value": "3072:/TSGcrasHTatp7bbu0CCC25tQriU669O5NnNAkNDQs+QV55utUXu:/TeM16HCC2G4H6gDCQV5M++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761670309, "uuid": "c57ea23d-5e27-4fb5-bf00-c95e1cc0e970", "value": 172616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761670309, "uuid": "6d2b884b-8f83-4e19-938a-60c5087bf273", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670309, "uuid": "19a94416-2093-434e-8eaa-bd162bd73fbb", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0adb3e-b3f6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761652979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652979, "uuid": "9a10efe5-73ea-40fd-8767-ec27a13047e5", "comment": "Malware payload (Mirai)", "value": "c5dffb418e601b7a4248c83f7e13dd6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652979, "uuid": "24f99507-9c0c-4424-915c-b6266eeb5bb7", "comment": "Malware payload (Mirai)", "value": "5ee5077ed58097fbcfcd56ffa774214afb3c5ebf08dc5ddee72185668e4c7c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652979, "uuid": "2a527aba-8577-4ddf-a55b-63e3aa3534a1", "comment": "Malware payload (Mirai)", "value": "a8bb3925b51229ee574d0333c3eb29c830aa7fe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761652979, "uuid": "6a380b8c-664c-488d-ac76-7fcd2516f846", "comment": "Malware payload (Mirai)", "value": "84a790eac437b0f85a0c2f4affb75d1c170f359797c85d21126822e026c4b82964b9a7b8a0f62fa90564c5ec63ce7307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761652979, "uuid": "9178d403-a1b1-4e54-9d6e-0c6c36791dd0", "value": "T156146B2BB3C3ACDAC51023305C316362772FC7491958EEFBDA1B3794A6977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761652979, "uuid": "cda454de-24a4-49ee-ada5-50956b2914c1", "value": "6144:W5pOm5151z8qmG8xE5T28iJ4ntqt7IKTtA:2z8iZ5NKHt7Il", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761652979, "uuid": "4516c403-cccb-4ad4-9641-b137743f179d", "value": 197592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761652979, "uuid": "f6a7f127-2127-4e37-aca0-dff71164dbe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761652979, "uuid": "6a1fac52-17cb-4802-a501-5c13f7030991", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46de3d6-b459-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761695755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695755, "uuid": "cc8eb877-d877-4c47-bfb9-68f58cd48618", "comment": "Malware payload", "value": "3f5184fa3d6dce44626549db1d63c3f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695755, "uuid": "57baed45-195c-4841-a40f-2a9559110808", "comment": "Malware payload", "value": "5eff391e4cb52d4d3af437e34577454d6e99f0cafc4a24716c1989e3917d3816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695755, "uuid": "dab94e72-e054-4894-93b3-cc974a016600", "comment": "Malware payload", "value": "50277b87451496f4be7c1519363cf9b1585c9722", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695755, "uuid": "2e63f8e9-50f2-4703-9b84-ae42a4079475", "comment": "Malware payload", "value": "bd9afec75dac1917974ebcf8700f698b01db4dcadfa24a2884c546f08c35efd228b018a1602d48d2c7c6f991c76a7e53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695755, "uuid": "8aef5a52-739f-4ce9-8758-727b29fcc1aa", "value": "T17D433943771D0B43C06BAAF429F717F087A6BD601AA75284E11DFEC4A332BB46525F64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695755, "uuid": "9d558f2c-61d2-4d43-beb3-a6b968c60ce4", "value": "768:mFUvy4nO9oN9B5iPn0xTieCFGBt2wJpISGInSgUT:Gr44oLB5i/05iEBUgpVGISpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761695755, "uuid": "468264cc-34d7-4263-b7a9-8c51a60534f7", "value": 55218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761695755, "uuid": "df98a393-8673-491d-a443-0b3b5f14195e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695755, "uuid": "5355c04a-5ef0-40c3-ab78-e6a6f08d5563", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b24bf4d-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761634643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634643, "uuid": "2e5631fb-6243-4370-909d-89f789dd4a88", "comment": "Malware payload (SalatStealer)", "value": "173dee2c11bf84d575caf80cea5d1218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634643, "uuid": "a59b6f89-020f-488f-97b1-d590106b09cc", "comment": "Malware payload (SalatStealer)", "value": "5f06923df64f4469c0a048b8ad95584d2c5d79c3ad265a73b334eac3b61d5f95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634643, "uuid": "58b05d42-1f0a-4dfd-9447-ec48aca24c23", "comment": "Malware payload (SalatStealer)", "value": "3cf4da37ab6f1ae03846243fc36c307284ebfcdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634643, "uuid": "4a3495de-a361-4a2f-ad64-8725b8510f2a", "comment": "Malware payload (SalatStealer)", "value": "fb8339a173e8019eec5e0e690b7e74bdf4bacb282dffb78c80ca219057faf3527fcfe0ad1bea9ad631a1e4620c9bd25b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634643, "uuid": "f9043fbf-af0a-4906-8828-7679afe1c55d", "value": "T1313723C2D9C05BF4C3D3C70AD197138BD7D06596EBAF5A0939C4DC032A82DA71687E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634643, "uuid": "a485f075-8d53-415d-9082-4de74c50a38c", "value": "f776710de15d02f8fdd34319cacae5d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634643, "uuid": "f307e9b3-bf14-4557-812e-170653da3a12", "value": "393216:gr3+C/onUPn2NvrLBproHANc+0Rg0AS8U4Sifg+fUcQYt6w3ff4fe:gr3+miUP2NjtugNikbY+fUtw3ff4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634643, "uuid": "98ad771e-1765-4175-93f6-f2168870f670", "value": 22708224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634643, "uuid": "829eb847-aa84-4a42-b02a-ee2aeac09079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634643, "uuid": "0b26f1ee-3b5f-4cfe-800b-1ed23f6f7ae7", "value": "173dee2c11bf84d575caf80cea5d1218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0e53c7-b3c0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761629783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761629783, "uuid": "9273cff6-4f95-4c9c-9d0a-af53f77f756e", "comment": "Malware payload (Mirai)", "value": "3b7d5165ab817016cc26aa3f85f05709", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761629783, "uuid": "84da5bb9-175a-4f50-8064-ba60d5bdb468", "comment": "Malware payload (Mirai)", "value": "5f866712aaccd1c6dfeadb523835378463253b98a7918d346ac3f3c4701ec755", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761629783, "uuid": "27df2c77-5af5-4574-9d59-40cf81abcb85", "comment": "Malware payload (Mirai)", "value": "a25683a3b8e9ef68e3151e924ddf0be918ae3b8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761629783, "uuid": "a287b49b-a016-4d87-9ee5-6c0c0c13ffdb", "comment": "Malware payload (Mirai)", "value": "41f549b2d6e37a4f1699df362c276d79277991d4ed6cdc3029729495c187ff543c3e7cf7c408102db51d1446a312bc3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761629783, "uuid": "af562d72-104e-4ab4-9946-3cd88450c42a", "value": "T143D3C031F0056CA4EE1116B8387A457C1300EEF40AE95243EFBEE5AE28B7D5579EE760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761629783, "uuid": "903b785a-0b4a-4c71-9340-7423c0229b6a", "value": "3072:Oq2zlBxBAc3cplpBBJ1KPGJgnHh/5O9T5uz1XQZv:Oq28BNKuCHh/etuzRKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761629783, "uuid": "45a138fc-c2ee-4a77-9555-510b35e023e6", "value": 131796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761629783, "uuid": "e7b0324d-8956-4b7e-a774-dfef6ee69c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761629783, "uuid": "9235a530-d205-40e9-bd53-acb73e8f5523", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ea9593-b405-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1761659752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659752, "uuid": "5f5a138c-c9ac-469e-89ed-a15bbe4805a3", "comment": "Malware payload (VIPKeylogger)", "value": "e40e8e4e8ed6bb4247046b8d88d05b25", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tbz2", "colour": "#3C1596", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659752, "uuid": "7e88966d-3a01-4565-8575-935dc5f46a0e", "comment": "Malware payload (VIPKeylogger)", "value": "60518cadd4994db07c0cd9995083b7254ba4d8f7336be3602e2b34b09ce53a8a", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tbz2", "colour": "#3C1596", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659752, "uuid": "ff3383dc-a489-4a7b-ae52-edadc33a4c32", "comment": "Malware payload (VIPKeylogger)", "value": "a5a1528a2636ce01e221dd94119bc7dc7b9fbb39", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tbz2", "colour": "#3C1596", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659752, "uuid": "d6857f3d-7ed1-4db7-892b-dea56b64d3ad", "comment": "Malware payload (VIPKeylogger)", "value": "e709db27ed5efa882bbff9c6e11be6e147345943613d56cd2df4eb47f37c2183e2213ae727678a14170eb39dbd1ea7b4", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tbz2", "colour": "#3C1596", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659752, "uuid": "1311f162-19db-4a0a-a3ff-70ed43705ed0", "value": "T182742305728A092CF2029FB728293F1619F39D559E3C3289F8B957E484869DBEFF4417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659752, "uuid": "46fb3a47-3259-453c-956f-187ca0b19131", "value": "6144:yZwE9QHgoQ+2AZ9PgyyVZWR30oq67XtpwRRrXhwwpxCsv0wAWC44o/tYhQ:Jvb7pdyVFoTzMZXh1pcwAQ4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761659752, "uuid": "fdf748e1-06d5-4a7f-a312-2a9be736e5cf", "value": 361885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761659752, "uuid": "bfb247ea-6bd3-4a84-a536-d7c12ef6031a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659752, "uuid": "07a48974-84fb-4940-80db-cd825d18afe1", "value": "QUOTATION ORDER.PDF.tbz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b93150-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mydoom)", "timestamp": 1761646425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646425, "uuid": "ad26de90-80fc-4643-972f-57799717c4bf", "comment": "Malware payload (Mydoom)", "value": "57e82671637443d4979fd2c12d37debc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646425, "uuid": "e6145e4e-9220-456c-bd7b-983a003bdf55", "comment": "Malware payload (Mydoom)", "value": "60f5ba5f0f142a5637b5cbf31adaea1efdbfbe6648581bc513c9c8b308456160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646425, "uuid": "d082414e-ddab-47ca-a85b-7856d4f40339", "comment": "Malware payload (Mydoom)", "value": "52db501b6f330e4d7e27237427bb3789bda334ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646425, "uuid": "4ffbbac4-94d0-4da2-bdeb-b64ee4b176d3", "comment": "Malware payload (Mydoom)", "value": "93dbbee0479143ef3e7fea11b98f902260a893c88a1bb81e6b4d46cac8e9f0b945377846fe6a1b020d3ad5c09f4f70ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646425, "uuid": "e1a67e7c-b475-41ea-a701-d71c788edbcd", "value": "T1FF23E112F1C81A91CB2971B700825E2959707C3A78558B5F3B84BA776835F27CDEB62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646425, "uuid": "f5d17d76-f82f-4d99-9ad9-d7b79f6bc1dc", "value": "8e3b89212eb788b1b0c947bc3faeb0c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646425, "uuid": "94d715cb-0f52-4ab5-8480-7d50673cfc3d", "value": "768:tZ0wucsXq78yONDR/kAHXINX8JRbl3I2VG8FetUxc8UmVCNu4TxWXz77DLj:70wucsbb3YCRbWcFeKJUOpwxWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646425, "uuid": "1a879bae-3c64-4dea-b37a-b7945118bc7c", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646425, "uuid": "4e6e6321-d7f9-4b20-a9cb-f13eff070e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646425, "uuid": "5624b6b1-e14f-46cb-a945-3add55a05c57", "value": "Readme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3246bd8-b405-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1761659755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659755, "uuid": "a47667c4-b20a-485f-be66-de642d3fdfe6", "comment": "Malware payload (VIPKeylogger)", "value": "4b355109d84ac4828ae54066cf5ae2f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659755, "uuid": "8abeb611-64e6-4384-945a-99811f67b88e", "comment": "Malware payload (VIPKeylogger)", "value": "6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659755, "uuid": "0ba615ba-404d-4bfd-a2e0-4aeb981a8ca7", "comment": "Malware payload (VIPKeylogger)", "value": "073deb1f85186bfebd10f0ceb45bb1157df7caf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659755, "uuid": "d95b501a-5fc4-4242-bb76-490c00c1194a", "comment": "Malware payload (VIPKeylogger)", "value": "9ce8b97e7bbe99aa4ebc37caa06fa14c7201e7c87cc3fc68590edb976352e765dbdcd8f5ac18dc17bbc86276c2f3cf54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659755, "uuid": "9e97b51f-9a4b-49b9-9744-fac8b894f28d", "value": "T1498412463AE0C567DAC846B19F7694FAEBBBCE150804430B2B547F477C366B2690B363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659755, "uuid": "f11804e2-1382-4ce4-91b4-89d33f986318", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659755, "uuid": "00ce2641-6132-40d1-a8ed-46983aca060d", "value": "12288:59USOe0uGsTxb2VJedjrrnUd5scy59v9Nv:59Ukjxb2VQdjrrCL49vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761659755, "uuid": "aff08bc4-f59e-4c8e-ad84-9acd7db0d594", "value": 394832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761659755, "uuid": "215b5cde-f878-4391-bdae-0dc5ac4ed4e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659755, "uuid": "f4da2fc8-383c-49cc-acc2-99f23783c56d", "value": "QUOTATION ORDER.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dec9e4c-b3d4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761638433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638433, "uuid": "b8bd7b06-53ed-44ca-9c03-9e98214328ef", "comment": "Malware payload (Mirai)", "value": "1ebc83062403bcff590c6d38a9c4e346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638433, "uuid": "2bd86a32-1745-4467-8376-447472aca690", "comment": "Malware payload (Mirai)", "value": "6275e1fda2c0260a5512220158bbed77034d00cc73792c0b315b3083d6a7e343", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638433, "uuid": "03f13e7f-2670-4173-8511-2335a2645292", "comment": "Malware payload (Mirai)", "value": "1518a36deddd0e24b063fca9d491e7b050bd38e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638433, "uuid": "f86d0581-3313-4949-a394-4e639a097d10", "comment": "Malware payload (Mirai)", "value": "6462e69265c6f1dd1a6f381bb37f35f8b562cefd4ac8e8e1d21ba5027b25e8b7e4978eeea1e085fb848cec9fbefd9c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638433, "uuid": "dbf85379-56bd-4bdb-9397-11a04dfa46ef", "value": "T19DC3185AFC819B06D5D526BAFE1E118D33136BBCE3EE7112DD245F2127CA90B0E7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638433, "uuid": "bcf45ade-628a-4c9a-86e0-c7f48151d613", "value": "3072:w5HETe6aXftpgX2gVBJZfSwbuULzaAArwDyFKwRgKJ6lDA:w5Hd6aXftpgGgVBHfSmuIzaAArwDyteS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761638433, "uuid": "a481c392-63a7-4333-9ad6-798c7457e3cf", "value": 121324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761638433, "uuid": "aeb168e9-da68-4cab-979a-b5230477cdaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638433, "uuid": "2d44be69-581b-4c4a-a412-86f771bd07fa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03412cb0-b3d5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761638791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638791, "uuid": "5479c4f5-b3af-4c4b-8234-a433556b8255", "comment": "Malware payload", "value": "693d25a7e422f83f1daf8d5b4dbf3ac7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638791, "uuid": "bb660386-dddb-4bff-bd7c-b8c6dd1bed1c", "comment": "Malware payload", "value": "6370d7905a4128b8353f5cf24c895489be32fe53f5bac553364568abe07c31f4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638791, "uuid": "1cafaf5f-80d7-4821-8d85-3bfdc7eb57cb", "comment": "Malware payload", "value": "9682f301eab91d605abd9dc17fe6d74852d66cdf", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638791, "uuid": "2a244864-d337-492f-a4b3-02ad220a4592", "comment": "Malware payload", "value": "9491702233b1e5aec9ef3e7e74a080726bc1178dc8a1cf81b0c5673570661351ef5fed99c2463c5c03ac02cb517ddb8c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638791, "uuid": "1bf6736f-dd1d-4761-93d8-37a1d49bdd51", "value": "T111321A1AD281DDD376A511FC8850F09C7284F9AE7332C8B91B899EAC04E5F1E806F8D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638791, "uuid": "876adcff-9314-4b34-8de6-6709a67656a5", "value": "48:BsMiPvhMTTljshBt27Bt9eeBtdPZlYx3333333333333333333333MQ37F33333i:BHQa9XlTeon4JZZLcgfZOsfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761638791, "uuid": "7ee33bb5-d64d-42c9-9665-d6c9b86eb288", "value": 11048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761638791, "uuid": "f69012c9-4750-4cf2-b459-b547cd2398b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638791, "uuid": "504c9413-75a6-470b-99f8-dcfc88c507b4", "value": "Zapytanie_ofertowe_217300005219012081_ Tersteel.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e8407f-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761646417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646417, "uuid": "e823a9ce-b6af-4019-8562-8e22c19e2e13", "comment": "Malware payload (a310Logger)", "value": "533bb55e15c23caa2ec33d7013939692", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646417, "uuid": "d6b05693-b23a-484d-b162-bc5148bdb0b0", "comment": "Malware payload (a310Logger)", "value": "63bc6bbe579658a23b846e56ceefb90df81cfeef68e5ba672e53aababc57a0a8", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646417, "uuid": "139ad1b3-0c3c-4476-8dcf-9996eb6413b9", "comment": "Malware payload (a310Logger)", "value": "0039d70c764184a15951a636347541399b1f9062", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646417, "uuid": "85a87489-7de5-400a-9109-dcbb0afc32bf", "comment": "Malware payload (a310Logger)", "value": "6c1b48b1272adc7ec1b44c83611a8028417c9fcb782dd8f9a65af2b8b9c5f2d8eda74794ed34934fe9049475061af811", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646417, "uuid": "4d363ccd-8238-486f-be71-9de6162ffbe1", "value": "T10675CF11FE528D3AF01E3539D82BDAC6541DBEF12A24781E7AFD3A487F396C32416186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646417, "uuid": "287be532-6e64-4777-9442-651ed9026684", "value": "1c46483cb5cc22b9cc47e186fc5136c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646417, "uuid": "2e520833-ccda-470e-9f4d-6519dea9c0d1", "value": "24576:a1x9k6hSHdKu0IDGgCQMaOSHKLodvVONGDjXWEUfgHFMp73Ohd0TKQR2p:aZEZdKLq4Gvm7fgHFkbkd09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646417, "uuid": "eb99da00-1c35-4526-8740-73a798225585", "value": 1641472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646417, "uuid": "b1a3eae9-c209-414a-be45-1da1dbfefa18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646417, "uuid": "a2c4776d-3278-4593-86c6-603da8fceb77", "value": "PAYMENT_COPY.pdf (~51 KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52487d97-b3ea-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761647943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647943, "uuid": "8e96b01d-ea4f-4c90-8f68-e6f4c72e5b21", "comment": "Malware payload", "value": "8763f6b939a7d1b5fd572369e5a9d19f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647943, "uuid": "559c01c8-1dee-4ba9-af39-5f3f937af312", "comment": "Malware payload", "value": "66eb974624e84ad29b1dd020f054025caf420a950a93ffb805422a46d9dce6c3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647943, "uuid": "dcd432aa-5a21-4849-8fce-44c2fce09177", "comment": "Malware payload", "value": "03d12ca400d5f8fb9026b901076dc82d109990c9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647943, "uuid": "ee9f3440-3a6e-4fd5-8de9-93792f04ca61", "comment": "Malware payload", "value": "925ed269252056db2881679400d7518071063dcff91493e563630abc012cd059f65f8a22819b84576c6cc3040029914a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647943, "uuid": "1b6e31c9-2af5-48b2-9183-858b0adf1f2c", "value": "T1D3F62285F718E92FC477A03205AA2272554B4D128E83DB4778887E4C68F7AE50F4BBDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647943, "uuid": "a7247f11-a574-4ce9-a7ba-285681cf0880", "value": "393216:xcQiLhAQPBViiTEwwh9U8nvwwF9Qgf6UECnh12Pz5Q:xcQwGQZViig97EYqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647943, "uuid": "cd2cb964-bf22-4402-8b21-99711cff192f", "value": 16197484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647943, "uuid": "7c44b93a-d146-4424-a961-60ba5dd77a38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647943, "uuid": "c0123c69-1191-4e44-9e80-df538a6eee5d", "value": "9movie.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bfa337-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761646419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646419, "uuid": "192dd224-7563-4c9b-bfc1-bd589bd64f62", "comment": "Malware payload (AgentTesla)", "value": "9b467f497339cd907978ecba94c46db6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646419, "uuid": "d3d184b5-002e-413a-940e-bdd969121d22", "comment": "Malware payload (AgentTesla)", "value": "673376b87ccff2a09ea2a4afc9451cb01744857ca06c0d2e214b968701a85a3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646419, "uuid": "035e48e7-0184-425e-bfbf-d4fe851b6944", "comment": "Malware payload (AgentTesla)", "value": "3e56f36e75d2ac612a1673b08788d83896c2f819", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646419, "uuid": "822dcb05-e80c-4292-9e7a-9cf080789b11", "comment": "Malware payload (AgentTesla)", "value": "383c7cae02bd0fbac4a3d9543359ced42099c4afa5d5e193e851fa752bbb75de321ff468b4b507f4d37aa4d91e23a1ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646419, "uuid": "d89a296f-2c91-462e-84e1-d8b9403831f7", "value": "T12CA5D7E490FB8092F5478D8069ACF9E105B271A3BDDA0939131EBA05CFBFD543A44B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646419, "uuid": "2865a2a2-e41b-4fa9-9518-82a974a17652", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646419, "uuid": "a69a4a9c-2a20-4e54-a7a7-a7c8b9017860", "value": "12288:sUUryk6RBKYb1kq+oMsLeoEMMV18e2GYuV3plXeshEYV5fMyPQBtAqXm9dAy7WJJ:bRClYuJplv+iBMRMdwOU9n6ZEgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646419, "uuid": "f09b8490-0fd8-410d-994e-1c60f170bd6f", "value": 2238976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646419, "uuid": "2d504322-28f0-46ed-b28e-b587a4e3424b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646419, "uuid": "034075d7-8eb3-49e3-8798-a5c4ffe13775", "value": "PO24S1458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c08d071-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620955, "uuid": "54924688-27d0-4c4c-9dd1-3272a8b5842d", "comment": "Malware payload (Mirai)", "value": "55e4c3a08770e39d836138b198114b08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620955, "uuid": "b71e6922-9a10-4d77-8e9e-f9a73cd8e524", "comment": "Malware payload (Mirai)", "value": "674637ec78a45cf6a6a0423a14ae811677d44d4ec456bf1f88c5cb098630629d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620955, "uuid": "d036f4fc-d38b-4dff-98df-ad8b3d8ed0df", "comment": "Malware payload (Mirai)", "value": "b3e38675cd118d1588aff7c9a57d1a2abb55ea97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620955, "uuid": "097d671a-2990-4ee3-8a3f-75deb930b148", "comment": "Malware payload (Mirai)", "value": "140e20a5937e739e72c741cdd28f0f58ce647f421a929205fc99c00e4ca22cda8a6cd547c4fed7a8a89a4b5b34d9a8f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620955, "uuid": "e52ed1c2-168f-40a8-89b7-71c50b30c3e7", "value": "T1C3935C13B9C480FCC849C13087AFB536D963F17E1279B29B73D4EA127E9DE511E6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620955, "uuid": "5dca5f0d-687d-4c3b-a90e-a40f39288379", "value": "1536:yc50J45j1WS60TzxMJQ18TidyRgQQ1h1Ms6fuftHHZlmpnahs:vf5j1W0TzxP8SyR+1h1Ms6feHHXmQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620955, "uuid": "28a347be-ccf8-44af-8c9f-b2b1a388ab36", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620955, "uuid": "4e2a8ee2-7a1f-413e-9825-82ec83e568a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620955, "uuid": "535eb45d-0d56-4685-9e53-3cf0b30eae0d", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ccdb68-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1761635822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635822, "uuid": "0d2cef4f-cf3b-4008-905d-fb569a9057ad", "comment": "Malware payload (RedLineStealer)", "value": "2bd630643dbb44f48bdc78f76f390c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635822, "uuid": "47e7826f-bc2a-4e54-a59f-1898524ef03d", "comment": "Malware payload (RedLineStealer)", "value": "68032433fbb6ec62b304d20ccfe8b68d01c095d55e8297c62d0f655b94559b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635822, "uuid": "80f2c3ec-17c8-47a2-99b5-f49b58b9a3ff", "comment": "Malware payload (RedLineStealer)", "value": "60b01c0e0021b0a17c4907ae9db9032784ffd657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635822, "uuid": "fb36c536-1e20-4f46-9c6a-2cb8f150fd8f", "comment": "Malware payload (RedLineStealer)", "value": "0a021b048e08fbd54d4c6294539633cfc5c0fb53484e084a3a0bf7592c54ee94de06b07f64eef60d496b6810b176bcd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635822, "uuid": "fc7c4da7-91f2-4466-8b3a-7686c6105d34", "value": "T1EF75BF10E2D2853BD312197ACD2BEAD6181D7B212B15BB1E36DDDB487FFD2C26C1A052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635822, "uuid": "ea1febbd-3b86-47f4-8966-53dec1f12a4b", "value": "244cd202f1481167ccc52eef781272b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635822, "uuid": "3791ae39-9777-4e36-859c-118a57648a0d", "value": "24576:310SW1xUYkCpXLfsc6xQ/JnmkEXpb1440hboFn:31xI2I66/c1hFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635822, "uuid": "5ba086f6-ceaa-4e70-ad21-7b34192e1108", "value": 1603072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635822, "uuid": "52fd4965-dd36-4282-84cd-309384ec6854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635822, "uuid": "96337f65-f924-4d99-90e7-6f1ae68c7a4a", "value": "SecuriteInfo.com.Trojan.Siggen32.690.25272.23025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55875a5f-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656538, "uuid": "65c7a803-0178-4bcc-9673-a786223f9770", "comment": "Malware payload (Rhadamanthys)", "value": "1caa71d24671f5fd4bdeecc2765e076c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656538, "uuid": "e7d68cfa-3cb5-4544-97f1-e75eb7c6b3f7", "comment": "Malware payload (Rhadamanthys)", "value": "680b00aff89205130f0d3f5caba8aea198416a49a7c1066fe51a1cd6629e0795", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656538, "uuid": "70f7958c-f004-4463-8379-713171d442a5", "comment": "Malware payload (Rhadamanthys)", "value": "4ebf2f3d040fbd942723d945ff6c3bfed2de0183", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656538, "uuid": "98c78b95-bb1a-4640-85ff-050d72f58bce", "comment": "Malware payload (Rhadamanthys)", "value": "46145c19132775972b2d3fd4fb4149cd47158ba39f6e830899fe86ed5b61463979c75339dfb4511d55a90d220b3b4ebe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656538, "uuid": "ceecd9bd-158e-4cfd-a767-fff2c3808ea3", "value": "T17AA309523DBF1E6422F131A52DD59DF5CB392F0829494059632EF2B206A5F27EB134CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656538, "uuid": "5bb04ec7-2607-497d-a201-2e86443d79e3", "value": "768:GDhd0i7J4sYKgY/CMNfWdBTQ6YsrXmjruJsIlCHDp+1OZiAUulacL+SLAuAAroQD:GDB7eKg20prOruJR+UAsk+6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656538, "uuid": "da78f967-2adf-4009-ab19-3f576122682a", "value": 104050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656538, "uuid": "3c921414-b91f-476e-bfed-4e99ed52706c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656538, "uuid": "7d58e44d-f27e-4db0-9462-98c6ea6ae5e1", "value": "invoice-1637482117.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d2fce4-b3b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625341, "uuid": "d00697c8-6d99-48b4-9eda-74435b7784c7", "comment": "Malware payload (Mirai)", "value": "2f24a48d79765a25d412612e5a5ad2b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625341, "uuid": "ba4150d7-4a04-4ea6-9b22-db74768b1759", "comment": "Malware payload (Mirai)", "value": "68aa9d2e946a9cd7b886e7b1e3c0e30e3599260a76f8ccd45883748bdd4d43e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625341, "uuid": "921a2a74-463e-4d3f-ae89-4df1e8d86f9a", "comment": "Malware payload (Mirai)", "value": "f12c08f361336bf265e3adbcb4a1070efa702457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625341, "uuid": "ad934f25-6645-404a-a548-acd9b474aa2a", "comment": "Malware payload (Mirai)", "value": "6ea464ce79748eb23fbda8aa425fc12db845ae1b42fe86cf66e081b0df62b9da3a70fa54977e0d81edaaf507975e8256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625341, "uuid": "139f57ed-e316-4d20-8cb8-c43439847d3f", "value": "T12653F1BB4A7CE36CF51A8BB69E4705D598D12F836C062744466F13BE8CF3A309914DA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625341, "uuid": "8a2fa8de-7351-486b-8c43-e79c935accd2", "value": "1536:Dfrzr1ntzD/frrWg//6TTUW1B0O7KJsVMfHnQyhGbcjAB5DSp:DfrVtzD/fT/KUWfcRfHQyh+cXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625341, "uuid": "6e9c5c62-b315-46d4-ac0b-e55ebfc17fce", "value": 66288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625341, "uuid": "cda68083-683c-4dd5-8208-1e159b48464d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625341, "uuid": "74f76e0b-dc41-4107-b03b-f58697bb80e1", "value": "Orbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c08787-b3b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625219, "uuid": "6c04f0d6-4f9b-48f7-bbee-da26de163b24", "comment": "Malware payload (Mirai)", "value": "f2213f9f8b7a2a34dd4803a2ccb96c88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625219, "uuid": "f7698a2a-5615-4f4c-b073-d5ab8186ebb2", "comment": "Malware payload (Mirai)", "value": "68c85af1a2a9ef2f74cd53ed39cc9e00333b961e9f51b9c55ff679c0197a2ae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625219, "uuid": "4e50a576-6b4b-4ea2-bd91-915e5e33b9da", "comment": "Malware payload (Mirai)", "value": "47893ed348b038b7dcd625b2696c21a014dad38e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625219, "uuid": "a055a5b7-a74b-4546-979a-374049430515", "comment": "Malware payload (Mirai)", "value": "d1a02e278f3853a1de85fc8d87fbf16e3da5158803fe1db545b9afa8fcf221118627c727ef4269f05ebd9303ad8e418f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625219, "uuid": "0000cfb2-ec11-4238-a786-9399a212eef1", "value": "T11233023BCFEC0794CA8D2075441A7578AC6CE81155AEFE58DDD5E0632F693682036ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625219, "uuid": "31534795-eda0-4fc2-8e00-3a278430f6bf", "value": "1536:sZntPjBWdUhKWBhg6/72InN8kgnouy8tyI:sZn5BWdzWBh3/KInlIoutR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625219, "uuid": "923b4307-4a96-49a4-a0a6-1ebd0e39d4bb", "value": 54756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625219, "uuid": "ed887d27-8f3e-4d70-8125-bbf149e495c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625219, "uuid": "c6384cde-1bde-4c00-80b0-810d3a304461", "value": "Orbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905e394d-b44c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761690138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690138, "uuid": "4f7d10ea-a53b-49bf-8fb8-a04472551428", "comment": "Malware payload (Mirai)", "value": "254efa7eae2b9d4b584e29539f957094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690138, "uuid": "73b2f9ef-7703-4aec-ad27-6f8e49eb3991", "comment": "Malware payload (Mirai)", "value": "690d7a98b6648b618a1ec2009db5b7bd13ecd4676b04085d4f733ae6b8a5764b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690138, "uuid": "e924d496-009c-4b1d-93c0-35be473adb72", "comment": "Malware payload (Mirai)", "value": "b9bbfcc494172fbc277f25dbe112328f0063b2c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690138, "uuid": "ad444e4f-4c8b-4dcc-b0ff-4e49fd5d9d96", "comment": "Malware payload (Mirai)", "value": "d7777d18de9bb3e630d909fd79f893355a3d0e6c3559dc2876e4e8ec1ac11a3629aa2e0ef261263f23b025792b64a965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690138, "uuid": "b5cf0d44-d4da-4320-8899-73b5639b74ba", "value": "T115532842B69180BEC18AC6B847AF8537F931BC591214693E7784FB752E36E312B0D662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690138, "uuid": "8873ca67-2d9e-4ce9-8def-2fd71a683468", "value": "768:9L8++gFjBC6jpnnfdgZHBuF29nJGqT6BqQXcN8hcxWQ2Q3rNVZZ58lcIUdzErRC:x11fdSjI1BqQXfOxWQ2QpZi3CorRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761690138, "uuid": "5cebbd53-2304-4733-894b-957bc31be056", "value": 63336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761690138, "uuid": "f9fdbfac-27a7-431d-afe5-ae6bee3da536", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690138, "uuid": "98a60777-ce94-4bed-a543-169bfc773d7a", "value": "SecuriteInfo.com.ELF.Mirai-DBD.33416353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffac1d0-b443-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761686191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761686191, "uuid": "0bcf4234-284d-4d62-9c0e-a43942769b1d", "comment": "Malware payload (Mirai)", "value": "c4ceb8b8617556f1b38800eeaf5e39da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761686191, "uuid": "18d02016-20fe-4b06-a395-a13521aff853", "comment": "Malware payload (Mirai)", "value": "6989188b3846b5e5cadae585e17bf98bf234a8ade6a0ee7326f2a77c4069c1aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761686191, "uuid": "22cdfad1-f811-41f5-b98c-7370d7e8f123", "comment": "Malware payload (Mirai)", "value": "2ab5c0ed62330fddbeb9ba1aff71b3cc4b201e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761686191, "uuid": "487e91e8-18a4-4961-aca3-b888086a345f", "comment": "Malware payload (Mirai)", "value": "8f61c10ae584f6a6088df79e1ee65e80f339dc42a119d2e4eecdeff1a25f7f45ee5abfc1c063a49d5ef7d940938fb636", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761686191, "uuid": "01a7c82e-c56c-4296-8747-b358640e7952", "value": "T145E38C22D964AE98C265C570F025EF795B53AEA245870FBA1EA7CB714003DCDFE053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761686191, "uuid": "e292cb85-f407-4c99-ac6c-9c68c3a2a83e", "value": "3072:KMeCWJnee0PIeqq1HNyEl8HeVJJQc5yqO2WzWYq56cP:KMj1YqaEl8+uxtjzA56cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761686191, "uuid": "bd1484f2-5339-48a4-8251-444ceb9421b3", "value": 156292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761686191, "uuid": "4bffdc79-a1d3-4c18-ae7c-2d127291c292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761686191, "uuid": "1ac70bbe-ac38-494c-a205-d039988528a5", "value": "Orbt.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9584f05b-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761640325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640325, "uuid": "73ef6fbc-f424-44b7-a542-48fe692fdbca", "comment": "Malware payload (RemcosRAT)", "value": "9e51cc93a18c7037ecd114d29fd388a7", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640325, "uuid": "d3f39792-9ccf-4f90-a3d6-d0e20ced0f70", "comment": "Malware payload (RemcosRAT)", "value": "6a6ef4d37338f5cca606bbce178b801d3c8b840209bb1d653fedeb5989088c44", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640325, "uuid": "f3fa3cc4-662a-4d4e-a970-a5ec7687a48a", "comment": "Malware payload (RemcosRAT)", "value": "3f7e6ad660774e5b4ec08039403ba8323de93e44", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640325, "uuid": "e3663b22-922f-4ae2-a934-25a718abc672", "comment": "Malware payload (RemcosRAT)", "value": "011d3fda4e59239066ebb2a0026eff041b0b941f2ed5d935c081e8943f460ce9d285ca6e92bf02cf8d6c9439a7151168", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640325, "uuid": "ff18bcd2-2251-4f7c-85ed-fa2ccc1313a9", "value": "T191C5C25D94B05C926024FE74A6C5F7938CEA17851A174B920FE5E2A63205C43FFBB3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640325, "uuid": "ce86bd30-66ed-46a2-af9f-7ae172d301d5", "value": "24576:U0s4QvtDbOdHr8orbVjYzhTOBewqDDlGeBP4QrCqSU31thJ:20o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640325, "uuid": "708f964e-362a-43e4-86ad-3d0c93f0ab0f", "value": 2681070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640325, "uuid": "7dac1cbc-0a08-4886-bd12-4ce6280481aa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640325, "uuid": "8e2350ec-90a0-45cd-92fe-a434e5926be9", "value": "RFQ_LGXTH_732_20251175006053.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9bdbeb-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761635825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635825, "uuid": "de8624b4-5408-4476-ac3a-8a81843b095b", "comment": "Malware payload (XWorm)", "value": "146c3b008e3ef236156f0dcde0ef2379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635825, "uuid": "ddac4026-fb6b-4bca-a274-344258b35eee", "comment": "Malware payload (XWorm)", "value": "6aa1e67c18d480459642d3fb964a3ac849adeed2792744a816ad0e441fc5a341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635825, "uuid": "755c4438-7895-49bc-a13c-8b77c604c325", "comment": "Malware payload (XWorm)", "value": "76212fadd969d26961f8df2616c7cbee8ef3d51d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635825, "uuid": "b87273aa-0c2d-4d94-86ff-bd911c483eb4", "comment": "Malware payload (XWorm)", "value": "a9d15caa91894fdfb1a2aaa7f711b952556d99580c4b6002e396168c8fdd247604694972c133e1030e57be16305ee509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635825, "uuid": "02d3a99d-989b-4b06-a53b-7f26f0d69c82", "value": "T18B35FA2FA6742027F09BC2745AD8696BA8155D373401BC1AFBC25F9A23756C3B4E132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635825, "uuid": "b25e7c54-61c4-4169-bc5e-85097cc21228", "value": "becf457cc1360fd759e8da9768a6612f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635825, "uuid": "137a5b05-71ba-4460-8776-d4237170e7ef", "value": "24576:wBrjhAkGMK5UBDMqp1yWsprCZblX9qowFgwCghpWJy:wBr6kGMK5UBDMqpoWsprCZblX9qoIgwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635825, "uuid": "ccca4924-e231-490c-94fd-ae5f3cdf238c", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635825, "uuid": "e13283d4-a056-4989-b6af-2695de6569a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635825, "uuid": "6fd0f621-353a-4b3a-8b84-7a487ab4a2c6", "value": "SecuriteInfo.com.Win32.MalwareX-gen.28966914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba426910-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761646399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646399, "uuid": "70600233-4f1d-4151-8b11-55537426597d", "comment": "Malware payload (Formbook)", "value": "b7afc935c7b01a793557e8982ae94ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646399, "uuid": "8c332f4d-419c-47f7-a65d-1f40cd2340e1", "comment": "Malware payload (Formbook)", "value": "6b50971b8aa1e2aa213d35f71ad5e21380edb08a6a5fb770228de55f2663ea33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646399, "uuid": "2aed8965-0a85-490a-976b-be049808bda5", "comment": "Malware payload (Formbook)", "value": "b2196f6ada72fd5d944b947ca21d28af237ccf9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646399, "uuid": "0cad8c19-89bc-4e79-ad54-19b173890e6c", "comment": "Malware payload (Formbook)", "value": "c6cbf1aad85650ca658ad5301060e22d035115df644e056e1bf216f0b0b9a61c05339a12e0e437ab8727d72b26068d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646399, "uuid": "045291c1-d0e1-4c7d-838d-9fcae9146a30", "value": "T10545BF027381D062FFAB92734F5AF61157BC79260123E62F13981DBAB9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646399, "uuid": "8975ec05-8155-46c4-b86b-32022f0d03ff", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646399, "uuid": "01952c42-7dc6-4c13-97ad-a7b93b1b8319", "value": "24576:f5EmXFtKaL4/oFe5T9yyXYfP1ijXdacKq6+MbdpNRfEV:fPVt/LZeJbInQRacO+Mpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646399, "uuid": "1e5fc9d9-672d-47bc-8ec0-4671ba0c8e55", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646399, "uuid": "7ce0a3c5-b1b1-415e-8582-586a65f4b2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646399, "uuid": "d38a1670-3a7e-44d4-8946-69602ec8ce18", "value": "AWB_NO_907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8013e71-b3ed-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761649509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649509, "uuid": "84e82b42-cebb-46d0-ac09-a9a309307d7f", "comment": "Malware payload (RemcosRAT)", "value": "996fc8647b18132647702140e98be59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649509, "uuid": "765fec6b-f415-47fe-aadd-a18044911c52", "comment": "Malware payload (RemcosRAT)", "value": "6c7efc73d8a9e1280727ac591c3bc8d3f2ec93fb00623a6ce7053c93f9cc4703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649509, "uuid": "66ea53d1-2c9e-4481-8967-247e2cff29bf", "comment": "Malware payload (RemcosRAT)", "value": "e523e411de366206e1627097fd7fc3c56326515f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649509, "uuid": "2a9c35fe-78c0-42b6-a688-676868959ed7", "comment": "Malware payload (RemcosRAT)", "value": "5f6614744288679026a46d86891c95fdc7c5574233fb919db772afc423b43e30efef488f6cf65dca66e5058c8402b9fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649509, "uuid": "abfe8687-7fed-4891-b261-f03194e64ca8", "value": "T1B975D012AE918C7AF02E3539D81ADAD2196DBEE01F14B54E7AFD3E4C7F391932512063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649509, "uuid": "6ce1c061-4393-4282-993c-6c67bfd33fd6", "value": "9fc2efbdca0d706fe277feda4bc3a110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649509, "uuid": "05db3f80-2234-4dc8-94da-d20ac0136869", "value": "24576:NhJCeyQ32JBMlb15iU2mT5QXUJ1/RLc/5xg+NrwIbbmLw9NFBKtrF5orQ6Np:Nly/GPuXUJ1/i5x9Pbbmc9N7KtrF5oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761649509, "uuid": "67595301-bb30-4ced-b1b1-e700a9dcb8f7", "value": 1684480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761649509, "uuid": "1315edf7-f612-472b-b903-86870a0aaa29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649509, "uuid": "165212db-c5d3-43ec-a066-d1467e72c15b", "value": "DHL Waybill NO- BG468545215485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c278b8-b3af-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761622529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761622529, "uuid": "6834b397-d3fa-429a-b5a1-b2df704d8309", "comment": "Malware payload (RemcosRAT)", "value": "ed1c9009eb571f93c4d681e0d2e990af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761622529, "uuid": "ea678ec0-4391-46b3-8da5-8d7a42d6434e", "comment": "Malware payload (RemcosRAT)", "value": "6cc7bffeea67e08d4e10ec4d62e5d9cfeca4a3fe72beebfa9d17f2db8d033ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761622529, "uuid": "a896c346-4773-4bcd-8596-5eaf13f5f931", "comment": "Malware payload (RemcosRAT)", "value": "59f38766a4dbfd9f80880e86a005dc022c6dc76c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761622529, "uuid": "2ee20cda-0a16-43fa-b28a-6105ddc2f4ef", "comment": "Malware payload (RemcosRAT)", "value": "ac660bba5bdbe77a7f5b61e58022cd4a7206ccb8556bfea1340cd2b5a57d7eae2ab7bd459ce5f44ce4f3ea94b5cc8844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761622529, "uuid": "e37ea343-8479-4deb-8faa-42a4f3d0b047", "value": "T1F705331626A2C1A1E2B758783D2711BEC91CA9560EDC660F0791EA1FFC3D8D4DF09786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761622529, "uuid": "8d682be6-b57c-4c0b-8700-5d90a57d2034", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761622529, "uuid": "6a8cd7b5-3533-450c-ad74-79cb2c3118fd", "value": "24576:BMwWY2BGE86jGAFPnAvc7qWe3ESBobebbr+gL:BMwf2BjFjnFPnMc7q70zbMbr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761622529, "uuid": "351f2af2-98fc-414a-85d5-04f66c1dd208", "value": 862864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761622529, "uuid": "01521a30-df7e-4023-b5b8-e7373663057d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761622529, "uuid": "62548894-e1ab-45f8-9aa0-f7c5e11d8315", "value": "SHIPMENT-CMA000322-00093930-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ded51a-b392-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761610371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610371, "uuid": "61c207e7-6172-47fe-a2f7-2653e9732786", "comment": "Malware payload (Mirai)", "value": "272ac938113b96695a59b477fc291b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610371, "uuid": "7a6514c6-0ed8-4de9-9861-2e08ae9d87ce", "comment": "Malware payload (Mirai)", "value": "6dc5161cbd963fd9ff0fbb5c1edaa0d4c15087c9ed8b3d90a9c75eb42915e615", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610371, "uuid": "d538bf7a-a1e2-4fa9-97cd-34ef72fe6d73", "comment": "Malware payload (Mirai)", "value": "dac38441cb348bed93bf54d181c5b9a1b838e3e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610371, "uuid": "e9477aed-88b6-4513-a79b-ef7b914c22ec", "comment": "Malware payload (Mirai)", "value": "a896f40e1ba94ca9267aa4f8b19eee8e4bfa6ae28d4b244d4a6165108e3f184e6a597363829b052a1a71a921fd17a1db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610371, "uuid": "f7bced2d-bde6-49a6-9b28-c38d0cb1ccdc", "value": "T14CD3C021E004AD91EC1119B534B98ABC0314DE7417DAA282FFFDF99FA477D8439AE670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610371, "uuid": "ba8e3214-51e5-4545-a0c6-18dcbeb3de9d", "value": "3072:PLiQIasAgdWQmEf1bVyqplDcj5gEAp0oiWfN4:P2FCQmEfNhlDWPAp0Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761610371, "uuid": "c7fbb599-15ab-4a3c-b638-5339d0011cdb", "value": 131804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761610371, "uuid": "a4174398-61ef-4c2c-ae4c-a48540989ccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610371, "uuid": "fc91046a-0782-4194-b0ac-54d423a2de38", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d01d3b-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656638, "uuid": "4dcda83b-ad65-4d7a-81f8-adc4f10467e7", "comment": "Malware payload (Rhadamanthys)", "value": "1a549710378cc510b92c411e490f86c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656638, "uuid": "fb9b4283-08fa-4b35-969f-9747ac206ace", "comment": "Malware payload (Rhadamanthys)", "value": "6e260514e704801e95c92e8d7b19c585405a9bc33d3955f30d4714ead5e5b39c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656638, "uuid": "eb697080-45af-4acd-96ca-3272bb7a04f6", "comment": "Malware payload (Rhadamanthys)", "value": "19bfdcd32cf453baca4272bfc13bbabf2de7975b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656638, "uuid": "442aa453-826f-428f-8198-c4873768e1e9", "comment": "Malware payload (Rhadamanthys)", "value": "3fd7a360133553bca47fb24c4ba410ecfad4ac89e7abc579836e7b0049b1150ff0986dc80daadb80f593f03aba152fca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656638, "uuid": "f7017dc2-967b-4034-a347-fd9e12b62675", "value": "T1B0A308423EC62DE138C0F6C43FEBB4F48046B1325A4F5AF8B51526670B67A6629F41F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656638, "uuid": "18459564-f58f-4953-8f71-cf547ca18c24", "value": "3072:GDB7b0PWWYVj/pXifckD/iH5qMQBoxeP5zV0r3VxTG+fflsmtoyPV3Vv2/8zYQzg:0KApHLjSWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656638, "uuid": "cb1b18d1-6a6c-4682-add8-bd65b25e122f", "value": 106018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656638, "uuid": "007db892-ea56-48ba-9e2c-a52056316d25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656638, "uuid": "6f5d1699-12f7-4ee1-b48b-10cb11ebd3a4", "value": "invoice-1637482117.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ba0e54-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656701, "uuid": "26e226c3-30a8-4c12-a23f-ef97e8edef7a", "comment": "Malware payload (Rhadamanthys)", "value": "d147e2d54b3306b6538da92b9948acad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656701, "uuid": "407f036d-e5fa-4f88-97c6-76d78b884770", "comment": "Malware payload (Rhadamanthys)", "value": "6e630f261a911fad4847fab95ed4d0928d480b9ee92ee2e85c1f80c6445b25de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656701, "uuid": "b564cb0d-4ceb-4602-8d6c-03583b5160e3", "comment": "Malware payload (Rhadamanthys)", "value": "a34e2be57aa2eab221e0c380f668eaba892ca819", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656701, "uuid": "de7b29e3-3f80-4c9b-b339-5ab4867eaf1f", "comment": "Malware payload (Rhadamanthys)", "value": "a41bb1a899a45f280d75cdcc04e16b9618526aadecdcb0849e86c07e4300930e6a3a05cb04faf4b29a8f12ac73da6841", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656701, "uuid": "e9f14ad6-1c36-48bc-8d34-cb999493683e", "value": "T105932BF80B65ECF8740AAB882DB0DC9C62547055F61B8EF9311BF662414A763EC936C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656701, "uuid": "03042335-f779-47b1-a8f3-220f8d5f9567", "value": "1536:GDB7eKg20Br9Q+1lnvQQLV8X2XQ+3aTFsnSP5qcm70fzijMveU988XQhXjyJ5UrG:GDB7b0Br9Q+1lnvQQLV8X2XQ+3aTFsne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656701, "uuid": "efee1290-daa2-4620-a31b-738cf80f1f6b", "value": 96793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656701, "uuid": "506f9791-2034-427d-8531-e064b7c9670a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656701, "uuid": "a095f5ff-998f-4f9e-8209-2bc41b5eb5ef", "value": "invoice-1637482117.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552bdfd7-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761634633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634633, "uuid": "39d2edc8-2138-43f7-8fff-4634ba219a43", "comment": "Malware payload (Rhadamanthys)", "value": "aa3c1782b0e3a60b0fad4bc89c165615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634633, "uuid": "690881a1-d8f5-4995-bfc1-477e9579539c", "comment": "Malware payload (Rhadamanthys)", "value": "6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634633, "uuid": "02ea135f-e853-490a-94d5-ced777e4b840", "comment": "Malware payload (Rhadamanthys)", "value": "2986fd9d86d80ff9671052073c18eff61131f7b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634633, "uuid": "981742c5-7887-4f3a-97b3-ff25a121ff64", "comment": "Malware payload (Rhadamanthys)", "value": "e7608f181f786f145e3381a89ac96bcdc2b9cb3a8e5fc76bb4794f07e8f357c65cbc50900ad5d39218d8868fd92460e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634633, "uuid": "6d7b685d-e324-42bc-8c45-2faa3250527d", "value": "T1869533675EE0A9F9E1C2473A9FBF89C719423A38054A5CD9B70E006C5D3B34129BE4E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634633, "uuid": "5fa5718c-158d-451d-b054-68452f548137", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634633, "uuid": "904e3f0f-aed4-4c18-91d3-6ddc64cba0e7", "value": "24576:w2BY+F7V0kFO5Zo5yWK3NBbIlopMXPTtdIQqcy0YEMcM4B4PacqZ4gctpMOr3Lz3:wha6kZzK3klckPhy6McMs4Sd2nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634633, "uuid": "e0d2ba95-273c-43b6-9412-28805afcfc16", "value": 1996288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634633, "uuid": "4dfc624c-ece0-4f0d-9657-74b8f0769ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634633, "uuid": "1972ac33-3fe1-49b0-a114-b753472e319d", "value": "6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2639212a-b3b3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761624247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624247, "uuid": "bb0f5f00-90fe-41f5-9e11-a13ff51c16f6", "comment": "Malware payload (Mirai)", "value": "b36d837b821c7aa310215a19221829b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624247, "uuid": "519afb7a-16fe-4d2d-a305-77373dcc1141", "comment": "Malware payload (Mirai)", "value": "6eda1367bf822811a7d0e2b47903fa6983741685b017f17282638fbf9b889091", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624247, "uuid": "ce8250a5-d26b-47c5-8b6c-759b258aa6b8", "comment": "Malware payload (Mirai)", "value": "69f2445aa1239d5905d3229c6da9c3527f942dfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624247, "uuid": "21159381-7b16-40e2-91af-0e04ca9b8d4b", "comment": "Malware payload (Mirai)", "value": "403ecf8cde08e1dae3d4dca64175e035d922c4097a070764497fa9de2e8b0992a9019ced2de38901ef9ea8e9ee50f90a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624247, "uuid": "187b63fc-42a5-4c80-88fd-1ade5a8f7446", "value": "T13C632B12B3BC172FC4B0A57880777B137EE56A9A4A60E68FBD750D8A9D132D407277E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624247, "uuid": "6116bf30-bcf5-47e2-9bb0-956e8ac0972f", "value": "1536:Kl8+tymFdjSLjMAMBIcTXEAsAkCQwQ4QwOS+fqInEvp8GwDFf8nJNl08JK:Kl8rs8AzEAsAkCQwQ4Qw9+DLGA8J7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761624247, "uuid": "f5a8e18a-3714-4d2b-90b0-930858fcf717", "value": 72028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761624247, "uuid": "cda2e91f-0067-47ac-ae49-2f2583ba3814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624247, "uuid": "296bdd48-957e-4b72-8b15-5bdf036a240c", "value": "Orbt.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce234823-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654164, "uuid": "e4f595a8-826e-4d9b-801a-0b6156baf77c", "comment": "Malware payload", "value": "d895c2ea112d9cf14e932c63801d4b70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654164, "uuid": "4cd656e7-7fc1-46f4-94ff-0a41508589d9", "comment": "Malware payload", "value": "70db11f00a841dda4c6631f8f8ca4e3aaea0c868253303c4bf1dd71b517d365b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654164, "uuid": "cde095d8-ebe3-4d88-b6f9-1d121c8f3a31", "comment": "Malware payload", "value": "32a76823a6b82bd6173fab87bc4437c04d2e30c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654164, "uuid": "2f97e818-8ac1-4f59-aeeb-0e53f9e0f7b3", "comment": "Malware payload", "value": "17f515c91999a05ff0789a17d4dee1887fb05f0e16d42e9d5e7c259b94b15eb4435a37c8aeedc7d1cace9e6b97f838d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654164, "uuid": "a8ecfb67-9f45-449a-8c40-bb2c5b82877f", "value": "T14863017477AA202CF9905C321391F5B9DD069D28005A0720FDF9C25EAD66A750EDFBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654164, "uuid": "5b6cd80d-7b02-46a3-a70c-344c50d04f29", "value": "1536:wCvPfnOEfYo0zOL7jQ1xSA3YNrM2yjsv+S+RdRprPKQ:VflAzS7g/YeYv+ScxrPKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654164, "uuid": "0b788ab8-3f3f-4d15-acca-55b58e33f824", "value": 67144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654164, "uuid": "a2d2729c-3ce8-4d24-ab03-c6ebe6bd4671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654164, "uuid": "8a123377-5462-4081-90f6-6ffd03d2fb32", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61eed8ef-b395-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761611462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611462, "uuid": "f7354b76-e9e4-4a66-9ae1-5d185977f69f", "comment": "Malware payload", "value": "ffe96a4761b2ff5bec745c2fb28866ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611462, "uuid": "42347438-813a-4ede-a88b-ffc7be9bbdd2", "comment": "Malware payload", "value": "7317a1a35e98a17186179e239331175e823422831b3f498e7ab76939963a45ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611462, "uuid": "cccac0b9-0756-45f3-ae94-e6f88ed0712a", "comment": "Malware payload", "value": "64d506ffec721b864434a306e22f875afdb8dc39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611462, "uuid": "f91f87ea-3868-4a18-9fb5-622a3b7a15c1", "comment": "Malware payload", "value": "3eb0796fdf1fd9029e2d2b8226e76f6b6adc4fa0eed24eb27bc4f86a64350dbf4b617f45c8295a075036f96810be48df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761611462, "uuid": "94a98d89-e63a-4f32-9a28-af6918ded19d", "value": "T133630240DB298265EC858C6A69BA9A3534F24409CCF11F3B90E676C96CB4A3F8FFC155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761611462, "uuid": "bcaf61f1-458a-44f1-a544-839bb14165e5", "value": "1536:PJ4B+Ozb3ZLerK0jOd/ksllJWRZDdBRCi5mER6q7VZzNzUbl4gSorP:PGjz7IKqO9XJWHh6QVgcSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761611462, "uuid": "7f474e51-937b-4492-8821-44d426829702", "value": 72792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761611462, "uuid": "afede722-e739-4eb2-b04c-ee2488e2bd40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761611462, "uuid": "ad1efa93-1fc1-40cd-afce-4136a70883a2", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8190010d-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656612, "uuid": "f287138d-6800-4d70-86ea-ffd712ba7f79", "comment": "Malware payload (Rhadamanthys)", "value": "50af146c69fc6eb5ba5dbed722376e8b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656612, "uuid": "1347b840-fcf8-4844-b757-1e57507e6289", "comment": "Malware payload (Rhadamanthys)", "value": "747f504f531282006947b35da5218dba5a33d0d0c5692847c4127f8bf429dec1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656612, "uuid": "f15c029a-fe81-42db-875f-52213a45ca3f", "comment": "Malware payload (Rhadamanthys)", "value": "b1a020508ab4800a9d652b11fb984a95024ebad3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656612, "uuid": "f127e3d2-af70-4f2a-96e2-3789292939e9", "comment": "Malware payload (Rhadamanthys)", "value": "131b05367d39d877d1ac81427d2c6de63f526deefc21902a131d13b2ac44dc28368c6cc918397362e67dd3e42a1c49c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656612, "uuid": "2e595bc4-38ac-4cfa-a207-8c9067919a9e", "value": "T12EA32B0DE631D0B4C26E4AB63D81D8EBA98E7E51E423370450DF27C0AD4578A6EB87D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656612, "uuid": "9d665419-b40c-4251-8a0f-8309be6acae4", "value": "768:GDhd0i7J4sYKgY/CMNfWdamDbK/rX+HruVwFH/FAPQzJtSLAuAAroQW+FF+Ec+0G:GDB7eKg20apriruVwJFAPwj6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656612, "uuid": "06aacedd-dbbc-4cbe-b94d-9ca262ee3219", "value": 105430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656612, "uuid": "7491f8c4-7732-4208-9ba0-9aab7a492463", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656612, "uuid": "ca0c3b4e-d0e6-4ded-82d1-aa6c76be8219", "value": "invoice-1637482117.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c4d986-b3b4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761624974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624974, "uuid": "5dfa9fbf-2ff7-4f6f-9db0-899f01297c01", "comment": "Malware payload (Mirai)", "value": "6e3566b3dab3c2433056ea63be739e2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624974, "uuid": "9dfe68dc-6e8b-4568-8987-12eab4f742e0", "comment": "Malware payload (Mirai)", "value": "74b0536ba2de49f1989592c085010eb3400aa33b4a4b85424e320fb74d143d82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624974, "uuid": "af53cb7c-d870-44e5-9bef-6a892a6c7f82", "comment": "Malware payload (Mirai)", "value": "84d6c9d91d652b864c11a3daa91b7969c033aa22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624974, "uuid": "7ad52a7a-5f2f-42ed-9742-c55f751da9dd", "comment": "Malware payload (Mirai)", "value": "f68c79f993ef01c9d131fd9f14bea41648d7dd8af8999791fbe1aac51de40d7560cd695b743dec1ce80b159da972a6fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624974, "uuid": "e2f52579-f18c-448e-8e98-8f4c05846f67", "value": "T1A863018C9F1320DACA7881B935F547259B621C726443CE25489F7747EF1E8A42677F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624974, "uuid": "4936aeec-c1bf-4f4a-9c25-98d1212a219c", "value": "1536:o7QMrGE7EfuD+zJ7Zd+5IUuKnF4BOsmU0+gw8qI6aCpR7na1vjOG/ZvsVJum:HMrGEwuD+zhf+5I4Khm4gwk6ZpJ4jOE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761624974, "uuid": "ac160e14-12e3-4f4f-aae3-470f683151d3", "value": 70236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761624974, "uuid": "e598b719-2949-4a63-8f01-b5f82c3196f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624974, "uuid": "e3c70c52-f230-4112-a611-f4b7e76e31ed", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54e15cb-b3a1-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1761616809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761616809, "uuid": "fe3f50e3-06af-4f64-99b3-0df8b96248fb", "comment": "Malware payload (VIPKeylogger)", "value": "b436f38fbd67cc676f95deac3b744373", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761616809, "uuid": "a4f33a9b-5a19-48fa-b2fa-e31a17376b30", "comment": "Malware payload (VIPKeylogger)", "value": "750178918522765b83b32510dce10c8cf9614ae72b95539f93b8ba7088bb1779", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761616809, "uuid": "b78b0ff2-dc52-48fc-afc3-04c5459d939d", "comment": "Malware payload (VIPKeylogger)", "value": "e129f370639f7ee4302aca344bab22d1548fa29e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761616809, "uuid": "8c85105e-ce0d-4c7f-bbf9-1321d7e79a65", "comment": "Malware payload (VIPKeylogger)", "value": "a039ce6f881265a5f1a7890d9e033e3bb1a660796b7eaf087ae4c08e0f768372ad6b9e0510f2d1c9c16eefaaa141596f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761616809, "uuid": "943e25d4-d5d9-4450-a793-fe79b462ea5d", "value": "T1E4F3373DC1A6ADF3C73BB0B3899B3A4D2049CA8FDC6D665F965577693490280EB6301C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761616809, "uuid": "2cd1bfe1-275f-43fb-864d-0c93d60d486e", "value": "3072:u+esEvJlJQzzw0UgUBex+KQYvHN+vLSPm9//t33o1:u+esEvjmzIMK8N+vLSe9H+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761616809, "uuid": "8a31a6ee-eff1-4ae8-b4b5-92ba07c7aa78", "value": 170647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761616809, "uuid": "b33d1f29-25b5-4cf2-acf3-8cdcf2381574", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761616809, "uuid": "b6c3c727-946a-491f-9e84-0e4c7daada29", "value": "rRequestforQuotationMKFMHS_RFQ_25_10_28.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323a2155-b442-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761685685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685685, "uuid": "b6bc9248-d8cf-4eb7-b1c9-ae449d588d77", "comment": "Malware payload (Mirai)", "value": "c704f264a783194cf12c6580a75326b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685685, "uuid": "9aa5645f-ed64-45ef-be17-96ae33d86aab", "comment": "Malware payload (Mirai)", "value": "7528457ceae38dcb4874e778dc46ce54737c96c903c018b9a56d678ec89ddeae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685685, "uuid": "06ee0fee-de7e-4db2-a8b7-a79c149334ae", "comment": "Malware payload (Mirai)", "value": "8829065928f3224b972046bef3d2e76a5c73a4ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685685, "uuid": "5e8a0d2e-c958-4d82-9862-9953cddf4e61", "comment": "Malware payload (Mirai)", "value": "23c6d6b46b624e443a0b897e00f645956bbecd12af34414b3c3d77f241eefc8b91d4c9fa81667e577d3c713540b2ec16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685685, "uuid": "3944b085-65a6-499d-aff7-55ac6d804a27", "value": "T157630855F890CA22C6D5267AFA5D428D33231F78C2DD7206DD24AB3537FB9560F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685685, "uuid": "7b466fcc-828f-47d6-b6e4-aa8ea57e63dd", "value": "1536:PPeLRJPws9h+0F1MObDlZeIONzII2aULmOg9+1Ir6:PkIs91bDb6NjRPv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761685685, "uuid": "3dee69eb-d5fe-4762-a01e-a5acdb1549e7", "value": 70904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761685685, "uuid": "5c39d463-1ab8-4438-ae6d-7bac1a3b3791", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685685, "uuid": "996d5500-c720-47f1-848e-05e01593c1b5", "value": "frost.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928cb690-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1761636454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636454, "uuid": "8007de87-c847-4ee2-9176-d6b4da9ca265", "comment": "Malware payload (MassLogger)", "value": "c84ff6417fdd4b17441fa21cd9369561", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636454, "uuid": "317d42db-6300-43c8-82a4-b6d3aed75d68", "comment": "Malware payload (MassLogger)", "value": "75ae2f35282a14163c9d996e040267853e5b4a93d9044983a282a78a4f0a99dc", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636454, "uuid": "2ac874ef-6266-4ef0-b98e-bf91e2c708db", "comment": "Malware payload (MassLogger)", "value": "0ff6cb4dd84b75c23741804ecd9826dd4a88be61", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636454, "uuid": "15251177-ca5a-4d7d-8f14-0a087bd07d6e", "comment": "Malware payload (MassLogger)", "value": "b2a3343084ed8dc8fc55b743b50270bba4dd861008810c630b92f065fc946dfa28d56e4bbd09d82cca0c0a4227e916d0", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636454, "uuid": "10e863f5-2f83-4b12-ab9c-07fedca43499", "value": "T1ADB4F11549846FB5CFBD4A1890FE190EE3F0168B9426A58AFB3FFC0A6FB764442171C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636454, "uuid": "fc7b3963-de96-4822-9e45-a10e3e22669f", "value": "12288:7iaMWQh5gbJgLpGfXo8+0yOI4g9DOdQcv7b:3QGJgkfXo8+0XIBKvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636454, "uuid": "51db7ea5-6b12-4e75-a0a0-5145660fa8a9", "value": 535074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636454, "uuid": "53c2a4ff-8ca9-4ef2-8152-9b621518303e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636454, "uuid": "3f5a6532-4f8f-4030-b06e-7e5bf57ea112", "value": "e-dekont.html.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd82fca-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761639805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639805, "uuid": "17f75f01-7b2f-49a8-b167-063d084b6402", "comment": "Malware payload", "value": "e2f2aadc271efbe32c03451ce02ce7af", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639805, "uuid": "6e5f0e2d-c81e-4b3e-8599-60d42d5495ca", "comment": "Malware payload", "value": "75db6bec966ae82e20d35e29ccb9ddf7b3ef1e9252d3d989cdd4b40bd69c42fb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639805, "uuid": "849288ef-a637-475b-bacb-b4ae0b0f3bdf", "comment": "Malware payload", "value": "8783f198b48fe93c27afae734f42c39ca8c5d588", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639805, "uuid": "0fa3b2d9-2581-4361-9454-7253ca5645f7", "comment": "Malware payload", "value": "3d5ff23987463fa7ac88faf985716fd0010de08253d77a77fd69143168e1c663d65e160e253eac21be16eb2395c7c511", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639805, "uuid": "e4472607-a063-4a88-a77a-7303e7914f99", "value": "T165A533845094E0B2FF0D9BD5A843B23D0C2B756BDCB8781E23D89F618047D691BDBE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639805, "uuid": "6f43a9fb-b041-4513-b565-486a5de9a21f", "value": "49152:GSVAC+lAbF9eYTXApw3c3iiBwBKjk5I9JGSV4lbIuwsXs/PXEI:JVbSAbNjApNoKjKsHylbnZ6Pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639805, "uuid": "80a76596-cf1b-4766-85a1-b53f5744e12a", "value": 2224671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639805, "uuid": "7e28906d-7302-42b8-9320-77c2cbd0c6a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639805, "uuid": "95cc24eb-c8c0-4e8c-9582-b53fbe9451cd", "value": "Ref- PO.EG-241611029110_QTY.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e8de1c-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656592, "uuid": "56c8bc96-747b-4491-a58c-7af3b1aa51a2", "comment": "Malware payload (Rhadamanthys)", "value": "d1a24945e17b4f47e33d37d1d4248908", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656592, "uuid": "ea8ee338-baeb-4ea9-b26e-83f5d5b4c883", "comment": "Malware payload (Rhadamanthys)", "value": "76ac3db79a76fa217ceb6ecd9d15c10c9e4df6af50afaa144046008f4cfd7c7b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656592, "uuid": "6ff275a9-9f78-4c86-a5dd-c3a639f7a180", "comment": "Malware payload (Rhadamanthys)", "value": "66eed0ed9757aa8fa4bf8304dfe84d44ae54f8fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656592, "uuid": "ccbf20ad-a6fc-44bd-8e69-124845713603", "comment": "Malware payload (Rhadamanthys)", "value": "637b031c81b0e03e8616bc325886e8ed804702fc713f7b10417b0a9b2e9191faf716207f79c86076f489cfc417dff30a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656592, "uuid": "bbe37590-3077-4591-a341-4d52e39fdc7a", "value": "T1CAA3F7B28E76D5D102B770B369276BF8D42FD8144B5496CC6012F330D1EADE1AE19ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656592, "uuid": "7fe8573f-1e29-4557-834a-798698e3f8cd", "value": "768:GDhd0i7J4sYKgY/CMNfWdX56dqoxsrXp+r4J/DZWHV7cMwA3Tc8WZgSLAuAAroQD:GDB7eKg20dr0r4Jr+sA/Cg6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656592, "uuid": "026321b1-d1ac-4e25-bde2-b1490b672925", "value": 103998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656592, "uuid": "c3f14877-b7d3-44c1-a95e-8686dd6ca575", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656592, "uuid": "1bd4c462-1358-4349-9535-c31e646f2e4f", "value": "invoice-1637482117.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5017a490-b3ed-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761649228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649228, "uuid": "5544f09a-a7d8-4eef-9689-0d2df58baaa6", "comment": "Malware payload (Mirai)", "value": "2114899970c131458682423de73653b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649228, "uuid": "d962a0eb-700f-4a09-83fe-1b556c9b6127", "comment": "Malware payload (Mirai)", "value": "770c9b19805bf48981ad946df23b40b70a76e38103a0c03064b33743ed3d8461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649228, "uuid": "8b739821-5831-4902-8f8c-3a09d2d5940f", "comment": "Malware payload (Mirai)", "value": "dcee4a878a5fcae3310d51e8e626b9cb1e1cfff5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649228, "uuid": "306b7501-42ae-4c11-bc53-87c24ae9dd26", "comment": "Malware payload (Mirai)", "value": "05541a95a171964dd905fe17266a61571c2be727d64173149e4ec03d7a9db2ef1762df5a0d5557773099333a493c3969", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649228, "uuid": "f709bf8e-2317-4015-8ff9-c0bd64e844dd", "value": "T18EC3F199F6277881D09205FE54801AC783917675CBE32B08139DE674787DCBE1FA8EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649228, "uuid": "b5c86b92-3f94-484f-8bca-6de18a766653", "value": "3072:BB65wLoTKnlFiaXlO1ic6fHzmSvIt6h+BuUMMTnA2:QKl0aX81yHzmmWB1xTnA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761649228, "uuid": "dca456b7-8d86-4715-9fd1-a5f4f7630050", "value": 119756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761649228, "uuid": "99776db8-400f-4f14-bf5c-ea7bf7964aab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649228, "uuid": "4446e7e2-0066-4a37-93df-6352ccf230b9", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d6b33c-b424-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761672886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672886, "uuid": "033bd083-a385-4fb5-b777-c2d03981c15f", "comment": "Malware payload", "value": "9e28aa708061a54f5c3e72b14c45b496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672886, "uuid": "2cb80553-e2ad-4712-8bce-a04ed6faa5f3", "comment": "Malware payload", "value": "773e664928edc197638a464f753efc7b3fb59ec026b7545ee51e53243c767630", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672886, "uuid": "a71bbe63-ed56-4fdd-93e3-4a1adc45e628", "comment": "Malware payload", "value": "6a0c79793025b0985db190fa8633a0f515d2fc33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672886, "uuid": "e6f2eef7-9b3b-4524-894c-07cb7aec4f51", "comment": "Malware payload", "value": "960f70b9df5c62c5e363d7b67186950e05cbb9073385030a44fc3b173e73816a8eda3b18df66598b0127996f3fa86382", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672886, "uuid": "8b0efc4e-8c43-4775-abb1-0802a1846611", "value": "T1ED932755BC829A17CAD0137AFA1E428D371663ECE2EE7213CE255F2137CB95B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672886, "uuid": "f5dd9606-28bd-4936-a50e-f517236732d5", "value": "1536:G41n0c9ZdA1XuQ29PpUDNYUZZpPaapsmPpDjw14qdPbZvBSduh1REDC:GoF9DA1Xr29PON7Z/n6dbFVhQDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761672886, "uuid": "03969ab8-6281-4b2a-9272-d7cb890d0323", "value": 97504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761672886, "uuid": "73441838-bba3-42d0-ae4e-a064838afdb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672886, "uuid": "08a0286d-9bcf-4f44-9142-6b9b817929e3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967fdfdd-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656647, "uuid": "38f3d882-aae6-4bc4-98ef-b19c1f1a910a", "comment": "Malware payload (Rhadamanthys)", "value": "6dc9988797de171cc7aea579dc965c9b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656647, "uuid": "b013a70d-8719-44be-b992-7069feec859b", "comment": "Malware payload (Rhadamanthys)", "value": "776dcde103b42d0f847004c5557bf7feb6b9a1338220a5988c5e7a7072bf9c7e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656647, "uuid": "839369fe-8436-40e5-b64d-9177e4c92d25", "comment": "Malware payload (Rhadamanthys)", "value": "3f6b81767c6320f307b1ae8e51292bddf686b49b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656647, "uuid": "1c8fb827-bf62-479a-9b98-5d33d550a10d", "comment": "Malware payload (Rhadamanthys)", "value": "c88752716732056701613374f19996d1b07f1349f298a4fa2af7cbabcb0780e64eb8fd917ab83888b092f5486312833d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656647, "uuid": "0997167c-d8a3-4d52-bb3c-1e7ff830920b", "value": "T173A30847CC90EAFE55FC61A8096895F0CD9D8041861EB28CB56FF78D48B8A319CBD1E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656647, "uuid": "8d990d5f-2a4e-4f28-8162-ed0635307a16", "value": "3072:GDB7b0bmKXH6JB59OCaEsLIAwXol89OCW3FpkiM++fHOLNe4Z7KtOmt5gh7uIBz+:0YmKXH6JB59OCaEsLIAwXol89OCW3Fpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656647, "uuid": "b0b30a47-6b42-4997-8abd-f3dadee320cf", "value": 104007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656647, "uuid": "4d29e53d-45e0-47ea-bdaf-f717fd929fe7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656647, "uuid": "11b0de61-f563-48f7-923a-bff03294f486", "value": "invoice-1637482117.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59ed507-b3f0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761650794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650794, "uuid": "012ec442-a721-4e46-97e2-2b5672f64d8c", "comment": "Malware payload", "value": "9dded80b806096094686580c6dbafc17", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Instagram Followers", "colour": "#B9D54D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650794, "uuid": "de1e9e29-f21a-4fe4-b587-faa6032b1b55", "comment": "Malware payload", "value": "77b86c8e0c2eff22bf51863f688ea45e09ee92aaac6c46fe06b77d6c4ff2b5c9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Instagram Followers", "colour": "#B9D54D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650794, "uuid": "baa6f6e4-a25b-4cc8-b5d6-329148cbe71c", "comment": "Malware payload", "value": "0d65b595f336ff91eafd5419634ac519384554ee", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Instagram Followers", "colour": "#B9D54D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650794, "uuid": "48fbc1db-1a79-4fd5-ac5a-f0134bc13e8e", "comment": "Malware payload", "value": "1d2cb837c1f664a2a11e0d805580eeddbc2551a35a51f4fa6b4da715436d43dac96d351f7323134f83f7766d7d2f8661", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Instagram Followers", "colour": "#B9D54D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761650794, "uuid": "3bb20427-a95c-4bf7-aab2-d8d9ef39bcec", "value": "T10AE712E3F319EC69D0F34736937510A3B9250CA49B53F2A60B12B6386EF3AD08549ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761650794, "uuid": "63466d0a-f1ab-41f3-a45d-1c2d062a41d6", "value": "1572864:qqpMXVG01mbHy/vjAC+lZ1mbQMDpKzBUUw0YpBj9f6PS8U:qqS1730C+UUopKziBjCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761650794, "uuid": "9eaa2a3b-25c2-480c-a428-00f4227bc118", "value": 67173213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761650794, "uuid": "02f1d80b-1682-417a-94c0-79861e514e3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761650794, "uuid": "c9f67be9-4da0-4de0-819b-27886b438fe6", "value": "Redeem_Free_1761638835640.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22971de-b3b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625340, "uuid": "ad85c306-2bc5-412e-ad49-5f6bfd82f731", "comment": "Malware payload (Mirai)", "value": "29a9e6026b8e06c6373335fbd51deab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625340, "uuid": "601c6788-7e20-445d-9489-030c591f468a", "comment": "Malware payload (Mirai)", "value": "784db215b440dbd938978437151c78733af63be748c51c04ea8a52e9ba560576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625340, "uuid": "54a580e3-d181-409e-8e1f-a2b0d4f73250", "comment": "Malware payload (Mirai)", "value": "b61df14d748506ca5319b2d6aac6ba1ce62d61aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625340, "uuid": "2e5fb047-4f97-4b7a-8bd3-ff93a096d3d8", "comment": "Malware payload (Mirai)", "value": "486a05ec36ab3086cec41c87fe00b1dc5449a4633a3a60e905b54f817d28d8df7005c6b91567e2107afce0d5bfdbd31a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625340, "uuid": "520f95dc-1edf-4749-bb60-3787de7f6b4d", "value": "T1C563020ED4D2A848D89C5D3F928A77AF6D9DAC419BE4C3CD23528C80F59A05FB9CDC24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625340, "uuid": "12e57031-5c53-486c-a678-b30d6a1efb2c", "value": "1536:1pugbRQ6HGSemtIlyHgVdk6YKBeXS5dlXp5ax94GnOke:BOJaD47kXMdpW4GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625340, "uuid": "88add0f2-85be-428e-ac32-b1db780fb306", "value": 71972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625340, "uuid": "6a1e9be3-7248-40d8-b67b-5a3d992be49f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625340, "uuid": "d9e2badc-6cd2-40d4-b0f3-e2da1573e115", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179cc323-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761635818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635818, "uuid": "47c87212-6941-4a11-a50b-ca02ab71e540", "comment": "Malware payload (XWorm)", "value": "6a0a7476a1d80dc08152449e5a3e241a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635818, "uuid": "9cfc7ef6-89cf-4be5-8bad-916980cc34b5", "comment": "Malware payload (XWorm)", "value": "784fffec0af6724eaa1116368fd77902a39cdd66101cb8e462225202839fe634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635818, "uuid": "7693321b-0ba2-4ca0-8fff-628d1ff74b1f", "comment": "Malware payload (XWorm)", "value": "ce454d5875ac30208c034842fbdfb5bb8f03a04f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635818, "uuid": "085f0f46-70d7-424c-9a2c-4b8ec5e4fe4c", "comment": "Malware payload (XWorm)", "value": "8bceaaa9e27428473375ef5c2864c5e467aec4f544af7cb6a4122990576236fb9341bff8395ec29b15c562e476c7ab9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635818, "uuid": "1bcd3946-7776-4999-8bf4-a50e1cf9a886", "value": "T1EB45FA2EA6742027F09BC2745AD8596BA8155D373500BC2AFBC25F9A23756C3B4E133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635818, "uuid": "f6692f76-a242-4fcf-b413-de399050a1d0", "value": "9bc9779c772573ca5ce1d6a820267a16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635818, "uuid": "20bae801-9c89-4447-bbe3-9dde2a0a2678", "value": "24576:HWhrjhAo1bJVyxGOa1P+rnIam4DeULnRFJsZ:HCr6o1bJV8Da1P+rnIam4DeULnRFJsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635818, "uuid": "298bd547-d9a0-45f3-bec6-90e1cfb0c9a2", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635818, "uuid": "1de6150b-b6cb-44e0-9f79-1e60fa22768f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635818, "uuid": "e4449191-73a9-4308-ab82-67a70b886dda", "value": "SecuriteInfo.com.Win32.MalwareX-gen.89238285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad58a41b-b3e9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761647666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647666, "uuid": "563d5ad4-f03b-4f14-ba93-9d6180ca459d", "comment": "Malware payload", "value": "8b5d4b2396d575605f35816c28e3c30e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647666, "uuid": "01aff918-6771-4681-bc7b-e46d10f17a6a", "comment": "Malware payload", "value": "78d302f5041caae85aeb25d70d98a087754b1e970cb29461999f82c5cf7cdb82", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647666, "uuid": "f744ba15-f0dd-46dc-a719-0118d3d7fcad", "comment": "Malware payload", "value": "96ea053384ddc41a3286c2522a1259cb9bc2f40c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647666, "uuid": "0e82aee6-1762-4230-86c3-8195e7ffc974", "comment": "Malware payload", "value": "2c5360dcdecfe71795921f6b764f6497df0580db3ac7bdfd43742fbd2c28edd53cc8cd7fba1b662c497ad33e3a00e25b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647666, "uuid": "971f17f0-fedf-413e-8543-d616befd8322", "value": "T19316F046F30594BEC4FA9732067622600173CD668F839687696C723C69BB6CD5F29FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647666, "uuid": "dc7f0848-d70d-406b-a10a-2ece05fa0afc", "value": "98304:ce8fGfZqWhsmUJ/giq+BQ2tYJmBBeLQUjU1ttTy73nw:ceZqW+mOlq6Q2tYAhUItR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647666, "uuid": "506b7c4c-92aa-4b03-8a4a-8ae58e86f0e2", "value": 4229808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647666, "uuid": "0ff35db1-eb0e-42d1-9467-9747cd96bb0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647666, "uuid": "51b46ecd-f86b-4dda-83a1-62eb9303081d", "value": "\u0412\u0441\u0435\u0308 \u0434\u043b\u044f \u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ad487d-b3cc-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761634929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634929, "uuid": "2ecce1b2-0051-40a3-9c10-102382cf861a", "comment": "Malware payload (RemcosRAT)", "value": "00db8febed8b9c77d3a7c5561fcba346", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634929, "uuid": "37459c86-b669-41a7-8561-acc95f896d38", "comment": "Malware payload (RemcosRAT)", "value": "78ed2db2b159c84f487dfe7cb7c3822f30341f2d24617991319f22030ae478c1", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634929, "uuid": "126cb6e2-d7d7-4bb5-9f51-9d650ca84042", "comment": "Malware payload (RemcosRAT)", "value": "aa11758ff4c5c0d82702f427ddd02d959f7ac60e", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634929, "uuid": "fe0802bb-b7e1-419a-9c0a-f44a333d4e96", "comment": "Malware payload (RemcosRAT)", "value": "8a3907e3f72f9f46ea7a1f7509f83d9646f707a9f7f6e7ef41f4129a1249b88c9bef2059e18839a26e9fd326e8b6c560", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634929, "uuid": "3e10387e-175f-40c7-8399-20752f966a8a", "value": "T1A6C5CF5D94B05D922024FE74AAC5F793CCEA17851A174B920FE5E2A67201C43FF7B3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634929, "uuid": "5ff83dc2-0168-44ef-9864-c2ee7979caac", "value": "24576:zr15rgIsK3KRWYfZOBMclTNAUpXqP3cuoW6QwGjsNGLy7:k/RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634929, "uuid": "680dd234-1941-4db8-be59-fcab14078dab", "value": 2681070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634929, "uuid": "9a02785e-f018-4008-8d97-72424eee53e6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634929, "uuid": "9b071386-ec31-420e-9aab-b8bc3b965651", "value": "OC2025261094903094_pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d642eb-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620942, "uuid": "fbbef382-1c4a-407f-8d08-8727315b0a37", "comment": "Malware payload (Mirai)", "value": "9557c9a3d2cbafb9737e5426bdfe3ce5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620942, "uuid": "8131d5f6-3700-4f5a-b972-5e6435337986", "comment": "Malware payload (Mirai)", "value": "795d6442fff29b5fd60ef1c2e271b802a9718e5d9cdf72b20ef2f566625bd0c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620942, "uuid": "77721e7c-3cb5-49da-a98c-cc16c344c339", "comment": "Malware payload (Mirai)", "value": "c33f6e2abba9c582706f2559dc537bada3355980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620942, "uuid": "4df134ef-b45b-4e10-92fd-7d10c2d08da9", "comment": "Malware payload (Mirai)", "value": "9562d1352d40a34c6d22ab3b66cdfdae17d2df2b742d13650beab581fd9a895a8434053af49ab2025c9fe38a728bae3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620942, "uuid": "7bf768a5-3e46-4587-91b1-1b7526fcd00a", "value": "T127836CC6F743D4F4E8120A71217BE7318A73E53D502AEE83D769A832BD12641E75A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620942, "uuid": "6cc931fc-eed6-468d-9820-6d3e078901bb", "value": "1536:4NGfle9cPS4ZS96h+XVE143RrFUCeWtsrswWdZa:4cEWSkS96h+6143RhUCeAszD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620942, "uuid": "fa82a790-15fe-423b-a04d-81acf0f7495a", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620942, "uuid": "efa9384b-4b2d-487e-bc91-f059acc5a9ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620942, "uuid": "7d483198-5c54-4aaa-b96a-1ec21555692c", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a07d35-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1761636198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636198, "uuid": "6e5dc418-9c10-4929-9c0d-6b81ab46a29a", "comment": "Malware payload (DCRat)", "value": "b2e6e1107ce17789969cf6b8edea8899", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636198, "uuid": "1e52876b-f128-43fc-b8bf-1bdab8bddbdc", "comment": "Malware payload (DCRat)", "value": "7a234dbdd2bf8d110541f84e60483a2956c94013ad287bd9fb579641a7eb5b43", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636198, "uuid": "692b31fd-9a05-4288-8a03-1704083f4dc7", "comment": "Malware payload (DCRat)", "value": "c2d6596e48504d4d89afad2b07518ab31f3816e7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636198, "uuid": "b49eff21-9d7d-4d78-b501-060f638b3b01", "comment": "Malware payload (DCRat)", "value": "6b1e3f9f438869329f03198409f9b706f9e2463c9dc983e931ce36e5751a610c8aab967c01fb3fdc1ed4eaae016b1a9f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636198, "uuid": "5047a74d-50a8-42dd-be68-08b499ca21be", "value": "T10D2613D92FE55142C59B1C068F0D36BAF3BA4C8F048B801C3D4FEFDAAF5289461DA569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636198, "uuid": "6161f101-f4df-4fa8-8892-98f20af74d3e", "value": "768:kZNXa/tGc874mDXQrXvsptSNrm+Li9q1mkwoCwuKmPfTWpeVnQP3SDERHuz/3Hco:Qta07LtV+2QErWp+xDERH4Eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636198, "uuid": "d995af65-0236-4e4f-a14c-96ca8d4035e0", "value": 4512096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636198, "uuid": "fd03895c-b7a9-4180-a9e6-11529177ffde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636198, "uuid": "29f2747e-7142-4220-a2ae-052370bced26", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c20d8b9-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761639799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639799, "uuid": "b4551735-b96b-4f19-8a12-13b426fa0cd5", "comment": "Malware payload", "value": "64cabbf1c42443f5f9b4c33eef01acd1", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639799, "uuid": "af6a2d48-1033-42f1-990b-a5efe866cc73", "comment": "Malware payload", "value": "7a64d300b11efd050fbad4bab555a60a1f4332b6f65549402b20827d60e3ff73", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639799, "uuid": "a84609cc-adf1-4580-b074-fe98c991721c", "comment": "Malware payload", "value": "dcdaabfea5fd4cb24c67ae03c364b9e664ac3392", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639799, "uuid": "be49ae5b-2302-45b3-8434-c4bfa694c479", "comment": "Malware payload", "value": "9173aeab101531587f1efb7c34e3603bb30573a2b3bd83f73c885af89be8e3e6758a6ba596f50c9046f4d150529d68b7", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639799, "uuid": "d961f935-972d-4005-98cb-464c11b2c94d", "value": "T161A5331C0CED06763CB6F02B41F02183A57871B5B059A656B3179BE61CE6FBE4A19CB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639799, "uuid": "6e5c2580-6a92-4bf3-a11c-e86316489469", "value": "49152:a5dS2lb0BceY1cR8MP2RqlRnLxnMbdEi1i+ZKU4lV1vW:cuv9nLxnCdNrB4D1vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639799, "uuid": "c405eed7-f8cb-4b52-a8aa-42181f255bc0", "value": 2079444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639799, "uuid": "61e40917-a105-4dda-8aa0-185e994b2a75", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639799, "uuid": "43320f11-d321-4d11-831a-142f995c839e", "value": "CONFIRM VERBAL ORDER (OCTOBER).xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a296868-b410-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761664250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664250, "uuid": "9e376a3f-b656-495b-ae1a-c91c242d1e13", "comment": "Malware payload (Formbook)", "value": "1657ac909f8abcf171e6f282d3904205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664250, "uuid": "447082fe-3267-415c-82e6-f00a560271c2", "comment": "Malware payload (Formbook)", "value": "7b09cd99f77589db2c229244b7f5c5d8d53113155439b8c41963e36581f35e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664250, "uuid": "1123e0df-0d15-43f1-94d0-df0f56273710", "comment": "Malware payload (Formbook)", "value": "0f1d22fb60a327c19a1acf6e382376aaedac25dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664250, "uuid": "bd2e78aa-1f70-4180-b065-829f89560546", "comment": "Malware payload (Formbook)", "value": "8d82df6bbecdfa48abbc82cde772b7627bd2a36c861badac8e3376515c2e6fd90e73d1553be4bac96a13dfc96a1d4dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664250, "uuid": "9fded59c-91bd-404c-9273-9aa8a8d0cb26", "value": "T11EF412002719EA03D66517B109B0F2741BBA7D96B820C35ADEDA7EEFBA76F144844B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664250, "uuid": "452ea042-4264-4bf0-a1c2-291ad1374be0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664250, "uuid": "2ba374a7-d7f8-4eab-916b-740d9da23356", "value": "12288:/Nmq/NRijZ5lyk6Kg/M9b6CDh4xVcViONJsMKQ2qdOpjJEOy9kR:Vm6RijZjq4b6CV4YV1NJRJ2qdOlmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761664250, "uuid": "78841eeb-444d-4510-bcec-316da358a5dd", "value": 747528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761664250, "uuid": "d6869d53-f25b-4556-9b59-d0a406eaa07b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664250, "uuid": "d26e01a2-f40e-4cc8-bddb-017b142c04e0", "value": "RFQ_URGENT_ITEMS_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96aa25bb-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761640327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640327, "uuid": "0553c603-786b-4214-b253-c6702a3d85f1", "comment": "Malware payload", "value": "0dad6a06d1427f06ea4a469dae6551d6", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640327, "uuid": "8dd074b7-e092-49a9-a02c-9595aec29e70", "comment": "Malware payload", "value": "7b461484f78b6dfee3519ae042f2fc554374278f5bccc2ef83a53fcc8bc154e2", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640327, "uuid": "7800917e-00e2-422d-a629-79929a513d8d", "comment": "Malware payload", "value": "824c1215606d228a3cfa4e684742f4359a80d894", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640327, "uuid": "1d53fcea-efab-4fad-9ef4-2829c2c5fd8d", "comment": "Malware payload", "value": "174538279a00e143abe273931e2c3a672868c5bf8b3ef7043c6b8eef02a10584a2dcef7d841471258513b2582ecbbcea", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640327, "uuid": "3d2571df-4bc8-412d-abf4-d25ffcae0251", "value": "T1A912F16A7D58D67045B7CAB9D81BB00EF9E4215B112E8C14FE5CC5C44F312ACB9E93C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640327, "uuid": "fd6ee2a6-4776-48c2-b1bb-1a480768b2ad", "value": "192:s/JGg0GwAo30ykRKB/HNS2Eu/JIFUayVYCP/Opq:kGg0GwAo3rCwN+uIFUayVb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640327, "uuid": "73ccc962-7e5b-4345-9efe-32b3623bea00", "value": 9610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640327, "uuid": "fc215ba4-0876-4cf0-a8b8-0362995d89c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640327, "uuid": "3c15f87a-0dc4-430b-8489-bea122169b90", "value": "Balance Payment..975770.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ca7444-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654129, "uuid": "5853e321-2756-48cb-a414-e857cf376714", "comment": "Malware payload", "value": "80e5a7ed5d4fd1f75c7406ee2c696b6c", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654129, "uuid": "9e85d655-79a3-49ff-a5e1-dde4241b06f5", "comment": "Malware payload", "value": "7bdcaf0ee89840883dc7b87482c5c92781dbe10f385f42700238e8ef5a4f3bbb", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654129, "uuid": "9e478266-9cfb-47fb-970c-44f325accca3", "comment": "Malware payload", "value": "548939ec3c948583730431bb7af9a72ca94d044c", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654129, "uuid": "302a2d3e-1a94-4187-a3af-1592d64e83b2", "comment": "Malware payload", "value": "549755c921d4f906b4efa71a1a2ba98e2587461ea4987c1169bd11a44bdf741058ffca72185b899a4014fa679536e2c7", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654129, "uuid": "63b08f15-19f2-42be-91c0-45ae339e79d0", "value": "T131E0C0698880DC8889B737F46EE7E608D35310270006DB60378CDB136F721014FC2ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654129, "uuid": "01a98ca6-045f-4360-9fa4-fdb2704f36f3", "value": "6:q43taYOXHmgEqrhaqeFWXAkosgMIsqvJMcKDFiwMch0MWXfGb:Twt9Eqr8pFergKmMRMwMCL8Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654129, "uuid": "2386b367-9f67-47af-952c-d5a8885557f4", "value": 360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654129, "uuid": "a5484abd-5a95-4325-b357-ba743488a47d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654129, "uuid": "48719b19-10ef-4b92-9e1e-7abbfb0a3aa0", "value": "7bdcaf0ee89840883dc7b87482c5c92781dbe10f385f42700238e8ef5a4f3bbb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f13e9b-b3e9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761647518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647518, "uuid": "f3ece936-3e87-4c5a-8c10-20c4133f3557", "comment": "Malware payload", "value": "a4cac2c38925e5325dbb03a70f6e3910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647518, "uuid": "05604e13-2125-416a-a964-d641da69312c", "comment": "Malware payload", "value": "7d2e54a7cafe33aac29df9655cb49f7bd2d73cf7bc3c022736bf4576851278ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647518, "uuid": "988c58ee-a06a-4e5b-87ca-82daa84c2148", "comment": "Malware payload", "value": "01a29592e409cc4f4344c13e62b7206663c64db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647518, "uuid": "cb8f3cc6-ef9e-4bff-9252-aec27cf9cb81", "comment": "Malware payload", "value": "34af3e0017f175d0d7a967d78aa959d6a05e4dc1653deeaadcb7e59d5a0fcc09581d6477a2643ef8990dcc65770bf1d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647518, "uuid": "7f8d867f-f187-419d-b757-9e574567be78", "value": "T1F3A41261FB00DDA3E4281F7094BBDFB41639BD9AFDC44AAB3258BB1F3DB0155651A202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647518, "uuid": "9b1405e6-dbf2-4feb-a4e5-5af5e80c2e5a", "value": "68618d0e1bf9f61a5e2465bf14cec6e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647518, "uuid": "2491bba2-a23c-4d73-8332-fe6bc84ea24f", "value": "6144:YEba60HyP0167bH0+zScsLpiMuc1Q+ldDO6i1YbkFCtSlz61ZOocrhwbxuS:YxUPowbUooiKFdbbwCtkEVcrWbx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647518, "uuid": "8f81a1d7-eb66-4a5d-ac81-3ed9f2908af2", "value": 463696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647518, "uuid": "db75bf23-b1d7-4e8b-b121-6a3e8138c4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647518, "uuid": "96f8ae04-ce49-4932-bb7c-ad8cab49c313", "value": "cptmarketsmt4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fe303f-b3ec-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761648920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648920, "uuid": "03e6037b-9c94-4690-8d67-6f578599a6af", "comment": "Malware payload", "value": "47a3594842d2e096b5c2b0087bb7d679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648920, "uuid": "0ddcb8ed-adf0-4b5e-b4c4-f337734668c9", "comment": "Malware payload", "value": "7da16e4c7ebe84b198481ede18c91aa505867b267de62eac05c1cd5ff8b36815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648920, "uuid": "e7bae166-b3d7-4afa-b059-6952891d640d", "comment": "Malware payload", "value": "f5cda4893e3fe787ac5826c7e10e72e365b0f4d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648920, "uuid": "204de98c-c0d2-49c4-aa1d-e8116a8e9a7d", "comment": "Malware payload", "value": "533651625bc99fe154fe3b8aad091d61ce35eb631947b3e19d1732ce0731c480b173bea1222335d8e23a9d22274d90d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648920, "uuid": "2dacb71f-2bef-492d-a7fc-2f41e1bcf7df", "value": "T1096302A66628202CD38F37F7189E0087F119A6C4C3D187FB55A42518DEBFCC6105BBAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648920, "uuid": "be73d592-4aa0-4d4e-a20f-e44057707e7b", "value": "1536:rPogsFF0Tgi6V4CSkLqgQ45KS6UEnAqSNNgrPe:rggsFgZCjLqg35K5KarPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761648920, "uuid": "c7441663-5fdf-4f6e-8f32-43b24d2a6082", "value": 66992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761648920, "uuid": "ec571434-6010-4c60-8419-84ef31283cbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648920, "uuid": "04a6e24a-0224-4302-b593-a6b54a67922f", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b522b4-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761636220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636220, "uuid": "4063d822-22cc-4cd1-9820-eda97df1f4a0", "comment": "Malware payload (XWorm)", "value": "386beff000ddd7fe7ae1612ec7c94285", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636220, "uuid": "3f128164-d656-423d-89ff-9ab19aa0dc9a", "comment": "Malware payload (XWorm)", "value": "7e0c1fd38e8f84137c8b3d475c820e1bb11625f20d339a8de098ac01f9efb689", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636220, "uuid": "b96eaea0-4f0e-4a23-9235-37b5508c045c", "comment": "Malware payload (XWorm)", "value": "d85eda5ef9f60ed4cddab179c1b7c863390903a1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636220, "uuid": "4266734d-0d82-4b83-a1dd-32446117e899", "comment": "Malware payload (XWorm)", "value": "786c298ae36dbc71ab1e7c7ccfe66ac86a3b761e2f9765154454bf64b93ff34f1c640962ce964e78a543362b247df5d1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636220, "uuid": "21ac48c6-7a61-4de6-88bc-c1e22703ab1a", "value": "T1F7A29C610ACF0BCFB159815BB142861F48EF9CFE4D25F08AB1A977790E8364564F73A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636220, "uuid": "3a402abd-b8d5-4c11-9df7-dc6e01873f6d", "value": "384:MqLqh603saYK0b7rsY1cj9BpKe/o4lsRgsmx:9paH0b7AY1cj9BpKe/o4lsRgnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636220, "uuid": "9db2b5e5-80b0-4526-a27a-5db9f8895efb", "value": 22412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636220, "uuid": "60cfedc3-d650-483b-b447-586c7b1c392d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636220, "uuid": "77b4cd66-c646-46ad-8963-119a29e8a83a", "value": "post3.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d124f1-b3fa-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761654987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654987, "uuid": "6e42269e-8415-42a6-bf07-61845debb887", "comment": "Malware payload (Formbook)", "value": "8254137f463b8efde6590cb0934a1aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654987, "uuid": "c8bca87c-f293-44ad-9bbb-0511e68c7172", "comment": "Malware payload (Formbook)", "value": "7e10d2c5c38e0d5887348e83cb1141988c7444b3fe1c7d6d7b3ac2abae3ac49c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654987, "uuid": "120aacfb-61dc-43a4-aaa1-0fd07e36ba64", "comment": "Malware payload (Formbook)", "value": "dbc6aefbbb0b616e827e9625df54037e8f94cdae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654987, "uuid": "1747283d-6178-42e3-bf9a-223bbb528c29", "comment": "Malware payload (Formbook)", "value": "d03d81238ba3764961ba9013df01cc278803db18af3e203f9b3b63fee59d30913fc50459a0282f5c92e435f55ba0d06c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654987, "uuid": "fc144e1b-f75d-4ec4-85bd-a0eea2d33d9d", "value": "T14BF402442AD9E6C7D4A147B40EB2F07127B92E667810DE1A9ECA2DDF7532F004871B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654987, "uuid": "9945a267-fe9a-44a8-bf7a-421909db7e4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654987, "uuid": "24821047-07ff-4daa-a113-ee974efc385e", "value": "12288:xWmqIjiqL5W+DQiGMOJcTuJKKVe1Wo9kIdD3Nl9FFvg9t06:YmZZZ5Oy6J/Ve1WK3Rgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654987, "uuid": "8d3c9e65-26e5-4eea-b2a4-add2611fd9cb", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654987, "uuid": "ae80cd67-29a8-4f5f-a126-5bf41f5d4ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654987, "uuid": "4114ae54-e933-4da7-bade-5ab96c11994f", "value": "y6JpZX20JbOHoJQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e80611-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656750, "uuid": "42d889fe-979a-401d-b5fc-bec42d292aa7", "comment": "Malware payload (Rhadamanthys)", "value": "5f156c0c13dc73aa80ae63bccd7bd4bd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656750, "uuid": "d1bba9eb-cef0-4966-ab47-474912a00903", "comment": "Malware payload (Rhadamanthys)", "value": "7e1b34f48aa0d1b7d2cf7d787d69ee5082a1242cf47601f7fce60119d5e7a850", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656750, "uuid": "f216f0b2-08e8-4edd-afe3-dd776befe1df", "comment": "Malware payload (Rhadamanthys)", "value": "cc115caa733ac6e11fc2890d7e61bc8a13ac6719", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656750, "uuid": "ca322dca-cd44-4b69-ad0f-1a149639a7b9", "comment": "Malware payload (Rhadamanthys)", "value": "b556a70c769ea00f27ddd08532ba4428a7cf39b8dfdf5f988a981affa7d9b78525329517987f683fa41fa6355303000f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656750, "uuid": "50955335-a7ac-47ef-8f96-7a650819e32f", "value": "T101A3F9089D35F5D64585AEBD4E0445B0CA9F99603E0A648DF22EE368769E3E35F80FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656750, "uuid": "d644477d-1312-48bb-968d-5a254046d63f", "value": "768:GDhd0i7J4sYKgY/CMNfWdg69rXkhrU4hcbSHusycWfTX1BAJUjSiGGSLAuAAroQD:GDB7eKg20RrIrU4mZbA7zG6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656750, "uuid": "d813d926-3433-4e84-888f-baaaf7d773f2", "value": 102054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656750, "uuid": "51078fd3-a828-43e8-b72a-2d5b5f5231da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656750, "uuid": "57cb5fa2-bcc1-4563-aa20-70c27b507833", "value": "invoice-1637482117.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c573706b-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761646418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646418, "uuid": "f8e077a6-c433-4f69-b2f3-2093cb1845c2", "comment": "Malware payload", "value": "69a0af3d77038188691169559b36c0dd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646418, "uuid": "6b13752e-ec64-4b9c-9476-f3afc69afd44", "comment": "Malware payload", "value": "7e24d4ab3211cf8d3e96b17975978b35e1760a8b01bbc8eff1f865df6ee4d6d5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646418, "uuid": "1cf056f5-59ce-47f8-b300-c67b73a8e35b", "comment": "Malware payload", "value": "6bf8d9751066c90de9b5dc140e59e75607bb3c35", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646418, "uuid": "1c720e9f-c7cb-4b22-9726-8f59ca030f58", "comment": "Malware payload", "value": "79d5fc1d384f14e2935791e73754c5f67cec7c2b49386dff46f3f0ff5ae83ee8e5daa1f7cf5cde117a9c748e164cc4b4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646418, "uuid": "492a48e1-3809-4e05-81c5-c6c4b72dab69", "value": "T1C146F1C7F7D8A92FC877507289BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646418, "uuid": "18a9bd6a-f954-4e95-a946-bff707c6cf69", "value": "98304:zlkbZoTwrYhKOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltQ:zOaKOfyaIbaciAFvrEZpXqmY9XrF/mp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646418, "uuid": "65419a21-d53c-44cd-927f-d51249e0d4e5", "value": 5859643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646418, "uuid": "9e395a82-c1b3-42ed-b73b-ee45334fabc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646418, "uuid": "b158a21a-8fff-4f86-a279-df0cdb1d5625", "value": "Storebet77.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ceb21a-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620946, "uuid": "b7120343-409a-4044-aec6-80233d348588", "comment": "Malware payload (Mirai)", "value": "ab1f9d68d95142c8c8e91d093377fa51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620946, "uuid": "0b1fb925-d69f-4e4a-905d-0d0c5e28d014", "comment": "Malware payload (Mirai)", "value": "7f254feef01af2a190c0cd2383ceee0604edee58558fc02182fe012409ecd892", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620946, "uuid": "51e455c0-4ba1-4425-a385-6af21524e2be", "comment": "Malware payload (Mirai)", "value": "5e7552b253788269064871d4f4be89dd4089944c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620946, "uuid": "daeeb269-7eb7-422b-8c51-89f842d0508c", "comment": "Malware payload (Mirai)", "value": "08119beb72e8e333ab9189c6bc85f4db15d848fc37d92bbceb22c1604475c12f67476dc564e08c6fe8c0898bcfc5f825", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620946, "uuid": "cc21f9fd-d279-4519-95e5-8df51aadea5e", "value": "T1E0936C85FB83E1F4D94609B011ABF7798A31DD322024DD6BEB98FE72BC31612911A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620946, "uuid": "b26a310d-b2fd-485f-839f-9797ac2f10ed", "value": "1536:hqj89KwF8ROXbDccj0P/zHj822Rqoi9pUQ31QUHLKVyMyF+r:64F8ROLIcj0P/zHYBIuiE5yM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620946, "uuid": "7d116b04-43bb-4569-844c-6ae286d22200", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620946, "uuid": "e800cc85-acdc-4b42-b6e3-a3198e91b972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620946, "uuid": "c1df4946-5bcd-436d-bec7-6533dc5da1c6", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0825ae0-b42b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761676072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761676072, "uuid": "9e467851-a6b5-4110-b512-9e85b62b189d", "comment": "Malware payload (Mirai)", "value": "09ca1dfdb9d6b9b6b39ecddd0cad4081", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761676072, "uuid": "e75f34e5-4bab-4e85-8739-b700ce22dee7", "comment": "Malware payload (Mirai)", "value": "8042fdc17a22019ed6f9cd82b9b57dfd314a08f33d80de6b53e893430ae886a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761676072, "uuid": "8d0f94c6-76a0-4d9f-8c8b-06f155d71962", "comment": "Malware payload (Mirai)", "value": "59c556cc4dea9b713397753e6983bc637be754ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761676072, "uuid": "ecebf1f7-f3ff-4ff3-9f39-8ee9ec2fbf83", "comment": "Malware payload (Mirai)", "value": "f5e2aa36b6c2909d8cac8661a9032519f39e8f4aa9e63994798e3093b3d030a21df994cf62eeff99d6e70818b32b61b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761676072, "uuid": "b061dbdf-5ade-48aa-a529-01a366fe5840", "value": "T11CD3B50E2E218F7EF66CC33587F74E21935973D622E1C685D2ACE9111E6434E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761676072, "uuid": "08987432-b1f5-4daf-a8c0-283092d558eb", "value": "3072:T0kzhu2l+WWSdhqrjPitGwYW7rmqE+/nl35qns9oyfZFiYRZuqx0PyiOcn1Lp8:jhu2l+WWSPGOtpRZuq6LD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761676072, "uuid": "d6e5ccc5-dce9-4148-81b6-e645bc6e4a9b", "value": 142736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761676072, "uuid": "4247ece9-d572-42dc-9e63-e88f36150378", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761676072, "uuid": "299addd8-e1d8-4d79-a925-64d9d8cd4f64", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb794c4-b404-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761659396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659396, "uuid": "d9337d99-b7db-4e02-87d0-964d2d6aa502", "comment": "Malware payload (RemcosRAT)", "value": "eb875ecc0812936f354897fa8113243e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659396, "uuid": "94b5a0b6-d5b9-48d7-af5e-2112660e193f", "comment": "Malware payload (RemcosRAT)", "value": "80943dad82a060b3506f2312c2d282f117e08a1b16cd9f1f6fcaf852be916407", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659396, "uuid": "68cb9424-64f7-45c9-a919-2e49afb3b812", "comment": "Malware payload (RemcosRAT)", "value": "49f1a06681d1136936d42903065267f317232b4d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659396, "uuid": "c6e83d94-b98d-4c8e-916e-f232c1c8527a", "comment": "Malware payload (RemcosRAT)", "value": "5ad119616b3d78ceb6085cddd712023f94d4bf6cd0a100839703ac460c2520317048150360790a37d3c5898136e31811", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659396, "uuid": "95877b0b-2fbd-4511-8f28-15e57d45b162", "value": "T11605F13AFAE7A8D0C31833A091FA2A3E109CCF47B66D59D889AD7C631C44D159B3754E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659396, "uuid": "5ff45516-7b08-422a-b646-7662c6b1ee1f", "value": "12288:oP1DGeNUZdV4XSwuP3U4oRLPPnuQHO8MfvFHi+WJpW3fFLBmtK/bzeHqCA3+9y:o2dVN5kBRTPrUi+WJMnmGbzetA3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761659396, "uuid": "c8eb987a-9978-42e7-9508-98e530b1e349", "value": 797075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761659396, "uuid": "89aeb2b8-c559-45fe-b208-ec666ceb0521", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659396, "uuid": "2154a473-12b0-4ab9-96d6-48fe17bef1aa", "value": "SWIFT_M18636902_28102025_PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f0be1a-b3e7-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761646706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646706, "uuid": "2eb63e90-0235-45ee-b271-cfc2f27bfab3", "comment": "Malware payload (AsyncRAT)", "value": "6fcc78ed7a692483f151ff8798a5d4e2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646706, "uuid": "cab5b49a-8497-43b6-a210-dd338bf43214", "comment": "Malware payload (AsyncRAT)", "value": "80ba25ee75d1be0dae2c72debaf232aa745980beab0789918eb7d6e125867514", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646706, "uuid": "e6a8206c-83ae-4f2a-9be5-b517c8694f0c", "comment": "Malware payload (AsyncRAT)", "value": "91a6ede9cdd4b0572e2b8eb6931e65da16a8a296", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646706, "uuid": "6ae45f99-927b-41b1-bab6-811b63839832", "comment": "Malware payload (AsyncRAT)", "value": "53474b24e77765fbb5a0b249fe3c0c0127a9c8946c1f08d576c1a02d0687d3df12051bc70a21d17c37c4166960ddc4e4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646706, "uuid": "b86a8798-51bf-4a73-9536-fbd2b3cb5a72", "value": "T169E412185399E61AD6B527B02DB1E2361BBA3CA9E830C3075FE57CEBB5A1F108D50353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646706, "uuid": "64410050-da0f-467e-9c7c-2615863e7a8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646706, "uuid": "680021a1-348e-43ed-be0b-b66c4630f91a", "value": "12288:UQiUl/0iCxm0U4V9ZqnMG92r2oX2kenhVE6IHLm8FAJlpKkR:UQz/0U4VenMG92tX2zAFAJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646706, "uuid": "7371f633-6643-491a-b2e6-e2cbfbe58616", "value": 721416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646706, "uuid": "8e1fff19-fead-4a60-9f65-91637d9dd812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646706, "uuid": "f4a0d497-c9bd-4b20-8abc-19d6881213e6", "value": "SecuriteInfo.com.Trojan.PackedNET.3148.30583.3493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4dfd98-b445-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761686910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761686910, "uuid": "1c461410-8d2f-4659-b370-b4a6ad2b8255", "comment": "Malware payload", "value": "38f16b1705af72c1f4bd0da77f6ca747", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761686910, "uuid": "d81d48d4-9410-4718-9116-08986f64f8d5", "comment": "Malware payload", "value": "80ec9992a61fa47f222ed879bd7f948d321e27517ce3c08231e48127ac6dca39", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761686910, "uuid": "a5384d32-0a51-4cb8-9201-dc0bd8a280db", "comment": "Malware payload", "value": "6573e457235e0f0056da7927f8e295d72a6a1042", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761686910, "uuid": "b41db803-ac1a-4af2-994a-f532d9801b42", "comment": "Malware payload", "value": "59d98f52b68dd211613f17b2decba462492f63a678ce3c7a6a388513bf59bec048527fd09321209d2d0d70d0dbb8f26b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761686910, "uuid": "23507e35-ddf2-4119-95e5-39139a3802e2", "value": "T157661203F78E492ECDD2BA7819A313716619ACEC1910928F4902F718BEB36D95F25FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761686910, "uuid": "28b8fc39-a73b-4ede-96a0-e39b0c6722dd", "value": "98304:awRRbOLnAJYTccylYER2a6xHN/ALEPABQzJq179RBr8uP5SN9e+hX9OaFFBix:D8nAxccYERsHyOIQzJ88uIRN9OCIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761686910, "uuid": "4877011b-ad5e-4d88-81f4-7d3602c25eeb", "value": 7111876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761686910, "uuid": "429121ba-fc9f-40e0-a153-d068bf0954a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761686910, "uuid": "3f7782b0-bb9e-4f85-b8ef-e528e53234fd", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8816fad0-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761636437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636437, "uuid": "0984f3bf-2059-46ac-afab-50605fea0b57", "comment": "Malware payload (AgentTesla)", "value": "e76fb5b485d0a48f029eb9232e516a81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636437, "uuid": "99e08dad-b3c4-4865-9416-e8f4b751a8ab", "comment": "Malware payload (AgentTesla)", "value": "810223dfaf7d4fed4cdcdc1df44baf374b2b347f39cb0de6d8ff6cf341f481c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636437, "uuid": "90fe8915-ea06-4dd2-99d1-5568183c8871", "comment": "Malware payload (AgentTesla)", "value": "127e642a55c24eaad97b1f7ee61607c43d41b06e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636437, "uuid": "84126372-890e-478d-9a0d-b3c8b53efae9", "comment": "Malware payload (AgentTesla)", "value": "306b2c409bfdb3d8244342ddd535d8e479bc17f9bf32514cadad970b36a485bed5fbac3911ba9091654df1dfcd0227d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636437, "uuid": "a1f2f27b-c25f-4598-9d69-936913f86b86", "value": "T1BEF24AA0EF120E755E0746A1BCE54761CCACC624043BB0E0F5DE939992145EC97FE7AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636437, "uuid": "6caeafa5-74f6-4946-adef-7edf66cc6e7e", "value": "768:NYWWG+HnpBKsDIWWaWWGKWWGsNxWqdJgDl4L:NWHr53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636437, "uuid": "146950ae-948c-457b-a55e-73b5af076c9c", "value": 34987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636437, "uuid": "c0ebec77-b47f-4a56-8457-c92317eba2db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636437, "uuid": "2a7691ee-c7c8-455a-9afd-69582849a2b4", "value": "2025-10-28-0753.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea2106b-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656607, "uuid": "d3d0d346-d76d-4263-bd03-3568779c4325", "comment": "Malware payload (Rhadamanthys)", "value": "270ed935866c26deba0828dc234cdfb6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656607, "uuid": "d684deb7-d08f-43c5-81e4-d333f6c117e5", "comment": "Malware payload (Rhadamanthys)", "value": "82e749ec436d405ba8d22e837d5fd79a68ecfbac4e9d2e6f10912e345ce014f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656607, "uuid": "7221c5b4-b100-4ea5-b611-45d142fe4dff", "comment": "Malware payload (Rhadamanthys)", "value": "fdf45d5eb3418a43a2fc864c8eefd6a221efbf30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656607, "uuid": "35d57101-5c11-4066-a3a6-9aa77d289253", "comment": "Malware payload (Rhadamanthys)", "value": "f5a1af82ec8896fa8a29ac89868b318fefab73edb01305c1b90944913e71425de96692ed0bc3311e67b95b15b5ab38f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656607, "uuid": "dc7e7a12-c462-4306-9265-9559b088e26b", "value": "T1EEA30B1CDD1628FC9347AC4DD47D54B48859FD89B6123486923AE7AA60EC3362C7F1CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656607, "uuid": "0fcbf1fd-291a-415e-bd43-f77441cd00f2", "value": "768:GDhd0i7J4sYKgY/CMNfWd9rXUerECUaHuBNW9cBAflqCSLAuAAroQW+FF+Ec+0FY:GDB7eKg209rvrECUrbAf8C6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656607, "uuid": "d54f1096-41d4-4f0f-b5e8-8895ecad9cc4", "value": 105395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656607, "uuid": "e23bbaa3-e623-4bab-aec2-01e246f76f57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656607, "uuid": "c2024f89-f910-4225-8ca3-b33cd8b0b0b0", "value": "invoice-1637482117.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d0b384-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761646410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646410, "uuid": "a91f5b25-8b78-4aa3-a01f-51b731f63b73", "comment": "Malware payload (SnakeKeylogger)", "value": "4ab35a0a970d1bf20c61b7e4c8565d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646410, "uuid": "2becd5c0-315b-4531-a6d5-7741701d3da3", "comment": "Malware payload (SnakeKeylogger)", "value": "82f094de7b631023f32fc72b7ec9a0313a65b15d947610cf0e536fba6437a59d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646410, "uuid": "0945ac39-f6d3-454a-a688-43731c6c6a29", "comment": "Malware payload (SnakeKeylogger)", "value": "36ff390c7b00c196046ead276f578d9f508baada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646410, "uuid": "1712a7ed-2ed7-4676-8082-73de8b533531", "comment": "Malware payload (SnakeKeylogger)", "value": "56c8c16e0401acc2a9c59446bfec03512c60c6fea08b2cd8687034e01f1eb749a687e9596a22531c4ec7c474b4f91c71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646410, "uuid": "f03147dd-cc01-4739-aec6-e1a25d3da54b", "value": "T1DDD4F1456B2EEF22E9A25BF50970E3B113B49D4CA820E2174FEA7CDB7079F552918703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646410, "uuid": "e2a35f2b-2131-48ae-8656-7497cd91d7af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646410, "uuid": "4711793e-fc31-4dd3-914d-08794ec51a6e", "value": "12288:qqf77Cn9SbACZ2nOuKYNc2kGbO3RvFbINNjfXZ1bV1/8v:qqf77C9OY/K+b9NNV1he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646410, "uuid": "b74da951-0fce-4110-8985-56e96208420d", "value": 634800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646410, "uuid": "946a2197-0d48-4e54-82ec-0d545462305a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646410, "uuid": "07eada65-a917-4d58-9c79-8efc548bc7d5", "value": "inquire.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb626a1-b411-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1761664716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664716, "uuid": "a1b3edd3-11a0-43c5-8f7e-d44e788b3526", "comment": "Malware payload (LummaStealer)", "value": "5270bfa8ba8b8af8348cf4dee987897a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664716, "uuid": "4a917c6e-b1f9-4e10-b73a-2fe816379e16", "comment": "Malware payload (LummaStealer)", "value": "82f29ef6211e1a68c3e97118aa3d1a6e2ebbb879cf1e04b720b7becaa73ee8cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664716, "uuid": "52623351-b713-430c-857e-43035164f2b5", "comment": "Malware payload (LummaStealer)", "value": "2e31261ec07359464d67b8eb0fc2301732bc9d9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664716, "uuid": "23a73921-4ea8-4841-8186-d7618661f29e", "comment": "Malware payload (LummaStealer)", "value": "c84cce038d8d89bd4ee1b2cf7ca3f085dccc3cbbc71e95bf6d9a3d02d0efa27faf417dcbf9948467336fa4ed664a8dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664716, "uuid": "5777a850-6519-4f73-89e8-2fc5870ddd90", "value": "T10335232E67DA24F9C17447B8C8F14143A672B4D02B76A3FF229894391F336D4B232B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664716, "uuid": "e3a261f3-34aa-4cfa-be92-af28653a436b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664716, "uuid": "dde46328-8af8-4554-a3c9-ccff10254fe4", "value": "24576:fj0oUW7LnM4yzxNbWsw/IBdhqkNGPBcARjCLyBm1zte6mOU:fjcW7Lwbeg9a2ARjCOWeXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761664716, "uuid": "afbc8f6b-9343-4b3f-b3b4-6ab4cd42c6fc", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761664716, "uuid": "0f906b22-1ccf-4b87-acde-442fb5d9e096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664716, "uuid": "0c62b85f-985a-4fa8-9b5f-e0173977d7df", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8daa1da6-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656632, "uuid": "b1256ba2-9c3a-48ad-89d5-7d120cbc99f6", "comment": "Malware payload (Rhadamanthys)", "value": "7a3e1240bd02bab2b2f5cee7903b4ccb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656632, "uuid": "b42bd26d-78a4-48a4-ab20-2a963cb218da", "comment": "Malware payload (Rhadamanthys)", "value": "834abd4123a1df97af27c7d0bbd1a7859ade4ea7736bd8f9ac81e1f230b34dec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656632, "uuid": "a6c781b6-760e-4793-9bb3-d72075abcb31", "comment": "Malware payload (Rhadamanthys)", "value": "06cefc0de5e3469218efb0e73c9c911a6ae103eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656632, "uuid": "08ec827f-f41a-4711-8c17-a8c21bde58ed", "comment": "Malware payload (Rhadamanthys)", "value": "7b485a85b32b2c8111d11abc9372d9b77554544c9444ebff4a85b72e05e25dfa8449ade3b99224b6610221ce97269bc4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656632, "uuid": "affde432-9ff4-4763-9bd6-e0dc6258d35d", "value": "T120A318937E123E63D582F3C469D608BC937B92369902659387CBF372520A1DE9D066CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656632, "uuid": "c46f271e-538d-4d2d-a047-bef6c177feda", "value": "3072:GDB7b0awAMbpZMnp+0ZqdwAlMrSu8uKBrLwU59+NLhaVbkrtWka9ma2n7uiSSRZn:0ZwAMbpZMnp+0ZqdwAlMrSu8uKBrLwUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656632, "uuid": "26fa16b8-b33a-4081-9fa6-b1b7c37cc0e5", "value": 101990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656632, "uuid": "250cf200-1b45-4285-a1eb-11ca5c19f5a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656632, "uuid": "90417a02-63bd-4faa-b00c-a6d1456f053f", "value": "invoice-1637482117.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5af6f8-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656716, "uuid": "ff699a08-7bba-4c77-bfb6-f362d776708f", "comment": "Malware payload (Rhadamanthys)", "value": "9002cdb0b83b6e3d0eb6fee9f754bdd2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656716, "uuid": "dbec4500-4fef-47ea-8ef1-e7c59bfc288f", "comment": "Malware payload (Rhadamanthys)", "value": "847f07418a5e5c1ae9f2c33abc4cd895cdee171f9c485d02ed9eb1ae45efdb88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656716, "uuid": "54c7c3fd-4848-4bf7-8c1b-422c5403cc3a", "comment": "Malware payload (Rhadamanthys)", "value": "686e0c9efbd28bf9fe76705f6f635f6e7c81ffa9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656716, "uuid": "96b415c1-3c90-4c74-9eb6-a87179e41cb2", "comment": "Malware payload (Rhadamanthys)", "value": "bc815526764adee7c0a7f7bf604693954a95b6086a4922fc5cf8f7afc9e72e10080863638099dc8137e449fe6b3cdc90", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656716, "uuid": "53d3d9e0-84e3-4344-91fd-4ac4042d2aed", "value": "T1BFA3F9010FA9DCBE0146317395A6A6FDC09FC6D6018F3769EE1BBBA358D975A90207C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656716, "uuid": "9bb1914b-e0eb-4092-8d41-21b9e8f9d73c", "value": "768:GDhd0i7J4sYKgY/CMNfWdkpFbmwmXrX++rGwSmBKmNHWoEkmHmomTAam1memN1Sa:GDB7eKg20JrHrGwzOmA6Mx6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656716, "uuid": "79e13a04-9d04-4d6a-959e-56b8f9c9f5db", "value": 98824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656716, "uuid": "0d925990-f346-4504-b2e3-bed549e090a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656716, "uuid": "c84a5427-b98e-417f-92af-44e3c3325e6c", "value": "invoice-1637482117.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31751a43-b3d1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761637150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637150, "uuid": "589d5285-c5bb-417a-b878-2acbdde414d4", "comment": "Malware payload (Mirai)", "value": "91558e70b0215ffe8fd8102f567f4418", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637150, "uuid": "17b72b36-ba09-4340-8096-5cb315e6c0ba", "comment": "Malware payload (Mirai)", "value": "84fc241f8605e10f4305b285ca5f0c8662bf56d0a399e5080dc2c2bba898fd62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637150, "uuid": "81445406-7a03-4bed-948d-27c86fad6fa7", "comment": "Malware payload (Mirai)", "value": "535121c8f18099dc53401724c6ecd3da1fab8e81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637150, "uuid": "e038f438-0faa-41e5-a0d2-646798c099f3", "comment": "Malware payload (Mirai)", "value": "28c9c5d885f2a03a38ae5cc3ac2990d81f8007bddf8f37804dafd3d5213cbbec72c89f6ff48ce7d09b4c4386dfb4ebc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637150, "uuid": "0545fcbf-9b0b-4359-9170-89e607ee7d57", "value": "T1C9B31816BC829B16C6C512BAFE1E118E331327BCE3DE72139D246F31378B55B0A7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637150, "uuid": "5f17197f-2dc6-477d-88e3-a03d3b167f0c", "value": "3072:r/9WtC2Pt4iCMygBvLp3Th7oPaE47ytr/ClDn:r/98C2Pt4dMygBjp3d7GaLrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761637150, "uuid": "d745b23b-576a-47e3-b15c-f3ef6eb41502", "value": 108004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761637150, "uuid": "743a96a2-fdc3-4541-875a-42c947e7cfeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637150, "uuid": "edde299c-99d7-4dbb-b0ef-e194c8d4e69d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f425b1a0-b410-11f0-91c6-42010a9c0006", "comment": "Malware payload (LodaRAT)", "timestamp": 1761664535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664535, "uuid": "3f198ace-90f5-4795-b667-edd52cf6e393", "comment": "Malware payload (LodaRAT)", "value": "7ac553830af69681b62fc96df8b2153f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664535, "uuid": "23fda7df-dab1-49bd-bc87-865f8592885a", "comment": "Malware payload (LodaRAT)", "value": "8515112cb49c06b8db272cf4cf17046b2b915e3092a37d1cbf1ddb01def86f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664535, "uuid": "862bdc16-fd2c-4770-9160-243bf31a77d2", "comment": "Malware payload (LodaRAT)", "value": "f4fb44ab4d428b7ed479fb95bb3b7c92497a5bdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664535, "uuid": "3b848af5-b969-41f9-afda-40739365c6a1", "comment": "Malware payload (LodaRAT)", "value": "e292664c578f456946e9c1985db7dcdc91a78160c3279d65e61c323ab0d03c25c70fa2b751caae949a93beb935ad2285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664535, "uuid": "8bf4c2f1-9a68-43f7-9cf0-ad9ede04386f", "value": "T1BF35E122F5C69036C2B323B19E7EF769963D69360336D1D727C82E355EA04416B3A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664535, "uuid": "a3bc8f5f-dd35-4685-99d8-a8f24cd6242d", "value": "a46a46b6741b96758ff5cf06d0c4c13c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664535, "uuid": "c05e4dec-ea07-4f2f-90d0-b0183c8a6018", "value": "24576:0RmJkcoQricOIQxiZY1iarxJCXcDR1x2RhJ2pN//4IFEYbL:RJZoQrbTFZY1iaVJBxe+pN//DbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761664535, "uuid": "16683fd2-35d6-4400-940d-69982ab080a6", "value": 1137703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761664535, "uuid": "a82261a0-0fa3-4e0f-8297-76cee2f5e0d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664535, "uuid": "e452a7f1-3a69-4d56-a6e9-fe547c3e522d", "value": "Haxball Aim - OP mode - Fake ping.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2cb2b9-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654165, "uuid": "670c492d-7fa3-459d-9144-41fb544ebd55", "comment": "Malware payload", "value": "39eb841c7113544e124258e3c98e4885", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654165, "uuid": "93891b6e-ecde-4f7d-9586-a405ff34bd1e", "comment": "Malware payload", "value": "854cfee43b8e99858cb203cb1bd70fd2cac419db22e489bc5de9969012edf5a9", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654165, "uuid": "5056221c-a21d-4416-a158-a08d4c03572c", "comment": "Malware payload", "value": "cd440b599b3e9bcc79c4fbabe9d13a84de85beba", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654165, "uuid": "a6334820-0f29-4196-8dab-3e796a30edfa", "comment": "Malware payload", "value": "0f43b0c5a7f90697e0765929ca2eec286222c726cd0af9037f87a777d9fdc06257a41693398d04f4ec526229b3aa88d0", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654165, "uuid": "1fbe8463-d56f-4eb8-bc79-946341d39edc", "value": "T189A022A02200C0B822088C00C008C08220AF22A03080080BC8EA2CC0CC33B8C28EEF30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654165, "uuid": "202ac660-b8be-45cd-adff-879ad2e630cf", "value": "3:I5/3JcWt0IR6xTwWg+BBn:IRLixA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654165, "uuid": "e87de89d-30f3-4d9e-a05e-8b1a63b5189b", "value": 63, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654165, "uuid": "220085dc-94dd-47dc-9baf-396d152dffff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654165, "uuid": "b916022d-f7b7-449c-8242-7c0f6c981deb", "value": "854cfee43b8e99858cb203cb1bd70fd2cac419db22e489bc5de9969012edf5a9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2e309a-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761636205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636205, "uuid": "77185b73-dd44-4fd4-b8bd-a268b54791dc", "comment": "Malware payload (RemcosRAT)", "value": "02cee4b0848090da95da7b4ccc785fa7", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636205, "uuid": "cb6762ea-f759-47c2-89a5-14d358431b11", "comment": "Malware payload (RemcosRAT)", "value": "859de7f0b61c2ce5e61b9737583fb72a80b0219c13c200a2d0de3e0da7f38307", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636205, "uuid": "2345a82f-edc9-47bb-8161-a16240092f1e", "comment": "Malware payload (RemcosRAT)", "value": "4b9639af59854d11b9dc551b673c0d9a81299967", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636205, "uuid": "a8265348-f8f8-4052-a7e5-7dde5298e1f1", "comment": "Malware payload (RemcosRAT)", "value": "37cdce1c7db50fe56ceb8b50ca6a948e600feaa4a8e23bc38aca0878352076becfe4e51b4f137dedb4c46b9367ae0145", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636205, "uuid": "e806cda9-6891-4d46-bfb7-0b43b3a571d0", "value": "T1785612BDE1863030EC5ED4A0E79ADA3107CD9364379F5CA91AE6C6B906D250F46BC3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636205, "uuid": "64d388f8-bee6-4dfc-bab5-7828ab1423f2", "value": "192:oYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY1YYYYYYYYYYYYYYYYYYYYYYYYa:KVEwFjEwVwdgoLoUmmmmmmmmmmmmmmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636205, "uuid": "eec76dbc-9fff-4c28-b2b7-78e195bfe06c", "value": 5978880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636205, "uuid": "d4ea62b2-ca4f-4a00-b255-62563775858a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636205, "uuid": "b504abc9-435b-49a6-919b-ece3ea9839c1", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202a0a19-b3e3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1761644852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761644852, "uuid": "62c05548-340b-4214-98f6-7aa1a2889b47", "comment": "Malware payload (Phorpiex)", "value": "5dfd5e35af7d18a8d80d57792ee4ef11", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761644852, "uuid": "a38f4612-1d98-4408-afcf-f310aeafed65", "comment": "Malware payload (Phorpiex)", "value": "85bf5ff6c1f1fcfbe5cd999dd4ca71c0c26f40b624c810fab29788aa275c09cb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761644852, "uuid": "ba6cd8ed-8a54-4f3d-81c4-ece7aa2d199a", "comment": "Malware payload (Phorpiex)", "value": "81fa366aa914bab46f6689234c1bf46448076956", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761644852, "uuid": "eb3675a1-b1e5-481f-9f3f-2bdd77878ead", "comment": "Malware payload (Phorpiex)", "value": "609a5a00c1eb3c957115c43486b0961791234ff2ba323635296be141dd2a55aa23b679e177832bc5afa9bb6470d33253", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761644852, "uuid": "73cda841-bddf-4f75-84a6-99eb0ef3963d", "value": "T14BF12A0AAD928071D3EE09F417B581994B7D04532BD630FFBBB2C95A4FD42C0949267A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761644852, "uuid": "9ccd86d1-ca57-466a-92d6-7d9a56a50731", "value": "7d043fa7bcef8cef39f98c88b1875ef7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761644852, "uuid": "66c3f77f-2d71-4382-bd18-3d1c3580d83a", "value": "96:WioLDBPbdRyD3d9LT+YmAOn7UkaNOwQL7aFJxSEj2FFp3C7tCEGMuHNx:7oLDBPQJ+eUULN8aFJx3jmFpcGfHNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761644852, "uuid": "7628d972-bf1d-47b7-bc6f-1edca65050bc", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761644852, "uuid": "8daac77f-3d68-4e21-90ad-2120d65069a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761644852, "uuid": "337cc76b-967f-48cb-97ce-81c63531c5f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0113de-b3cd-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761635697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635697, "uuid": "77241cae-fd74-45ac-bf39-81341fd05549", "comment": "Malware payload (PhantomStealer)", "value": "d4287fd3c2fb687a11f958e7d07b76e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635697, "uuid": "39c5f1e1-5982-4c3d-9249-e81859c795e4", "comment": "Malware payload (PhantomStealer)", "value": "85f3a91826ed77e2a9e1d97f400b28c705280e624a837902ad4baa34a2eebc97", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635697, "uuid": "610c2d48-9993-4f43-bf49-886aeaa37b19", "comment": "Malware payload (PhantomStealer)", "value": "ab239f84036f4d2ba5f5dcd9f4141cf748129c54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635697, "uuid": "d0f8e847-36d0-440e-b144-c8d7e1270878", "comment": "Malware payload (PhantomStealer)", "value": "007802c78d0c3be8b89224a918a1e62a8d0958bc0175df434e0f4a76e9a7886ab9a7e6fcbe3275852dfd0783f60fdbbe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635697, "uuid": "903caf09-113d-4e38-aa2f-5d5ee09d5b25", "value": "T1FF254A61DC28076A8E4727EEAC904BA2C57DC649453381F5F2ED074E72068ECE37E66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635697, "uuid": "5ce20f91-a988-4e3d-9d9c-a592db8c44c5", "value": "6144:9fYclfYLf+fYRfY4zfHfYcxfYmfYif2BfbfYFfGfYIfYcvfrfYxfY0f7fYXfPfYp:Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635697, "uuid": "77d5316f-8bbf-4186-bc5c-f3436fe7a33e", "value": 1036291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635697, "uuid": "e28a8e87-fd19-4736-8515-db6bbf3a8809", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635697, "uuid": "ff66b429-5998-40c6-9aae-8c0803bcc59f", "value": "Advance_Payment_Confirmation PO-0252615028_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3728154b-b402-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761658205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658205, "uuid": "f9e4f0fe-d116-4de7-ad38-23aa6aaa07ac", "comment": "Malware payload", "value": "d7041deb63f374f99357a4107ac9fd00", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658205, "uuid": "7351b4ba-a8f8-4e34-ab58-a9247b0279ac", "comment": "Malware payload", "value": "86aea759fd01859f54a9c739fad43570c9806758176a8d5912a51fb9b31dc89b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658205, "uuid": "374a4bd1-45b7-4be6-9f69-606e563600fa", "comment": "Malware payload", "value": "c4d46f563abd7501718cef4a8ae7282b877ab24c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658205, "uuid": "c5932f9d-0351-43d6-96ec-3c843fecb8d7", "comment": "Malware payload", "value": "44c5de12d1d8986bcd4ebbba4fe81affd1642f096ff0b5e0208274882173b57f5cebe36e7237a1b01ee23f801536b2b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658205, "uuid": "26efa129-ab2d-45b9-91d5-f0388b6f609e", "value": "T1BC8212C97FC2B2B15273A0A32D1BB069F35B6D41F55CA194F278D2A0F86075CE4E6838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658205, "uuid": "bf4c9a0a-1e01-435f-9880-ab513ae69f17", "value": "192:9JscjtMIVDKgKGQkJeCkszI1H7o3tthEIxnHnvLPhbW8W/ye6IXfBW:/smt/DKjG5eCsH7o/hrHNS8XePXfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761658205, "uuid": "d0d96bef-b7d7-47e2-99b4-a7afbfe725b6", "value": 17630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761658205, "uuid": "d149df27-62d7-43c1-bd85-90433240ca38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658205, "uuid": "c75a9f09-0be2-43b8-ad21-018e6e69bf70", "value": "rNewOrder264pdf.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad51790-b431-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1761678612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678612, "uuid": "7aca29da-4b5a-4e63-bcd1-02e2d7441416", "comment": "Malware payload (RedLineStealer)", "value": "6956fde56ce2d9aea0ddcb358a485f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678612, "uuid": "ba26d37e-dbdc-4c02-846f-6b139b59e5e5", "comment": "Malware payload (RedLineStealer)", "value": "882d402a462b05dd11f46dd4792560b085dbf5b07d39f815c03b5df7c3723e31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678612, "uuid": "a3ca43a0-f532-42d4-8fcd-c15b8c4b4a64", "comment": "Malware payload (RedLineStealer)", "value": "c021b47979127cbf43f8dd7c11aa5c05cffc4945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678612, "uuid": "fb7ab5fb-79f9-4546-9c47-3801d7b86229", "comment": "Malware payload (RedLineStealer)", "value": "83c9fa466d13c7ae8655a3bb6f0d90fbb9939496fd7587de00ca7154409c1d262d12e827b806e4f989e600a90712f6b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678612, "uuid": "d2ec1df3-6f95-43c5-9332-fa8facfd9129", "value": "T156645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678612, "uuid": "9f245267-669e-4c8e-95e6-d2c652b35a90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678612, "uuid": "ae9438ee-90b3-4d49-add1-30240cd843ee", "value": "3072:+cZqf7D34qp/0+mAQkygQAQEgTLB1fA0PuTVAtkxzf3RQeqiOL2bBOA:+cZqf7DIqnyzjB1fA0GTV8kdwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761678612, "uuid": "18debe0d-fe55-4ad3-ba34-51280a211393", "value": 308500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761678612, "uuid": "b2a2a329-a186-4d70-9fae-dc426564b081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678612, "uuid": "18bee032-30cd-48aa-b041-1b857488e3aa", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3094101b-b3f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761651322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651322, "uuid": "ec339edb-7e33-4819-bfd1-57b773090291", "comment": "Malware payload (Mirai)", "value": "e1540cd9a6ef6ca0315806df7e53b22b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651322, "uuid": "3de2b216-245e-49b8-a82f-446ac1abbd2a", "comment": "Malware payload (Mirai)", "value": "88796bb337aae9ae9586472350b8deba20081e7a2cf25ff87ce89b1732804727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651322, "uuid": "e270775b-6600-4dce-a87a-2462110a98d8", "comment": "Malware payload (Mirai)", "value": "6c77e95fef9fdcc4599b6b4ebb353af0893fe85f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761651322, "uuid": "382600d0-6fe0-41a9-a662-b98098914b4d", "comment": "Malware payload (Mirai)", "value": "79989d4e051c21a39aa63f0ffee882e650d9b648833a9442f81fb0e359678d4ff72bf26999428180cf95bfab041383b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651322, "uuid": "a8d3f72a-e0b1-4169-85e2-52479476e96c", "value": "T18DF3392F248192F0FA411B746BCBD3976C290BBF51A5A0DF6B515329B6E0B7BA03C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651322, "uuid": "96235826-1065-48fb-b3be-1e53d89e7ee4", "value": "3072:K5fAvBg1472Pq1jbfsqtQbxbu6UsNNAWvoNiPLz0U55GcUVx:KCMq1P0RxA+2iEi30U5cNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761651322, "uuid": "9f2f3c9b-ea19-4e94-bca6-f3e5e3ef460a", "value": 172756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761651322, "uuid": "4a9b14c8-616d-4e57-8b5d-a9423083c9b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761651322, "uuid": "98f68b5d-9eb7-4282-871b-3d35d85950b6", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0db8cc3-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656691, "uuid": "e149ad58-1fe2-4e29-9603-c39261419d6e", "comment": "Malware payload (Rhadamanthys)", "value": "1a5acd20255a3125f0a34788d1b2253c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656691, "uuid": "a0673157-560e-4b6b-bddc-35d9e67acf6d", "comment": "Malware payload (Rhadamanthys)", "value": "88e312e5523ca20f5becd3bc647b2ff9d04dee3ae966a3e2a2ee9b0f012a4b1f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656691, "uuid": "17b9fad3-64b5-48f0-b27d-4af887e3df42", "comment": "Malware payload (Rhadamanthys)", "value": "7ca98eec2888a75ce5577d6328aaa750a132be7c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656691, "uuid": "3af53799-f6e2-4a29-af1d-5dc227d5b268", "comment": "Malware payload (Rhadamanthys)", "value": "f8935ce30751cbdd6d941bf8c9c1672b0d0a81d30dd3752bf967b4d2ed9932ad0873744b08743f66c244e9094be02957", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656691, "uuid": "d2bb50a4-cb2a-40e9-9fa2-dd30ac264b22", "value": "T118A3183AD361EDD5DC35F2514BCE5F76AA2ED502444898E8A47E3369C708BCC35BA283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656691, "uuid": "3e08cab5-be7f-4592-958b-fd192f35febf", "value": "1536:GDB7eKg20JlA/kLlwL/4o49UOIr5MqAfldFWKFR6mvpUSerfG3vrIC5fm4biHQes:GDB7b0OMtJbQh6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656691, "uuid": "62b535a4-85cc-4a79-97cc-b8e67e7dfe1f", "value": 102856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656691, "uuid": "56019b4d-4d97-4e64-8ca0-132135a3e09c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656691, "uuid": "010aabe1-63ec-49f5-81ef-6557e4751b3a", "value": "invoice-1637482117.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe7e3f6-b394-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761611210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611210, "uuid": "bafcfaf3-adc6-4ee6-833b-a46c56d5ac9e", "comment": "Malware payload", "value": "d93d8b32e93f38adc9a0446073bd88e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611210, "uuid": "466e073c-e5db-4ef4-993a-63c7e803b1da", "comment": "Malware payload", "value": "89adf15a2e8bea8f2cd8979693c41c8ad9f41883c0914bf1179bf29c576c7ad8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611210, "uuid": "f71104ab-2222-4074-a26a-9eefa6ae8929", "comment": "Malware payload", "value": "02cf48436bcbc081c4f8e9022b93c4ab2998894f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611210, "uuid": "f28fcff3-766a-4129-ae33-4b7615ec635c", "comment": "Malware payload", "value": "58928f4ccb2dacaee88c246076c2bd72c9d72900e766fa422a56aca3ef8eaa9979f767e07ee1e65ee3a39603337db465", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761611210, "uuid": "20f91ed0-9a07-4843-a2aa-8a64e52a0f43", "value": "T15C5302A407F08A9EEE08C931876DC373DD4E11E1CD56BFE2C1C960E6CA39C098C2869D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761611210, "uuid": "90691ff8-1c85-47ff-9cc3-e1c774e5a171", "value": "1536:dP8FKdH4Fgs/0+sb+dv4Nt9BvFwW1AR7rhqI6eB4AQI:dP8FKpvo0Vg4rQ7NqI6eBTQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761611210, "uuid": "16052169-fe77-40a3-970e-ef31be683b05", "value": 61852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761611210, "uuid": "162b89c7-3a51-413e-9b88-de1614d684be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761611210, "uuid": "45b75ef5-2faa-4186-98c8-6929ac838da8", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494da149-b445-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1761687012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761687012, "uuid": "6c14bbfe-afcf-452b-8ae3-fa8c9271d17b", "comment": "Malware payload (RedLineStealer)", "value": "2d3218405a7d8094e4117904fd7b9a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761687012, "uuid": "9f168dc1-29b6-45cb-b21a-89f28f062fed", "comment": "Malware payload (RedLineStealer)", "value": "8a2fecb22aeb3adcce1348ebf450f1b0d1f86ab3990ae1797dbf3bdf769c0296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761687012, "uuid": "0106fa64-018d-401b-aa83-4fd9e3ff21f9", "comment": "Malware payload (RedLineStealer)", "value": "b8b463023b8f81e3e5f0a829771e5347f03172a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761687012, "uuid": "e1290621-ee77-490c-b817-e57a1957d11d", "comment": "Malware payload (RedLineStealer)", "value": "e84205a0a2cf1655df0195e3a986ff02d7df62597a6becf6fda8a041fd2fa13797c613179e0dbb1a0d00ef73d6423aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761687012, "uuid": "4803bf1e-761d-49db-8ab1-af7df5d3de07", "value": "T1D3645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761687012, "uuid": "961e7d1c-dfdb-4d06-9f53-6de89423280e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761687012, "uuid": "7321dcce-3fa1-4a37-bbe0-4ef2aa185cd8", "value": "3072:+cZqf7D34qp/0+mAQkygQAQEgTLB1fA0PuTVAtkxzf3RQeqiOL2bBOA:+cZqf7DIqnyzjB1fA0GTV8kdwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761687012, "uuid": "d8d08a67-53c3-488e-9da8-4b5e517df057", "value": 308890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761687012, "uuid": "7ea42e5b-7caa-46f8-9d2a-d0f09c7892c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761687012, "uuid": "977b7301-cd67-4662-a501-7ee075abbd4a", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6f9c82-b415-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761666561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761666561, "uuid": "ca764331-4043-4472-8a99-db55abb5b1cd", "comment": "Malware payload", "value": "beb20f120ca2ba96ae7cf6691ecf021e", "object_relation": "md5", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761666561, "uuid": "4ef7b4ef-5013-4cf9-a1dc-e5d039f507d0", "comment": "Malware payload", "value": "8a331fa11c3b98476a1f7231db3735fff1e6b429e0e22b2b7fec0f09fefdb2ce", "object_relation": "sha256", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761666561, "uuid": "bddead99-b96c-436b-b6a4-afed978b714f", "comment": "Malware payload", "value": "5008d95fa325817160809ae1a659b0c69c94595b", "object_relation": "sha1", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761666561, "uuid": "cf7141c6-41d2-4277-817f-ea9ce9fae43a", "comment": "Malware payload", "value": "7e8a64a2f3e5d3e0907e725b24bec286c6931b5c69329f7b3e325b50a8759f89064f0df19466d9f3681bf315257551a4", "object_relation": "sha3-384", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761666561, "uuid": "0fd0e355-9389-45b9-887f-b636f10966e2", "value": "T1DF2833BBBEC94532EAEDACB49F7E1F16026D6C17945170766A20B51DDCF02E00A21CE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761666561, "uuid": "d6669c23-127a-425f-a330-37c2f226bf24", "value": "1572864:obwrn+Rw2T8xnyWpuVAjEX9wo9v42lOl2JZyxsoh88XgzaUkR30tnj:osrnmw2ITAV/5Q2uEZyxsoh8yt+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761666561, "uuid": "e8acd273-e95c-4cb0-a510-61523da0937f", "value": 97710080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761666561, "uuid": "0fcf7bee-cae6-448b-8e02-1c532791111a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761666561, "uuid": "8f8c725e-aa0f-47e3-95cd-a27dc6a11165", "value": "LauncherSword Installation Wizard 1.1.7.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f9eff1-b41e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1761670362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670362, "uuid": "85896b59-1ec0-4408-b8c3-9fb495a492ca", "comment": "Malware payload (RustyStealer)", "value": "064b24fe26d0b13ab66aec35042ad5d7", "object_relation": "md5", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670362, "uuid": "633c53d9-b2e3-480d-b271-3aec7a8007d0", "comment": "Malware payload (RustyStealer)", "value": "8acfc35ce2d1e0ae44a9a322eccb42f82e8ffa0152ac19695442dca800367844", "object_relation": "sha256", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670362, "uuid": "bd77f633-d592-4034-8547-de4bfb5f85bf", "comment": "Malware payload (RustyStealer)", "value": "4ee2857c80f865c0d1b98299e09ef74d2090a025", "object_relation": "sha1", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670362, "uuid": "22618632-6e76-4eb2-92fc-7df5ef0bb5c1", "comment": "Malware payload (RustyStealer)", "value": "2716999c03d0cb5dc90bcb1cdef491161b9a204c34e184ff39bc04bd44890e6a4f8ee7739c39ede45eaa9fcbcb51983f", "object_relation": "sha3-384", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670362, "uuid": "5d903386-c5ce-4b5a-a8bb-0d1904897b1d", "value": "T167182347F1A612B4C12BC2B593165523EF72B458023A62BE92F887603F87B50D73FB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670362, "uuid": "d0792499-86a6-43d3-a754-a96e729d4d15", "value": "01a702faea615deb8afd2e16c4beb983", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670362, "uuid": "1f5c41ab-1e04-4584-9bf4-b1d8b635388e", "value": "1572864:TEy7PX7ibWr0L/k71lMoRB9ktxBpo3MhBGUhXRS4XSJB4Gn0fXt8wrE:Yy+Wr0L/kZzKxBi8hEUhBS4XOl0fXtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761670362, "uuid": "8bc46058-b5b4-4418-a5d3-f841b5ee981a", "value": 89654632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761670362, "uuid": "05a5fdfa-c696-4b31-a8f3-63f81920002c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670362, "uuid": "e326c3a8-63b6-4aa0-b97a-fbd228593572", "value": "atlas_browser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587b5c9c-b3e9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761647524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647524, "uuid": "f7fd1e15-1955-474a-88b7-35a8cff25d41", "comment": "Malware payload", "value": "7413e9e6bec8f505e1b5060f41c24082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647524, "uuid": "66600631-4d43-404f-867c-c2de22897e6f", "comment": "Malware payload", "value": "8afdcb80b64d813c4b71dbb290baabbc1edafd0885a76a15eabe96fba81466a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647524, "uuid": "4904508c-b757-4e15-a4e6-e20375f8d341", "comment": "Malware payload", "value": "ec6bb10475cfefaa58f68d8a2adb502f9b340491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647524, "uuid": "8643a3cf-70c6-48bd-a72e-5780acb5b43d", "comment": "Malware payload", "value": "763dac1c388a7ad0630eb6cdf9e642254cf06a6c9495b224817a34326dc50d3828e375f171bc79bff18bcf664c835248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647524, "uuid": "568d76e9-365f-45df-a62b-576f35618fc9", "value": "T1C5C69D1173F89A2AD1AF9B75A070803543B1FD06B262EB5E2548B4ED1F73BD08D1276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647524, "uuid": "89302444-4dec-4d12-8a66-b1ee0a632da7", "value": "bb3ac2c21e02c68abcad237dc3fa6d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647524, "uuid": "2e03e2cb-2ad3-45d6-a60a-cd10e915365c", "value": "98304:t9VvIFGFv2JtGN6T9VLh35A7iOBgNCpjpIo49iEPRaCyQqt817Yxh8nrccGS:lIFGFeJtrd5uBeCFpVoYQMC7Yxh8nrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647524, "uuid": "ea7ac4a7-6246-433a-8e88-69a1200e6ba9", "value": 12239075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647524, "uuid": "6b142891-0c46-41bb-abef-a18f6a45b30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647524, "uuid": "b81b333e-a052-446a-9b13-fc160b269535", "value": "PCL2_CE_Release_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f18c2b-b3ba-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761627607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761627607, "uuid": "66d826a5-5649-427a-a543-7f351313d77c", "comment": "Malware payload (AgentTesla)", "value": "3e6a0bea63b5bb056633899f28b050e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761627607, "uuid": "883eadee-4855-46f4-88a6-6951c1903599", "comment": "Malware payload (AgentTesla)", "value": "8afee6207b66f7fb9e4fa53ce121fe4be8dd62fbf1395c746bb0ae0098d4cee3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761627607, "uuid": "c1cb8efd-ac69-46f3-9339-2c61fd379250", "comment": "Malware payload (AgentTesla)", "value": "7ccf5257a5ba6b4c53c0676a9964f42f2eb29e51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761627607, "uuid": "cfaac7f8-e452-4a6f-aaac-577414dad3f7", "comment": "Malware payload (AgentTesla)", "value": "c2598cd0c44bc858fde54f810f55732f2f47218c27616d5bf326a9c4b6299064b335b02adb31759d51cba8818654e7b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761627607, "uuid": "8b90d925-c9f3-4a15-9682-1990e839cce5", "value": "T12022BE85DF9DD32F068E71AA23674ACDE43EFC2690A2DADCDA56436480321D94383016", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761627607, "uuid": "46a26cfd-42f2-440d-90ef-9e783b42fa26", "value": "192:gTek88BiOwnvgax0MacFDoIVZ+H29AOLrAkbCrRY9+BHI8JlrpRNE7Fv+vcvDx5N:gyk88QOl87acl7T9AOfAkutM+pIKlrHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761627607, "uuid": "070db2c1-73ef-46b9-9356-850189034d2b", "value": 10347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761627607, "uuid": "7ba3b528-3ace-47cb-9d20-d3ee320213f3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761627607, "uuid": "1aa473dc-3253-4f6c-8c22-0475e21ae14b", "value": "n2025-10-28-0753.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64985825-b42e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761677179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677179, "uuid": "f33be14d-926f-4150-971f-efa80c921c3b", "comment": "Malware payload", "value": "74b9176a834d5b0e0095fa8c10e248a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677179, "uuid": "2a697f91-6819-41a1-a7d6-b69ccd8c91bb", "comment": "Malware payload", "value": "8b6b8ba081404337f3f6cbd2c633843c4a5db2b0bfbef37751dce5c4f2850c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677179, "uuid": "71289588-cb23-4857-8f64-63f1654bdbfc", "comment": "Malware payload", "value": "a7e80dbf594223cec6fd94caae9bfd24fd55b83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677179, "uuid": "c6e9298f-e36a-431e-ba88-8360950cf009", "comment": "Malware payload", "value": "89590a39dca24f1d9ad871f16054934ce7c0010a045198d3e40ab3e8651acd4dbf258763dbfb3e1a2b384866a16f9309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677179, "uuid": "5dd88224-20b3-4d7a-9b68-9d95aa8ba0c6", "value": "T11091C81A9BD8533BD87A07705FB357121BB4E514961787AF39C8621FBCA778408936F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677179, "uuid": "bd9c3434-e468-48db-b19b-06d293d14979", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677179, "uuid": "c5bfde8e-9742-415c-9725-e463b6800f4b", "value": "48:6UGTuaQbYyIHDhZYj4KhYJwILLbmAVmv14u4OulOb7q8pfbNtm:auaeYyI9Zhcx+eAoN4uugbpzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761677179, "uuid": "8fff0b83-9646-46da-b020-2ab2574fca52", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761677179, "uuid": "e58d249f-8610-417d-b916-dca4fd28027a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677179, "uuid": "b023cb26-94f0-4e0e-b87e-3ea0e170c361", "value": "gta-prison-mod-0.6-installer_7f-PyZ1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9e57f2-b426-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761673866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673866, "uuid": "c88899a3-baf5-47a3-8aa8-af62ca1f3172", "comment": "Malware payload (Mirai)", "value": "298b7e8679d1d17763031093c6105573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673866, "uuid": "fb4fdd14-04be-4f97-8563-2bef3b72231a", "comment": "Malware payload (Mirai)", "value": "8baceab3c5fc2c2f0a922f885af62a5d04d55c2417881308252f80f89e7c41ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673866, "uuid": "f041c64f-d355-4816-aba2-1abca6585797", "comment": "Malware payload (Mirai)", "value": "54012bd30bc3433e103127d51387aec03b36a393", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673866, "uuid": "47817561-29e3-43b4-8092-ec32928a7a28", "comment": "Malware payload (Mirai)", "value": "2c4cdf4cf5eeab15c10b8fbc2e6fe6e6507fe83e323928a5199e46e4529e18be92d6d634de79f4dbb79ca213ceb6c1c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673866, "uuid": "b420a2e7-a297-422e-834a-fcf4f1432188", "value": "T1CA146B2BB3C3ACDAC51067308C316362776FD7041918EAFFDA173790AA977625A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673866, "uuid": "8fd46f59-65bf-4102-b253-415ff37cdb44", "value": "6144:KhROm5150z/Mmr5XN/kzHy3fBtLHO7IKTtXs:3z/LVkzu5dO7Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761673866, "uuid": "6f10d126-3e1f-4554-9d7c-e7adab14e018", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761673866, "uuid": "b6116fb7-7b8e-4f98-a643-a35fb7bdb146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673866, "uuid": "25d54eb7-4a86-4f23-a7ae-cdd15f79c039", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29131c0c-b3fa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654746, "uuid": "10d958f0-6317-4f51-9ca3-332437a04e19", "comment": "Malware payload", "value": "ca1d1df87c8582d738c99cf37187b8db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654746, "uuid": "8ac8d7f7-ee6c-4c11-9702-ba5ba69b1f93", "comment": "Malware payload", "value": "8cb41f9bf30674566cf76ab7ff365abb0b90eac4c513d881581d0153d8e1ca56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654746, "uuid": "c8644490-786f-4e08-b2a9-02c50b6e694b", "comment": "Malware payload", "value": "9dc8122a4f6683356ddbd0ced567b1c70ca27736", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654746, "uuid": "fe86d55a-b99d-4b8e-83f6-911cd0d94689", "comment": "Malware payload", "value": "6e0130780318809738213961e277f16acc9840979a52cc42c16321c2b252e1ca102f1eaa2c446f9f87961af1a2962b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654746, "uuid": "5c3a5b8f-f99f-40a4-b570-f539624aa62d", "value": "T1336302974113A984CB5A993685AB3127D2738FE0C37E64F3BE9735DA4C4303D8347A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654746, "uuid": "ca049d8f-84ed-4834-a9d0-f425654eb668", "value": "1536:pmwdM32e0tFzcBYyna2H3sZX2K7NRGjVLSor9:pmK8utFzAYyVch2K5RGJLSS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654746, "uuid": "e6032592-d975-43f0-afec-c02310c82a55", "value": 70584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654746, "uuid": "391a56e7-1e80-446d-ae3d-38dd09cef64d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654746, "uuid": "549be612-c979-45ee-a2d2-069df58075d4", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92078d7-b436-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761680784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680784, "uuid": "fb42205f-b6ea-4601-bf08-0f4a7e869abe", "comment": "Malware payload", "value": "8516599e2f9ee73d14b198f3572f4c5b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680784, "uuid": "5ef7e1e7-3b50-445e-b974-726db0ffcf62", "comment": "Malware payload", "value": "8d76b0239943993c1efeca08022690d895d79010a304305a570a2827102aa241", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680784, "uuid": "a4264800-c9d7-4e04-bd8d-9f35f1b6027d", "comment": "Malware payload", "value": "d80be54f6f7b27e9ecd4f4b32fe662dd163391ab", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680784, "uuid": "a4889b5b-96f8-4b76-8f29-c1d607f0b6ec", "comment": "Malware payload", "value": "de8162f8b0e9f4eed909340a46f2f864da5482c92470846ddaaeb474b2ee1213a205f80c65a43683a1184d2330290fe1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680784, "uuid": "d63fc0fd-ac6e-4470-b5e7-7a2afaac2c14", "value": "T11721B710BBE94B24F3F60E71447B77784B77F806AD628B2E00A902891C71A45AD29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680784, "uuid": "c89097f3-7297-4886-8768-b7e43af1d825", "value": "24:8sJ2DmM/3cjc8UBY5gAIvm6wYWDv3+/x/dp+RlnFNlvD9WYqVK4OJOOJ2y+cImf:8s0DmMfcw8UBO3YOnv2/dADvTWBcpBGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761680784, "uuid": "ebd0c6b0-b3fb-48fa-9728-75da9302fa35", "value": 1300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761680784, "uuid": "294df15a-af5f-4c1a-bdf2-e1c3093387f1", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680784, "uuid": "2c396ad3-3558-4eca-9408-1306b1a9d19b", "value": "Bestellung_4089207_pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a4f8ea-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636110, "uuid": "220433af-168b-4029-8e5d-b6bee815feb7", "comment": "Malware payload", "value": "9b3a04e3b974ad41d3feb3963f366a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636110, "uuid": "2e8adfbe-afbb-407a-937f-ca6ef05d762f", "comment": "Malware payload", "value": "8dc36c2e44073c1b3e62853ed28040ef4d848e18fbc482a5d165fc272ce5363c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636110, "uuid": "5c1cf938-353c-4c6a-9cf9-7d374f724ce3", "comment": "Malware payload", "value": "591eed845d4bebd206a17d2cbb174335e997d177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636110, "uuid": "8938f669-cf4a-4360-ac16-cd18322ffb97", "comment": "Malware payload", "value": "dcb3c370dc47dd21734f4a5e157c88bb1a6eaaa10abffdee33f88abfa39a8045c58eab37b07ca5ff80e69ce35775fb2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636110, "uuid": "2dab58d0-a8c6-413e-ba07-74c9ada1ed8e", "value": "T1E1F522A46C8A4FF8E01FDB30B052051CB27F37B09A79692D5F48D9694EE64E12E721DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636110, "uuid": "132f4dcb-63bf-4506-9199-272e8e347be0", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636110, "uuid": "bf5d29a1-003f-49b3-85f7-40682e1837b1", "value": "49152:XdKceBN8EF9kgJjJ3y91O5577FaaYb0ajUTpAZ8h6+OY9sKkQbyMiLj+Eswlb9CS:s7FRj9yG75atb0OabRpmKkQbej+RqCRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636110, "uuid": "0b9f8d87-fb73-4eee-b765-2fbe9214f811", "value": 3598768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636110, "uuid": "f98b6bcf-24c7-4793-81b2-7910969fe3cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636110, "uuid": "bb2be584-3941-4dff-a924-c93ea6b9e770", "value": "8GVk01wwWXHHto7BJ1pwBajM8YOnUuQf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a625081-b3cc-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761635018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635018, "uuid": "0cbdf4b4-3d55-46ed-ba06-70313c8e75d0", "comment": "Malware payload (RemcosRAT)", "value": "26b4aebadd367e5ff3e8753269e00e9e", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635018, "uuid": "05f7babb-6354-415d-a3f3-e63f6638123a", "comment": "Malware payload (RemcosRAT)", "value": "8e7320ec997f204bc6392f20d774d2ee663edd326982251d7536896627faf8d7", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635018, "uuid": "509194e6-65c4-4a8f-8c49-3a99b5c1ab0a", "comment": "Malware payload (RemcosRAT)", "value": "8c2a28e21b6ef5d5ded92b58cd849662d893b30c", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635018, "uuid": "91baf2e6-1904-4b54-8ef8-3dd674fb458c", "comment": "Malware payload (RemcosRAT)", "value": "c5fcaae107ec969f1873a2484556ea899b00087775ab0ee04ff1ef845b1f0bfa3a40a54667ec2ca0726146373f8995cb", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635018, "uuid": "be2b6c2d-22a6-49ba-af57-1867ee41bd5e", "value": "T14A55AF62FB7D791D1904178F40E47DC582E188A3E6A3C5BEDCDB814EA477AC6F100ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635018, "uuid": "b2112843-1562-4edb-9fd2-884a0b9903b2", "value": "24576:UEt0blK/aUT216pIV07IZ2bq+/luzQdxp:t0bWNkcbq+hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635018, "uuid": "91370dbe-e8aa-4cb9-9edd-0a9f36ad74c6", "value": 1349302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635018, "uuid": "da64047a-c116-406f-8914-e48425153e15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635018, "uuid": "5d3bac05-a348-44e4-8e5d-fa5dbd56a346", "value": "October Price.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a170f4c2-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761640345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640345, "uuid": "24ad2700-5f6e-4a85-a420-d67e9e8ac55a", "comment": "Malware payload (AgentTesla)", "value": "8bd3b2235841710ff9650f7b61b1bb5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640345, "uuid": "c8c2c6e7-cc12-491a-a66d-b69812d52426", "comment": "Malware payload (AgentTesla)", "value": "8e7b5900789ddf8e2145e8e838b5d4b459eff2fafd0ef8ea28a4ba0bcf7e2ff9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640345, "uuid": "fbd7b1d8-2a67-4e34-815b-1eca1544f53b", "comment": "Malware payload (AgentTesla)", "value": "280ceee5cd06dc499f9b9951701fdcddbfde8901", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640345, "uuid": "2de77e00-cafb-477f-89de-bfb69c74e065", "comment": "Malware payload (AgentTesla)", "value": "dd580a34f0ea3355a9204233409e9b667b7e97c27523a8663709d1f71602a4570744e0fbd551a9eadae8d12bfdbf028c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640345, "uuid": "eee03b64-1085-4141-b15d-6c00ed66ab00", "value": "T15345021089842FB9CFBC591D80FE161E93F04B8E4526B44AFB2BBE46AFF7448511B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640345, "uuid": "738843d0-c6fd-4374-a77c-6cb77e3afe67", "value": "24576:7612tufgk/35T62o81u5ntHCRCtOGctyYQVh2M+twA0c6zeZ:vi3Do8GFR+Mi0c6iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640345, "uuid": "9d427770-a1e4-4935-b62a-2440c5927482", "value": 1237799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640345, "uuid": "5c84b0f0-d5fe-4162-9fde-7ed81d065dd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640345, "uuid": "b41bf5a9-509d-4cc5-b5d6-e3b3e6a6e489", "value": "0990987676665.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfdafd5-b3ea-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761647852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647852, "uuid": "3b7fbc80-9486-4515-a131-2c8207bd3801", "comment": "Malware payload", "value": "d689a4f6b252c18b34aca445ab1eee9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647852, "uuid": "412e2ced-2e2e-4f1f-bb1b-05cc9296b3e2", "comment": "Malware payload", "value": "8ea424cd16a74b60fcdc9dd397b65998829c18712536d570c67520cdf177bb9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647852, "uuid": "064f6360-41d8-4b52-b2bf-fdba297e3017", "comment": "Malware payload", "value": "bde79969eeba4ff347a9b5ee4807afc9a253ba22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647852, "uuid": "97309d9f-9598-4c52-a945-9ab88fe9ca64", "comment": "Malware payload", "value": "bd3fa165e579db9d59d325e1dc6daeadccefd5a23a955076c7f270ce3f94c9da00f3d15ea47ef814c7f49e11fff5b3e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647852, "uuid": "a33f404e-ef3e-4e4e-8a68-7bfb5a9efa4d", "value": "T1D143123A3A5CB252C630ABBD45DCF291CCA1DBE1794FDCF6F96160830768C525F42291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647852, "uuid": "f288da06-bfae-4b81-a927-1ad8942be081", "value": "1536:3hyAHQkPDsbbiDmX18oIoQkkFZiKLdDYPMHYRpwLkg4azHU:3hyAQk7sWmXWobMFZjdVYRpwLGazHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647852, "uuid": "98307081-5d26-4006-b330-7bdf7f24e0f3", "value": 57028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647852, "uuid": "e04d0c5a-2a3e-4380-a841-67734001c604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647852, "uuid": "8cdf444e-0bc3-4b9a-a290-2e6ec1001792", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ac6b8b-b40d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761662959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662959, "uuid": "d991c0c0-e4b8-4c15-829f-0a3972c574dd", "comment": "Malware payload (Mirai)", "value": "b1ebec96e05cdf405ab1a22ba1d561bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662959, "uuid": "114a47cd-e9b2-4bac-ab7e-e44a487cb214", "comment": "Malware payload (Mirai)", "value": "8ef020a0c87e981b3b989e722b8a9ad5495d0865ce3d49cde6e91250173dec35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662959, "uuid": "45dd7a5a-e17e-4a25-9c8f-9ebf39ce7217", "comment": "Malware payload (Mirai)", "value": "fa8e9d518d1c014c10c1d44399e383d924378fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662959, "uuid": "b9d35d68-d3c4-4a2e-943d-f51be39137bb", "comment": "Malware payload (Mirai)", "value": "50628853b909d1ad1401b279230401af7e7b117f6701ce1654bba7a009be59d8d570d0d6f57128d3ae9244d5ca1fb70e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662959, "uuid": "e97e7dd5-3753-4abc-b3a8-77a8b4c1608d", "value": "T1A8D32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662959, "uuid": "3e375b5e-6dca-4039-ab8f-15bfedec15ff", "value": "1536:9roGHNTUZN1MIBUiCxfytiteQInJ7abwko7lj0JvAhhHr5+5uQfqIcv7+8:nmZUiCx5t26wN7lDhLvK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761662959, "uuid": "8b81d241-ce8a-420d-b7c2-1b9ab1db22cb", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761662959, "uuid": "51fe3cf5-f10c-4c4f-8c71-724a77646afe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662959, "uuid": "8955ca4a-92be-452c-8931-da9c1b6bb31d", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11ac341-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656745, "uuid": "438b4e6c-639f-4c7f-ad34-bec756819d7f", "comment": "Malware payload (Rhadamanthys)", "value": "a704c4576ad6b0df5201b3dba25d4aa4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656745, "uuid": "3b7de710-b006-4654-a404-0c58d285b047", "comment": "Malware payload (Rhadamanthys)", "value": "903f7c71d53846727bbc1d9a3a26019892e4e4df5791e1c83e1a2d0dc6b24fda", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656745, "uuid": "2a839e29-f733-493c-bf3f-599e46297627", "comment": "Malware payload (Rhadamanthys)", "value": "b877dd9b8ef19c09c56b3d8fd134fdf3c430d62b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656745, "uuid": "0a050c97-512a-4d27-a55d-890eb8afd8b0", "comment": "Malware payload (Rhadamanthys)", "value": "2fb17b75d6db6da485cffddcca605fa7e9731e9ec58b02c1af938f87c11bf6109d9da1b17983c190bcfb75a0f7e3300a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656745, "uuid": "7a037264-b100-4efa-bde6-d3ab9c386865", "value": "T1BDA3E801B8835CC4C286985DFF876FB1D986AD150403548ABF1F7B7A35AAE8FADD04D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656745, "uuid": "f98de3db-ef9e-48a4-b866-5376a3bc771f", "value": "3072:GDB7b0EDPJK0Edl+9N1a1lp78fOyrBqrsqO+m4kev+eKHQgjMmgm9YN8ssDzUmun:057NuVWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656745, "uuid": "0b25b7fb-03d9-4f21-a397-03daee104fae", "value": 106732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656745, "uuid": "c770a6a4-499c-41ca-ba21-46968a5a8245", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656745, "uuid": "b59801e6-3867-4445-83aa-4df47570a901", "value": "invoice-1637482117.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf23b30-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656765, "uuid": "418415ef-4274-44d6-9fd1-5ec86e4613d2", "comment": "Malware payload (Rhadamanthys)", "value": "de0690bc2caa27e461a5b4391884f2b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656765, "uuid": "814bad6f-e80c-4e0f-ba1d-05db4e5f88b5", "comment": "Malware payload (Rhadamanthys)", "value": "9091dc6d2bfb6f9c2297fb0873dbdbdec057d82aa90b490dc4fd4ee78ca448c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656765, "uuid": "8fd3070d-0938-486c-ae21-a32399a43a11", "comment": "Malware payload (Rhadamanthys)", "value": "b577ef718b986056c05b1dcbdc36132a372ee596", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656765, "uuid": "9efe343d-f7e0-4bd2-97af-fdcc17014692", "comment": "Malware payload (Rhadamanthys)", "value": "645cd5cd07172d989bcc6eaf02ac5c1d13a3b7cf16dfb2ad17543b37858f349fb9d625e9b2a3f038551ad0284a244c88", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656765, "uuid": "a9ceca91-2527-4b53-a875-7133a0a019a0", "value": "T122A3FB51AB02ACF1509D306CF9D92AE6C45B48C62273A317601BB3F3A3D5F949DD28E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656765, "uuid": "75c76fde-cf69-4dd9-b2ca-e710d1ab5f66", "value": "3072:GDB7b02xiI82YvvA6RCtOxibus3yy9tzpNmFLjJeKGW6/ItmIM198bCTakFddPTC:0LxiI82YvvA6RCtOxibus3yy9tzpNmFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656765, "uuid": "ce7ee861-c48b-4426-82f5-a71245e80b69", "value": 105929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656765, "uuid": "184a03a9-d8e1-4fdc-9cca-a4dd708cd059", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656765, "uuid": "1e483cb3-5c90-4de8-8bdb-2aa73d5ce39a", "value": "invoice-1637482117.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d975fc0-b3b4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761624849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624849, "uuid": "25e6b963-a4a8-4cee-ad6b-5c85622638f1", "comment": "Malware payload", "value": "03453fbff5181a493a331c8db1e1d18d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624849, "uuid": "25bf4d04-24e3-48fa-9afd-c81bdef8c0da", "comment": "Malware payload", "value": "909eceed253fd71879cf6a7f628ac34927705c3ac7d49fc207c25f1be7bc413c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624849, "uuid": "4f8f9ff7-0005-4b65-bb18-88a0aeb732bb", "comment": "Malware payload", "value": "d83358b945d4af1e5017c3b335b3f4d7daad9b85", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761624849, "uuid": "b40bf163-1798-4ac5-8751-1be1a9667353", "comment": "Malware payload", "value": "c797f37b1db87854d530da8f9e057518f8afa6c8f15274034020ecd1e272a1439ca176827dc05c6c6febec7241482b4f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624849, "uuid": "15c00267-8d42-4b53-9dd4-235acac5eca6", "value": "T133E63356F78A7417D8F787328379C76AC1874C298F03D7472659B23C29B7BE04A85AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624849, "uuid": "3fd25945-806e-49c8-ad67-8fc55498c30f", "value": "196608:UiTDKD6uGtXl1oreY5nqMG4QEYn133jNpW+QVC/JymEGA5buExDBpCZnRoHYNbgV:HHdz1hvEkHW+Q7mt2BQS2WGv7bWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761624849, "uuid": "d621f851-d253-491e-959f-041404e7ccfc", "value": 15183378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761624849, "uuid": "c5834435-c986-4141-88f3-9a3b3bcdb083", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761624849, "uuid": "18e8ebae-4ae9-4753-b6f3-06b761b73019", "value": "mParivahan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cedc3af-b40d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761662966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662966, "uuid": "9b8b1ee1-f4c2-4722-b91a-b52a39c819c9", "comment": "Malware payload (Mirai)", "value": "1993baffe3da1a81962c299c5a3c0994", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662966, "uuid": "53ed3e0b-1959-443d-a16a-63869cba7b36", "comment": "Malware payload (Mirai)", "value": "90e356b7bf83f1240db2c7b5b21e521542c03cf5ef39408e321fd0721588a8c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662966, "uuid": "500baad8-e836-47e6-85f2-0127fcd02d99", "comment": "Malware payload (Mirai)", "value": "de0ec365d9c06552414428b8e85a79de8388cbd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662966, "uuid": "b710fd8e-bb0c-4386-95d2-6096c5b11274", "comment": "Malware payload (Mirai)", "value": "3f2d02d7736220925a4e7373692b16f16be116a83c9b24be39b7ad2988d1074298b20239a742f86444210baaeb835547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662966, "uuid": "efcee620-f948-4e51-b912-e02f95a58227", "value": "T1EC042945EA404B13C0D627B9F6DF42453333AB94D7EB73069528ABB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662966, "uuid": "65273b7c-c690-4733-8fed-92e555ee3eed", "value": "3072:OLe6vho1QIruCee+asuTuRebU7IVILZZQy38YhTfYo+M/Rvs1tlLn:ee6vhjIr1r+asuTuReAvLZ738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761662966, "uuid": "18ded285-8399-401f-bd6e-574e609d0f9e", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761662966, "uuid": "56f2892f-a041-4293-be7d-27e2ee633991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662966, "uuid": "769023d0-7fd5-42be-b304-4096a7ec81a3", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084e851a-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761634504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634504, "uuid": "fecd19d3-fa34-4f42-a819-d2f2f18df7c0", "comment": "Malware payload (Rhadamanthys)", "value": "52a4178b422eb536ff66b585857f2d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634504, "uuid": "67d5a7c8-142a-4afa-a9f0-b3b6b6dfbb41", "comment": "Malware payload (Rhadamanthys)", "value": "90fdebc410120ac1dceb5861aeb082fc9e9af9836015d38bfef6ca95a7b88de7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634504, "uuid": "24d65dcb-c442-4825-a2f3-2308d8e54309", "comment": "Malware payload (Rhadamanthys)", "value": "0edb32ba47ae12f57688f9060846d9db4d0f27f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634504, "uuid": "1d16f875-940f-487e-acc7-86a03dd86f68", "comment": "Malware payload (Rhadamanthys)", "value": "26678c8ef04507bc4f6cea32f8880f1e90fc3617a1c08819babefd219b21016126885f82e34f1b4916826c08d54eb3f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634504, "uuid": "48d3b5b3-6cc2-4e81-a792-99d62b8560a1", "value": "T1FF953311BCA65EFDCBDFC7772B8758926F407A894150BCCAB8153430EA3F6615B8E488", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634504, "uuid": "7592d98b-297a-4e08-94db-3a84e700c40c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634504, "uuid": "8ebd18ec-7190-4b5d-9180-39094a7a3ab6", "value": "49152:1ha6knSDFhbEjOwq9CcdwX1SySIvh5KHlVG56wN1REJYMUa9:7aPYzwqbdwlSyjGHlVG56w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634504, "uuid": "69a75cd3-3aec-464a-a9d7-10a45d4cc020", "value": 1998848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634504, "uuid": "cf1629c9-73b5-4f82-89c1-23e9807b5fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634504, "uuid": "59728790-b935-46ac-a1d4-6ed88a968a64", "value": "52a4178b422eb536ff66b585857f2d7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5868a7ef-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656543, "uuid": "8af5404e-9c2f-4b16-a150-706b360c452e", "comment": "Malware payload (Rhadamanthys)", "value": "a303f2ab9d86fd46ab92e07b625ea17c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656543, "uuid": "924a0c13-5b6f-4cea-8d36-05e2733010f5", "comment": "Malware payload (Rhadamanthys)", "value": "9113b002323bc094a85ef1cebd344f900793ae7bf71bd4e9a8c8ab8a166ea025", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656543, "uuid": "65738537-ab78-4eb6-903b-79a55c666f70", "comment": "Malware payload (Rhadamanthys)", "value": "198e9598312b4893e651ed6e1b11b78fb847ffb2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656543, "uuid": "a09578ba-2ab1-4b2f-9d75-161d91a7e866", "comment": "Malware payload (Rhadamanthys)", "value": "a4c21858e1680307ae9f6328c64248eb22acb954b08a135eff9666e51b825cc03a317e6690a3ef60b4db11d920814de5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656543, "uuid": "8661c5f4-4fc1-4180-8228-18e2568a2535", "value": "T1DCA32D229B033BD412677DA40F1B86F5548E55B86A7B68C0D238BF23CC94F2D7539792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656543, "uuid": "ddcb2ff5-ef60-409d-977e-95af6e5d3b3b", "value": "1536:GDB7eKg20F2es7X8rjr/PLIasFltDAD6n1UC6BkQWJ+aY:GDB7b0F2esCfHmDUC6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656543, "uuid": "4377431e-14ca-42b5-b3a0-debfdf8dc71f", "value": 105368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656543, "uuid": "2d724258-823c-4a7e-bc68-4bdc748f0719", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656543, "uuid": "b40455a3-62b7-4ec5-bb2c-bcb2f774553e", "value": "invoice-1637482117.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70231a7b-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656583, "uuid": "4ea58e74-7b8a-4cfc-a569-cdeebf6ce730", "comment": "Malware payload (Rhadamanthys)", "value": "fce633dc2fe50587842ecefbc8999410", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656583, "uuid": "fc642da4-57bb-40b3-8351-1cb9e18b424e", "comment": "Malware payload (Rhadamanthys)", "value": "91bb719dd44a4205a2d27198248eac7cf64f331a0a015e5240a12b90967d6c0e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656583, "uuid": "2e2cd599-72b1-4937-aae9-c0fe18f4aff8", "comment": "Malware payload (Rhadamanthys)", "value": "971036b19fb42ad7513e9bde088ebb80151b2087", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656583, "uuid": "6db3e771-c021-43e1-9f77-a423f840e91d", "comment": "Malware payload (Rhadamanthys)", "value": "40698dabdc3c73b2d6ab3cb6613d9eda5f217f572475b0cc71a96f1918596e7c5496be7bf08c1d2df042d83a4672f4ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656583, "uuid": "a39b1fa9-6d87-498e-835f-0aac0c750097", "value": "T13DA3D9213E62B822A8C058AC5ED757F9F2085C585B9781152E0F2E91A7BCF071BF2DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656583, "uuid": "97e57081-75f8-472a-a756-f899714d7774", "value": "1536:GDB7eKg20ZBLCyV6ruITRtXG+KnWoPlQP+TX+ClPcpBOVGn8bktdTKCgx3TGnHgg:GDB7b0angDDwVL0rcj4OphPW6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656583, "uuid": "f74310e5-1c40-4f66-a7ab-96e8c1a961fe", "value": 106060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656583, "uuid": "bc340fc4-61d0-41bc-920d-626d179a14f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656583, "uuid": "2e6a248e-4506-416f-a05c-932d4858b62f", "value": "invoice-1637482117.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132a6e60-b395-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761611330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611330, "uuid": "c1a86b26-f728-4973-908a-1903f5202222", "comment": "Malware payload", "value": "09ada5829c2eb974935204763745d817", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611330, "uuid": "d3f00ac9-94b3-486d-b64c-5f75518b31d2", "comment": "Malware payload", "value": "923452a9020154346c3f73efbe654c4276f02393734879e984d496fcf7ccc031", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611330, "uuid": "0722246b-1fb7-45a3-bfe3-4b4b8ef12388", "comment": "Malware payload", "value": "414051855b6350516557344cb84ada23cb1da2ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761611330, "uuid": "5351554a-0a3c-4460-860f-e4ede3254f45", "comment": "Malware payload", "value": "89183d30bafd994c3af328563ec64692a41bd9372b3c7f2baac2da56e8b9b57c90ad8cf477834245ffd4075287784971", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761611330, "uuid": "9e92949a-d104-4cda-9365-62bad08fa5b3", "value": "T1729533B22D0502D8E55B1370DCF9B99519F3C6E4A744B5EEE1E3698E77A820E4F0C523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761611330, "uuid": "8c5ff410-7139-4c0a-8e8f-75de506db5eb", "value": "49152:60bKdm6NrYKzJRNUqbaAK3Tr8KZhwmUfpCyQNyPJ9:6DdHbRiqdK3v8K4xhTPJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761611330, "uuid": "7d92f66a-d960-45f1-af9e-54b7669b4e30", "value": 1878692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761611330, "uuid": "d733c478-7c52-41a6-b005-1c0737e87c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761611330, "uuid": "f350b533-297e-4e4c-b17f-9b72c4e60f46", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab1f3a0-b402-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761658426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658426, "uuid": "d7b71787-3d03-49e0-92c9-352122e0ae3c", "comment": "Malware payload (NetSupport)", "value": "358e2ae5e2d557b2f1816093c9c03707", "object_relation": "md5", "Tag": [ { "name": "benafaciario-com", "colour": "#68C9BC", "exportable": true, "hide_tag": false }, { "name": "chiklx-com", "colour": "#755514", "exportable": true, "hide_tag": false }, { "name": "client32ini", "colour": "#19FDFD", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658426, "uuid": "3605bcef-7b7e-4c93-b5b1-9813748b6f10", "comment": "Malware payload (NetSupport)", "value": "92e26ffde6a599662fdc2b8c614369f81ecd4088de06e1150c381d52868a9fab", "object_relation": "sha256", "Tag": [ { "name": "benafaciario-com", "colour": "#68C9BC", "exportable": true, "hide_tag": false }, { "name": "chiklx-com", "colour": "#755514", "exportable": true, "hide_tag": false }, { "name": "client32ini", "colour": "#19FDFD", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658426, "uuid": "d9c407cc-bd42-470d-96c1-e63fe536edd5", "comment": "Malware payload (NetSupport)", "value": "e91cad053ac58b1fbbd5219fd1421ce800bd757f", "object_relation": "sha1", "Tag": [ { "name": "benafaciario-com", "colour": "#68C9BC", "exportable": true, "hide_tag": false }, { "name": "chiklx-com", "colour": "#755514", "exportable": true, "hide_tag": false }, { "name": "client32ini", "colour": "#19FDFD", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658426, "uuid": "3b741af0-41dd-4b8e-82f7-8378cfbd7e46", "comment": "Malware payload (NetSupport)", "value": "523cea631b46b14d707add09c7b673f63d4d023788028da4db34b37904f1a3bd867c22ed8fe6deee1b73cb2f672bc980", "object_relation": "sha3-384", "Tag": [ { "name": "benafaciario-com", "colour": "#68C9BC", "exportable": true, "hide_tag": false }, { "name": "chiklx-com", "colour": "#755514", "exportable": true, "hide_tag": false }, { "name": "client32ini", "colour": "#19FDFD", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658426, "uuid": "72e45b72-74da-4a80-af35-4683a0988514", "value": "T192A2D170AB7CE696E75C0AF3B6DA6C4D8FEC50685781428BD98CFC05174BADF20161A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658426, "uuid": "24db00f0-1210-45ab-b77a-f82d0b64f13b", "value": "384:uXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5NHN:uXKuqXS69Szi/urdMt5lBUeuhJrsRxLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761658426, "uuid": "7bd6fc2b-5f62-4d68-abc0-5a845f08888d", "value": 22204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761658426, "uuid": "1cb082a0-560d-4455-a10c-cfaa3e5c567a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658426, "uuid": "ff99685c-8bf9-48db-b9fb-f8f6e731449c", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767f3f6a-b3f9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654446, "uuid": "8d976b8e-2522-49fa-9856-f8abbdd227b2", "comment": "Malware payload", "value": "12e333f8ad9dfe225a5b3db94d31e7f7", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654446, "uuid": "ab25c351-5679-48a0-b34c-2ddfac439d08", "comment": "Malware payload", "value": "93fedcd2736a41e41066d5f667bfdbdfccb2afa7ac8fefdf14c503cad2d81df8", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654446, "uuid": "e9311931-2ef3-4474-a3de-c63332a66938", "comment": "Malware payload", "value": "ec69113a7c5c4493393666f3834a9b9df74e0386", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654446, "uuid": "e0856dbe-1341-4406-9e11-c2b60b6acb42", "comment": "Malware payload", "value": "b85613e021f0313d4d316fcdfa07fc39e4c379e155440cce3f19166e78a23be940c8e22c301c2c47e1b5a2f1d6b09b41", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654446, "uuid": "8cd2ce3a-02ea-44c7-85c5-7fe471869b7d", "value": "T1B9E02665D845DD8C047826A9AAA7E608E26260231002EA14774CD6536F720024EC76DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654446, "uuid": "749d2edd-e754-4b66-9962-c9896cf8ca27", "value": "6:q43taYOXHmgEqrhamtFXtKqRqBu19DFiwMch0MWXfGu:Twt9Eqr8mt1J4u19MwMCL8Gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654446, "uuid": "6300f298-a652-443a-bf69-770763e9d03e", "value": 330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654446, "uuid": "e4eeb9af-dec6-42e1-81e7-566dfb819055", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654446, "uuid": "e150a84f-0d66-46c7-9934-97f74d98401b", "value": "93fedcd2736a41e41066d5f667bfdbdfccb2afa7ac8fefdf14c503cad2d81df8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a806553d-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656677, "uuid": "dc1ec07e-2e1e-492c-97d2-b4e34a31fb57", "comment": "Malware payload (Rhadamanthys)", "value": "ea9e79b58d33d2f866ff990714e7a517", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656677, "uuid": "4d2bb4cb-8670-431a-a389-199315971c37", "comment": "Malware payload (Rhadamanthys)", "value": "9595e0fc886aae6d61fd9cac3a06347b0077b62c7a5a17b3d90bbf67b6d0870b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656677, "uuid": "95a050db-5f0e-4a55-a972-bd6938112cd7", "comment": "Malware payload (Rhadamanthys)", "value": "155719a01e0bcca19481e70a39f1851291e6c494", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656677, "uuid": "ff1d5b6c-ec81-49f1-a2c3-e854a41ff45f", "comment": "Malware payload (Rhadamanthys)", "value": "24e3c4469befc141d395ae5d224f5ffff832a9e231c59630ad5f444fc153340789a344bfe3ed085b99bea2c608dff7b7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656677, "uuid": "63e94139-9ab1-4084-b10a-347d7c12a32d", "value": "T135A30A16DD26FCA010E9CE9A6ACB54B85E774F0095492CDCCF1EFE60614FB7C2246789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656677, "uuid": "8ef68f93-22ac-4b9f-87d5-eb8e67f6a459", "value": "1536:GDB7eKg20a8Q4+r3rZ4mln+l/58A+2pJsE6BkQWJ+aY:GDB7b024kbumZ+l/5q2pJsE6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656677, "uuid": "1d35d5e7-c1a4-449c-a96c-d90dc77aaedb", "value": 104819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656677, "uuid": "178ae0f4-2825-49bf-bcc7-4ba01e6b18d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656677, "uuid": "a4bb2862-b015-4732-99b0-f8b5647771de", "value": "invoice-1637482117.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ff7939-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761635811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635811, "uuid": "6dfbd54e-0d3d-4101-a9a2-c7d4641e0677", "comment": "Malware payload (Rhadamanthys)", "value": "38f9c7b4d32337edff4426234cd69ec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635811, "uuid": "34709cd5-908c-4e4c-a41b-b18bedb1c2ca", "comment": "Malware payload (Rhadamanthys)", "value": "960bcb3ec7258abbdacbef2a7f6749f6a47fa5184152402771add6a4c7b51725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635811, "uuid": "158bdc51-8d6c-4a08-a59f-27a6bcc0ae47", "comment": "Malware payload (Rhadamanthys)", "value": "d8fa02e3ec2da4573fa5d64d6a91d7f5d545c2a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635811, "uuid": "a5a27615-3a38-4837-8aae-3dc9f46fa2f3", "comment": "Malware payload (Rhadamanthys)", "value": "81a7734a475de78b012851dbd07f1650914e45bca484f6286392a82e5388e228e87b3b481642c9f96dd37a176f58f4fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635811, "uuid": "a7598d5b-adfc-4224-921e-c2cb4496ae7c", "value": "T1FA55302C26FA4349F273AE364AD9B5958A1F76E2E5F6538B134C020B4711680CF91FF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635811, "uuid": "67c93c1e-a47a-451f-ad60-65b59922ad92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635811, "uuid": "f48dc927-8ea3-40e4-bba3-e98330839735", "value": "12288:FC7lquuNg18NEEa3Q2tJ1/5zRX77/3YBRNEiHNDTdcxsYYcRt2gdvU5dH:FC7ug15lrB/38LURtRvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635811, "uuid": "72329f17-2fa6-4b18-86af-8a0a78f863b2", "value": 1357312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635811, "uuid": "12b2a5d4-91c9-4435-98e3-36357c850bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635811, "uuid": "a4e6bcc7-8e2a-4af3-bd30-bac95e4ec7f2", "value": "SecuriteInfo.com.Trojan.InjectNET.84.2895.12500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88841460-b3ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761634290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634290, "uuid": "97525540-d65b-4829-bc6c-f8c00c07d8fe", "comment": "Malware payload (Rhadamanthys)", "value": "4d462ad4131fcf7ebbdcbcd9163d1e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634290, "uuid": "b34e0102-375f-45a5-9987-13dfc7220ec4", "comment": "Malware payload (Rhadamanthys)", "value": "96b93324d9f103302e79010f908d90227067d2cb4e219169b86a5828c991f6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634290, "uuid": "a7163dbe-44bf-431f-8ef1-fbc44e66e885", "comment": "Malware payload (Rhadamanthys)", "value": "532c89fa6b75b779cba7d5ef2b71ca74f0e737fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634290, "uuid": "bf02e03b-cba8-4f12-ae53-9ad34263a4ab", "comment": "Malware payload (Rhadamanthys)", "value": "c13a60772819dd1c954f0ba87caf3bc2ff0dc938f78c19b475bacd49dc1e3ef5085c1931d225d1012ef5421fc3498140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634290, "uuid": "6077684d-3e25-4183-a708-a59ea911faf4", "value": "T1DF953354C89F1268FF868330F8B70E4129756F2895AAFDE4165C985ECB7BBC32778805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634290, "uuid": "946d8c83-b35f-462f-8055-9b64f402d152", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634290, "uuid": "4195af6f-547c-48ed-aabf-697cd3a49e84", "value": "49152:2ha6kaXxuzE4ds4itmleBQhH3a5hSP7jkCS16zpI:AaP2ug4ds7DeR3as7XS8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634290, "uuid": "07acbfb3-1065-4c0f-9e4c-474c8cb06979", "value": 2031104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634290, "uuid": "c976978b-40e2-45b1-8b84-f9c69835c3e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634290, "uuid": "4421c016-2489-4178-81d4-90dc8529d94e", "value": "96b93324d9f103302e79010f908d90227067d2cb4e219169b86a5828c991f6e4.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50fd18d-b42a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761675596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675596, "uuid": "be32b43d-685a-4dda-9489-c0f5af053511", "comment": "Malware payload (Mirai)", "value": "efdedea436a6922ec341b11c60436af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675596, "uuid": "1c21e891-44d1-48e9-a06a-60245ce13c4f", "comment": "Malware payload (Mirai)", "value": "97030f2459f838beb0692bd2d8c3b9983ba544776a45033759b59d487c7ba0a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675596, "uuid": "0b769ef2-6803-4c30-a974-1a8a1737d683", "comment": "Malware payload (Mirai)", "value": "a90a31bed6c14c1aff68eeb0ba0a20d0da97672c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675596, "uuid": "7b84d3c9-941f-4580-b184-539f48346eaf", "comment": "Malware payload (Mirai)", "value": "b0f0b35a0b28f234a0a2c6ab1acdef80c7dc8013ffe0f179c18a241afc66f70e461e525ec685c567240b1340839c6f11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761675596, "uuid": "0a612f90-dead-4e4a-b4a0-0a5bcccc16ce", "value": "T1CCE35C07B5C180FDC4DAC1744B9BF53AAD32B1A95238B16B37D4AF322E4AE205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761675596, "uuid": "1820ae23-684e-4b2e-bced-57a8d2100d05", "value": "3072:62RF9eSuygEPjt6qkWqqdKmDnYMb0gBd/gQyVGsdqml67aj:6IF9eSuygEPjt6qkWqZeH2la7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761675596, "uuid": "f9fbcc6c-d633-418d-a62a-15c86b209813", "value": 148207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761675596, "uuid": "8e1907a5-7c4f-41d7-b8b8-4b3edf5905da", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761675596, "uuid": "5f0c466f-80ee-4e10-aa62-31242ac5fde8", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99ce279-b449-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761688999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688999, "uuid": "06c24c27-0b11-4c1a-87d8-3b0d550b7a31", "comment": "Malware payload", "value": "a521a15ceefeca3733a5cfa4467687a2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688999, "uuid": "8b902910-38f5-4e89-b869-26de725eb787", "comment": "Malware payload", "value": "9705b02f24c62bc938211d125bfeb3c4fc842b2cd74f05df36cfb3a23c7bbcec", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688999, "uuid": "b7750a43-bba4-4c51-93ea-2f011589a56c", "comment": "Malware payload", "value": "9c69c37c001725692b5fae5f607d81d00861f4c1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761688999, "uuid": "91c38297-25a7-4265-983d-be4c114632a2", "comment": "Malware payload", "value": "3b1edd8da90dd9260615a63c54b0780d2748d0f10bd25e36a71f77642e194c80940faa33ff714b062e4941164567e9bd", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761688999, "uuid": "7ec36af8-2df9-4b7c-890f-cbd0a577bd07", "value": "T13831125F3D1BC250A332A624457E450ED6C1941B26038C41B59CD88EFFB966AEEB43EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761688999, "uuid": "b1bb078c-0796-43e2-875e-f4c81ebb84fc", "value": "24:JzIAW/zPtUuXpk563gNApQ3b/iMB0SIdQrIrKViKk5LDwbjmVfJZ8Q/+isB7MTqE:+AKOJbNAGzN/fIUijfJVJ9/+dSiru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761688999, "uuid": "608820d7-661a-4100-8d07-f0e8b4c9910d", "value": 1737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761688999, "uuid": "e230a7e4-3bb2-4a14-9e7d-bcc968858894", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761688999, "uuid": "65ef19b2-931e-474f-846b-0a3fadd69377", "value": "vn.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aea3da4-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761639770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639770, "uuid": "5b27b2c3-3daa-43fd-b68e-e8158ccf68d5", "comment": "Malware payload (a310Logger)", "value": "d0f8e4825d71bd4fd57a1a43a18bf9ae", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639770, "uuid": "a4202f5b-e141-4bc7-892d-86c67091a6ca", "comment": "Malware payload (a310Logger)", "value": "9732d3331728997cd38f78335e750cd134cfd8651f3c86abbefcaca44510dc7c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639770, "uuid": "90dac4b8-9e3e-4a98-bf46-31eb9c1b6141", "comment": "Malware payload (a310Logger)", "value": "ced9045d9f59ebc0ef32ded57fa52b634db9092b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639770, "uuid": "3341eccd-5053-4be9-877e-000d80ca7efb", "comment": "Malware payload (a310Logger)", "value": "8305e269e12185cb3699ebeccc67f1737290a19a21b9c0b94b2ef07123f59fbd44b8bcbb53c151d868668033c7fda93d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639770, "uuid": "769adba6-a0b1-4687-ab34-44f9591739fc", "value": "T160E4125462A6D823C5F657B02DB1F67407B97E6AA831E70A9FE57EEB3622F104D10303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639770, "uuid": "bc672a8d-62e7-493a-8671-5408579ac542", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639770, "uuid": "962a10cc-01eb-4c49-8a52-22c851784f44", "value": "12288:mQhhqh54yh4jfzolpL9hxzQ6kf2SMieyhBotm7Uhs97mUYgZ52s:mQu54yhGElHo6kxzeeBlKsdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639770, "uuid": "4d368b85-1ddf-4159-9f07-bd1c110ea312", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639770, "uuid": "08a63cd0-3017-4459-9c89-08bec6c04bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639770, "uuid": "34c3eb01-fd6d-4194-ab8b-2a1ecdac6828", "value": "ELCAB KABLO TEKL\u0130F-51770 826 102025_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ba48e7-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761635814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635814, "uuid": "71014ead-97eb-44a9-8b5f-fd43a5416003", "comment": "Malware payload (Rhadamanthys)", "value": "f1ece3be9ef7541430d250c2809aa4ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635814, "uuid": "09ac2ca4-a751-4fe8-8d60-e1ea8261a415", "comment": "Malware payload (Rhadamanthys)", "value": "981f6c1aeacdcf274d0a04c717ca6632022f8314bd853774fea72953f7b3b526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635814, "uuid": "f1bbb056-3c3a-4789-9650-23b4de545dfe", "comment": "Malware payload (Rhadamanthys)", "value": "e3773b2f2b41794f2c85fee46838b2e591526a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635814, "uuid": "2b5968a4-cf02-471d-94c3-3a2b6003bbd5", "comment": "Malware payload (Rhadamanthys)", "value": "9758f6fe8c25ce750ae19e46ef539dea85f80b68dcdc4341d77dc25897205390e22c2e326688ddfd3f84d32722d3d441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635814, "uuid": "4067d65b-3559-406b-a3a2-64e8d40c66e4", "value": "T1DF55302C26FA4349F273AE364AD9B5958A1F76E2E5F6538B134C020B4711680CF91FF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635814, "uuid": "95c2ec0d-ca2e-4980-b3c9-4519be4fbb23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635814, "uuid": "c26caa78-9db6-4161-aa1d-6323ed10b068", "value": "12288:XC7lquuNg18NEEa3Q2tJ1/5zRX77/3YBRNEiHNDTdcxsYYcRt2gdvU5dH:XC7ug15lrB/38LURtRvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635814, "uuid": "06abd79e-5397-4282-8a93-2c030c219466", "value": 1357312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635814, "uuid": "706d7ba2-692d-4cbf-9b9d-c31e94274419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635814, "uuid": "553282c3-1f40-4046-816a-7895720bf827", "value": "SecuriteInfo.com.Trojan.InjectNET.84.13815.30052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63908f3c-b3b2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761623920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761623920, "uuid": "c1b297f5-c981-44df-9c3b-6413a6e58367", "comment": "Malware payload", "value": "242ca4f580fa11fdf3ed5776090be3d6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761623920, "uuid": "822cbb9c-7b87-42b5-ab25-68d681afd282", "comment": "Malware payload", "value": "99004f64b9fd6e5d86c1c451c121e90873a146bc52fa5195e153a05a06955912", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761623920, "uuid": "dfb96219-5f00-4554-887f-24a59e25cb95", "comment": "Malware payload", "value": "7c6df0919d09fa2fefc47c004e186ff3631ca70a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761623920, "uuid": "aa99ef4f-773b-4f41-b727-904a76df5f61", "comment": "Malware payload", "value": "cf8db2ca4fc22cbb94f5e7d10ee5bc43991463fd5c62ca739524596787e92c32c5c0ff9795a18198a1c10588038e116e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761623920, "uuid": "dd003f8b-0a8d-4b79-b330-5578b737fab9", "value": "T104F63342F791A94AD8F3C7315C3949A61129FD72CF138787E121333D1ABFAD49A852E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761623920, "uuid": "0a417fe1-696c-4d13-bfd6-a1a246984aa7", "value": "393216:h7LkyUTxRm034p5uPeWqnwVFhDpc/2YdRZtW+kHkLMO0XoVlelY:hnKx0Zp5CFFpc3dRZtux3CR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761623920, "uuid": "1083182f-0f9d-4471-9d2a-3a6c40700794", "value": 15724818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761623920, "uuid": "350c352c-97bb-4af3-a096-b49d54617b59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761623920, "uuid": "f44735c5-88a2-4629-a522-d255483d2ca8", "value": "mParivahan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253f3c72-b42a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761675355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675355, "uuid": "f4961e5b-a193-42ba-8607-5ec09441ced1", "comment": "Malware payload", "value": "7368f5ba56196c8dc2a93456f6a31023", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675355, "uuid": "836c1114-fc96-4850-9e6e-1d89b0bab135", "comment": "Malware payload", "value": "9b23a5bc17ab4feb105b56f7384886233e73d53aa93ec1f8b37151de5f81331e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675355, "uuid": "aa507afb-d756-4685-ac94-a077f4189a68", "comment": "Malware payload", "value": "c02303dec428d97120d43f48d59e496764d60774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761675355, "uuid": "b6ce520f-0ca6-4a13-b80c-f7fd0201669f", "comment": "Malware payload", "value": "8d4861ca2c93969c92c990e22368429ee66c045c75d1456a75f28bcc7976427d6d70198eea9eee2f777cd935affbf39c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761675355, "uuid": "72642d42-63ff-4bbd-be3f-f1ed5c592901", "value": "T18F6302AF1E7DC50FC059BE7181B8658EE87005E133997783DBB60108BE592E6C058BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761675355, "uuid": "ba9104b1-645a-4e9f-82ef-a501a5e98156", "value": "1536:Bq02wR6ZxdAqmfRB/J3jr15Bdxig3eE7ISjrPPP:Bq06DdbQRlJTbBbiShrPPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761675355, "uuid": "becbaf95-63b1-4ee9-adc8-4bd78a7fe5cf", "value": 69668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761675355, "uuid": "1caa13fb-6df6-4202-a402-51f7b9729dd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761675355, "uuid": "d48552c1-4053-4865-b482-76eac9de623c", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2576e5ba-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636271, "uuid": "3d224f0f-0795-47d2-b0f0-ad30c47b1366", "comment": "Malware payload", "value": "eb23dceeaa028f9ed456f9e5a1c0774c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636271, "uuid": "d9e9e18d-a3f4-4f7b-baed-2e4dac87f872", "comment": "Malware payload", "value": "9b32f2401db7bc24cbe14e54158fb45c9250c735a725885f5664ccecc62b67bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636271, "uuid": "759496ee-6d0c-4f88-989f-eedfa9c3054d", "comment": "Malware payload", "value": "d2ec84b832b495ffcf1ace4eb987d853e56990ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636271, "uuid": "7ad60194-3c8d-4fba-8e5d-0467afdf45cc", "comment": "Malware payload", "value": "ae2c4b6b3663df54d8514061946ed339d83e1f31c18c85eb7acb52b3dea4975e18e3fe6d42bffb05c3911790c4c70d95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636271, "uuid": "76a20627-1a4b-40e5-8e7c-4e17116415e9", "value": "T12D0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636271, "uuid": "b2ecfa3a-661c-4856-805d-6e728d4c6362", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636271, "uuid": "b02fe256-b322-4596-b7d4-a63400fa4903", "value": "98304:aAT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:/2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636271, "uuid": "8d52357c-0c56-47f4-82e0-3a6ee3ad4602", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636271, "uuid": "515bbc7d-b061-4e3d-907b-f1a294dc50ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636271, "uuid": "8d3a1708-75fb-403c-91e8-3bc0cec06570", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9436f068-b44c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761690144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690144, "uuid": "3679358c-6bda-45fa-9957-63a76bb1f732", "comment": "Malware payload (Mirai)", "value": "3e3368eaa118fc193363b715f24f75ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690144, "uuid": "35d3adaf-111a-422b-bc13-880cefcb56f0", "comment": "Malware payload (Mirai)", "value": "9b5a4d2b0c62321761792fd447fb23a5fbd0bff085b7c590ae2a9dbf7e6a4264", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690144, "uuid": "4d57fc09-3cf6-4020-b998-7044322fcd12", "comment": "Malware payload (Mirai)", "value": "ba699207753b548f6cc8436cc4560a73c2597c3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761690144, "uuid": "91f25972-edf4-48c5-8c86-a3f47dcdd690", "comment": "Malware payload (Mirai)", "value": "81dc6939669b1d6f7f8f2b6fd98dd1b046704e17c934613200b0c5e71e4b62585215f49e569b24df1d8b1eb822a42ddc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690144, "uuid": "978ff5b0-1a9c-4795-8bff-c09cb8fdecaa", "value": "T1AE630855F890CA22C6D526BAFA5D428C33231F78D2DD7206DD24AB3537FB9560F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690144, "uuid": "96183c6e-c69e-4eea-a83f-bf5db0d7c2fb", "value": "1536:jfeLaw0owThW0ixMOfwZMn/oorXUyAdV9FOl9+1Ira:jA3wT6fwSAoxGUva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761690144, "uuid": "71de0f8a-9c11-4395-a20b-97c78314cdf3", "value": 70904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761690144, "uuid": "adbfd277-3c9f-4523-82b1-d24b1e5ffa5b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761690144, "uuid": "a996269d-a5f0-44ed-a75f-5015c17bad40", "value": "SecuriteInfo.com.ELF.Mirai-DBD.34191313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0bf7ae-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761636495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636495, "uuid": "44e563f1-0ec0-447f-b650-4a8fd866c916", "comment": "Malware payload (Formbook)", "value": "49fd17d2e6ace14162841692287acedd", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636495, "uuid": "b76c7ed8-d64d-4c11-a753-6980c590fec5", "comment": "Malware payload (Formbook)", "value": "9c15ab7f6cac18ba6947417cca54485447ec61178906ab1672d92d6bea71cfd7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636495, "uuid": "ed9fb424-6696-4851-96a3-bd6a25a751c7", "comment": "Malware payload (Formbook)", "value": "81cc64f199d5b9095f146b96b80dfb1a3c27a279", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636495, "uuid": "68f25ac3-74b9-491d-be50-78f3078b70dd", "comment": "Malware payload (Formbook)", "value": "e83fd3b85aa0cfbe77c1859a543ab7ded0297e809e4b02a4420f495927658b548d13cc818292c416d59d63ee98e73d71", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636495, "uuid": "6c1f66f7-8f22-4741-ac5f-e8e0a4b61882", "value": "T11145BF0273C1D062FFAB91734B5AF6115BBC79260123A62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636495, "uuid": "ec3a1add-3707-489d-b147-ca685331e154", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636495, "uuid": "92df510a-8433-4b1c-9a22-9f7af3c4861b", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1ijXdaOZsk5VbCx2O5/i6+va:WPVt/LZeJbInQRaO57+x2OF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636495, "uuid": "c1b51054-08ff-4b76-9f79-51a80cb9fbe6", "value": 1256448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636495, "uuid": "a655d124-6216-4853-94fb-f889603eea51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636495, "uuid": "4d66ef93-164b-4bcc-9d56-5dd1fb3cbbd4", "value": "DHL ACCOUNT OVER DUE LETTER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab14497-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761636629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636629, "uuid": "08e180b3-d6ce-49c3-83db-188bd79fbcc0", "comment": "Malware payload (RemcosRAT)", "value": "9f7a4cd0e20d1baf9da45fbd18141b93", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636629, "uuid": "9c546719-1241-426c-badb-0e2a9482331e", "comment": "Malware payload (RemcosRAT)", "value": "9c7bccc9beab63a3ebf8995eb4ad568c15e7b65421e11fadbac663d4bc8ef792", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636629, "uuid": "185eb293-5a63-4dc9-a593-1379c39c5e71", "comment": "Malware payload (RemcosRAT)", "value": "56e530d8704a3ea7afb6ebe62a8b1d429683d717", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636629, "uuid": "9311514b-18cc-42c5-9424-69ce903acc08", "comment": "Malware payload (RemcosRAT)", "value": "9d295389df6860630f27815258903bb8294dd61cf2da0768547965292f34eb68bbecbc6fa58af5438fe31a19bbc42783", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636629, "uuid": "c53b60de-b651-4ccc-8169-b7fd3a635299", "value": "T12B05792B8B2ABEACFA58A94C913F3A0A30548742F730275C6743C7D99C955DD963F10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636629, "uuid": "2c6a0351-d57c-4a25-a65b-5ef7bb4fe357", "value": "12288:MCpu8NrJ3dEOZnJxerhc7M+yjn24HhahPN2A2Rw41AcJTIsBT8ATtQbg+UrQj:0GnTeNc6HhY2J1AcJmbxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636629, "uuid": "9d9d4811-20c4-4b75-ac09-7d89d71f65a3", "value": 809557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636629, "uuid": "fed8b437-475a-4aae-87ca-feaa2056637c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636629, "uuid": "44de5cb8-aa9f-43c6-8dff-9718ea1ff090", "value": "\u8a62\u50f9_HA-27-28199 22-077.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c83cc8-b3e8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1761647257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647257, "uuid": "01c9a4bb-2448-45e7-9292-06bcd3f70fa3", "comment": "Malware payload (GoToResolve)", "value": "a38493968f825792a08247caf1465e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647257, "uuid": "b1f91e9b-0ee7-4d28-854a-1061ac7556ad", "comment": "Malware payload (GoToResolve)", "value": "9c7d38cec08dd36a62abf5b3ab44fbe574bd3d2be9588ace60dc571e14aeb536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647257, "uuid": "cb595e82-eb4e-4499-b363-17e51ed79d1d", "comment": "Malware payload (GoToResolve)", "value": "607e02c25fd0f66584fcd29b4d3657620655e567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761647257, "uuid": "a564ece1-2e85-419d-aec6-822d7f79426d", "comment": "Malware payload (GoToResolve)", "value": "ec9a5a1e9743f04ba448fffa1573944fc851b5417037819e54b44a1b37d6aa484f4c27eadbda42513ae95083e2711a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647257, "uuid": "0efbac89-f363-4bb5-ac96-3054166082c5", "value": "T17D37333132568471DC5211F1E929AFBBD66D6D248BB208D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647257, "uuid": "29a8a848-2a7f-4ce5-8f2e-f5739a38eb18", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647257, "uuid": "358423f3-8ccc-4b0e-ae86-d69c32397620", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpq:q9WtLzgOTbjZvk/ekS/mcpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761647257, "uuid": "029d2fd9-16f3-4f27-9cba-66080e7caf12", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761647257, "uuid": "c1461967-4b5d-4718-9264-ed67bae8be72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761647257, "uuid": "bf7100fc-be18-4f86-bf9c-fb20366aab90", "value": "AdobeReader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09cce41-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636102, "uuid": "526d53a2-dbad-46ba-8b6f-9ee61bba8e79", "comment": "Malware payload", "value": "61a2a3238b47f3956009e120555319d3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636102, "uuid": "256e688f-bcec-4764-94fa-de0730656509", "comment": "Malware payload", "value": "9dd5df725cde4f6913c4e895e068c4b4063d5eec26369fe44eba2809928a043e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636102, "uuid": "a1d882ea-24af-4748-bfa6-63ec22bc1c8b", "comment": "Malware payload", "value": "5f2331efcd71c2433dcc9f0bc245cb27f2b32532", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636102, "uuid": "f699bd1c-7bbd-4dd4-ba8d-bb5e8f2dc0b6", "comment": "Malware payload", "value": "7bafe1d94692f28e35c17374f12af2b91deb27136d6e10e5853037d43164e1fddafeb7d001b00a45100b8f30d52ca014", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636102, "uuid": "5a1aa99b-765d-4457-824c-2361313998d1", "value": "T183F09ECD0C324EBD0FC9CD73F5546186B40AA0CCCAA1A5D41B9125DD8D880D836EBF93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636102, "uuid": "369ba4a2-ee66-4ce9-97c0-fa9a9ba87a82", "value": "6:hzLYVJhZiOrtovqLVLEVbADOrtovqLVLE4A7aHbOVomxRKVHAbKo0tVk30SAGGdt:5YVJhZnBLBiLBLB7OaVHAbr4OVlCk6Pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636102, "uuid": "15ab822a-892c-45b3-bf2e-b9c989f16a81", "value": 512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636102, "uuid": "e7a7f932-3706-442b-8226-6ee64f6102f7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636102, "uuid": "16202b28-c77c-4ec6-aded-64f6f8e3e14f", "value": "windows.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add12fb3-b434-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761679879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679879, "uuid": "e2011c46-7c0e-4d3a-a4df-21380238c809", "comment": "Malware payload", "value": "a7eeec1706775542f1d89fd054a6bddf", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679879, "uuid": "d10c2600-7aff-4613-80ee-2e2e2159c02a", "comment": "Malware payload", "value": "9e678705b2f481ed4c6e35891f0dae9aba4ebb2c42fbda7a3095f73e6550ba2d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679879, "uuid": "ad6d1de6-7ee4-4b0b-a97e-2d21395714da", "comment": "Malware payload", "value": "f0db417b65bc1590f7e30fee28d0022285c7557b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679879, "uuid": "26bf5dea-58f2-4347-815b-565b39553790", "comment": "Malware payload", "value": "2b932b5cf70571e0c633136690bcf473a0686f167f1a482409b26611fd17f9ea0972c47940c630dcbf17ce29a1948927", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679879, "uuid": "f21cea7b-eb2f-4aa9-a16b-69623f4a7fad", "value": "T18445F1434E1985FCD78D2C7814DEAF0B92ECD2D43E2F86B7A68B540D42DEA1E09D11B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679879, "uuid": "d005768d-1223-4656-aeae-d7108afc79f5", "value": "24576:YgB39r50s1RJB2lObt5495NFpf+rwHiZrVpdo7ECv6:YIVDDeIaiZxpdoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761679879, "uuid": "9a16e6d1-e900-4db8-8575-4f43c4b42fa8", "value": 1236269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761679879, "uuid": "489add36-e298-4948-bdc9-472af7e71913", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679879, "uuid": "9877f75c-d764-4183-900b-daec03a3d507", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be366acd-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761634809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634809, "uuid": "2b49127c-7dc5-4384-a66e-9f473b56c618", "comment": "Malware payload (RemcosRAT)", "value": "0e3db6b52d558e48e2b3dc164a95de40", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634809, "uuid": "b22a9ac1-ff5c-4a90-bdb6-1bdce4b960ff", "comment": "Malware payload (RemcosRAT)", "value": "9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634809, "uuid": "bf05213e-8ca6-4504-a7b5-ac277912f598", "comment": "Malware payload (RemcosRAT)", "value": "1bc87376155c4f604939c37f42172ed921b11d39", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634809, "uuid": "30ddaefd-2a05-44ff-9886-2d03a848a20b", "comment": "Malware payload (RemcosRAT)", "value": "1e03d17f1b07cd7f7a93da7815d2be4186a1ab105d9feea92be04302c0ef2363fff9568f7d3ddd817fce65b0a4c6393d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634809, "uuid": "8945c097-b6c0-4c27-9be1-b04e337cea53", "value": "T1FCB1F7B29C103AB92C804CD6D4CB4D8F704B4D5F4A2966B4CC1F5AFEB9F9679521C076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634809, "uuid": "f1720d2d-3327-4008-9b7e-a410367a88db", "value": "96:WbsnxS7AOZMWCVGo5eVVrw27F5G68uzPdBaUObeOYWU6I1V:CYoAILC15Sy27FrzPb3OYWU6gV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634809, "uuid": "ac5c251d-50e2-4b65-94d7-ff430a839e62", "value": 5527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634809, "uuid": "f6f46c0b-e30c-43a3-9f8f-d27912c8feff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634809, "uuid": "870ab170-a655-4691-b04a-770bb0f8bb6c", "value": "z1Dispatchnoteof21_10_2025-PB4902CBPB1701EP.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cd2935-b400-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761657391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657391, "uuid": "f67a7775-7fdb-4af7-8f00-4c840bf15c78", "comment": "Malware payload (NetSupport)", "value": "c28a13f7f7dbdad51c86a08801b917ac", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657391, "uuid": "ca871913-f09c-437c-8d9f-0b87e5e43518", "comment": "Malware payload (NetSupport)", "value": "a14dc4955ded009e6b905c16f7571705232d55247e87f1a5bd5ca6a1481d37e6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657391, "uuid": "223f1d5a-c5f1-44f9-b228-a6bb4d9ca112", "comment": "Malware payload (NetSupport)", "value": "d34a75fcc0af272e40d0d5ada1f17d5bd5f39090", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657391, "uuid": "1ba83ac0-03b9-4230-96de-6b63441333f3", "comment": "Malware payload (NetSupport)", "value": "19a72b2a04d6bdb0e298922ed5b2e7a1c9b400cc2e1c48f7423b17adec94921d53322a1a02240898515ff3f4cd9327ae", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657391, "uuid": "e9201d9f-eb0e-44cf-aa18-aa9cfb5ffd9a", "value": "T1A806F022BA8FC526D61E0272E42DFE8E643DBE73476140D3B7E478995C318C257B9A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657391, "uuid": "c200afbd-b45f-4599-b479-49bb2a0dc8cf", "value": "98304:hDz3IGvjINMlgPsz/HEzhUFOu0v4O8HixLXIq:Rz33jziEz82FLn2LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761657391, "uuid": "7d4c44d8-f0d0-49e4-943c-2ffff8d2f9dd", "value": 3966976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761657391, "uuid": "742aa9a6-d003-4d07-9fd6-f7c3b388df04", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657391, "uuid": "286c4686-3e3a-419d-bf0c-b79b8db233a2", "value": "a14dc4955ded009e6b905c16f7571705232d55247e87f1a5bd5ca6a1481d37e6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a60e056-b3f9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654426, "uuid": "bb383840-1ea7-4b7e-ac63-216c5ffc2d47", "comment": "Malware payload", "value": "81fe83ca50bfb779af92c87ca4fc32b3", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654426, "uuid": "4f53cbee-34a7-4cb3-bdc0-c7d4f3807816", "comment": "Malware payload", "value": "a1e5c9eb5a7031fbf01bcd8fcebde87d4854a90a590e295042607b46b11e8fca", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654426, "uuid": "1a5abd7e-9fa0-46fd-a5b3-0c693486e803", "comment": "Malware payload", "value": "f222eb534b8615005fcb6c716dc5764ab43027fe", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654426, "uuid": "023a8f76-55cf-4838-8656-6ac5d639505d", "comment": "Malware payload", "value": "5d8a9926c1487419d963b29d313f6fa2492276cb44a608dc1e848219b610016f521af9dc687c4436fae3253fa025190b", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654426, "uuid": "19494ad5-7f9b-4d45-bfab-fbf0a5990024", "value": "T130E02064DC50CC89147A35A5AEA7FA1CE25250530002DB51FA8C85177F724060EC76CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654426, "uuid": "d4507de0-9ef8-40ca-a836-f3cc5b2c1d59", "value": "6:q43taYOXHmgEqrhaq7N82NFtcoHYsKWwxRFZHTP9DFiwMch0MWXfGb:Twt9Eqr8YN8qFrXNerMwMCL8Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654426, "uuid": "7cc502fc-4391-4437-9539-e88432ef1eb5", "value": 350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654426, "uuid": "12956de2-f98d-4847-ae08-0a6984238223", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654426, "uuid": "b4e8a718-b0b6-4089-b60a-bc74de54a5fb", "value": "a1e5c9eb5a7031fbf01bcd8fcebde87d4854a90a590e295042607b46b11e8fca.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a45db8-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761653819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653819, "uuid": "cde7ef60-ae3f-450c-9fe2-ba586356746c", "comment": "Malware payload (AgentTesla)", "value": "93ede199c5abdda6ab911bd255057129", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653819, "uuid": "d2180784-cd38-4e65-bbaf-8efb3be0cfc6", "comment": "Malware payload (AgentTesla)", "value": "a25cb2e8ed92e812fa63cd107dd69b5e69d891775fac3439db05e11622535875", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653819, "uuid": "a1a294d9-9be4-4a78-8e5f-c9cafa8af043", "comment": "Malware payload (AgentTesla)", "value": "29cd53b5c4403b2318efc0329b32857401069364", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653819, "uuid": "6a5c6691-29e2-4cca-afaf-68da81e8f8e9", "comment": "Malware payload (AgentTesla)", "value": "0d3154f8d722067629dc28b7f363085a9aac0672baa56fa242840bde7532a0eca06898a25f882cf063b7cc4003497e1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653819, "uuid": "f92bb48d-a7ef-4f26-b2a2-32ea36f86c63", "value": "T1A692E5C8BFC5B2A0D23350736D1BB45EA36A6C80F28C5158E335B564FD60B1CEAE6578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653819, "uuid": "ee1ae04a-b480-4229-9657-92b401bc7f0d", "value": "384:JTD4sI2tYixY9apWMMSYqOa5CnGkIkbxxx:dX3xkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761653819, "uuid": "d903e7d7-86b5-4c76-b3d7-ac7210666013", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761653819, "uuid": "29f13fda-8aaa-4815-94c3-d5d3d25c14ce", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653819, "uuid": "9660351b-c690-477b-b02c-1b47759ee5ce", "value": "payment receipt.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef83111-b428-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761674485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674485, "uuid": "c31c800f-d6df-41f0-bbd6-f713c8b1e29e", "comment": "Malware payload", "value": "1979c5c88ab458a93aaa5d8f548666ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674485, "uuid": "4031f763-d305-4dea-bf66-8bf832da42ac", "comment": "Malware payload", "value": "a299b363bfc54e3f0424129691af0551cefacfc91a259d93203ece42b298c351", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674485, "uuid": "6139ecd4-5057-43f2-bfa6-2053f7da9431", "comment": "Malware payload", "value": "921a88215f0c8e8c462b9a80cb1227136072a6a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674485, "uuid": "8ea32eb5-55b9-4b8d-b2ea-280d45ee1d2e", "comment": "Malware payload", "value": "d1e47c5e4c4a72b9e07c438149606bafa77cbab5dd46c85a5943f526b5fdcab89b1e9a34157d5098d4d84133b99a2012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674485, "uuid": "2a8149fe-a723-407b-8e6f-8666b07892ae", "value": "T1EF246385BFA03FFFD81ECD370295DA05129C891A1294BFB66B34D508BA8B14E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674485, "uuid": "c463d2ab-5e9e-49a3-be2f-0489127456a8", "value": "1536:H1Js4QtQ4U1UFhfaDJilSzZAcgrIIy2Q+dqExtLzlE5cUD0LbDrUyA2aSKvNzpB8:Hvs4QtQk3PlEIA0KvfB5CQgGqn1J3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761674485, "uuid": "10367e80-27df-41d5-87b1-ed2cd5e705c4", "value": 223916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761674485, "uuid": "8f08f326-4b69-467f-91bd-8c00f5c5b166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674485, "uuid": "d4ee6987-ba0e-4748-b87c-e31f8ebf11e5", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2925587-b411-11f0-91c6-42010a9c0006", "comment": "Malware payload (ResolverRAT)", "timestamp": 1761664962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664962, "uuid": "b2d7ba54-decc-4961-8836-cdf0e205d8e1", "comment": "Malware payload (ResolverRAT)", "value": "c678f6eebed835cb569cbb6ef541b350", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664962, "uuid": "6aa6b372-056c-4e0f-a462-1f3c075d784c", "comment": "Malware payload (ResolverRAT)", "value": "a2c09894e87d009a535196b027f0115e679f180570d44789de79799e7757fafb", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664962, "uuid": "96785e66-aae3-4286-a993-de0b3c3d4c50", "comment": "Malware payload (ResolverRAT)", "value": "e076c7294de31283787746b77728da872412d699", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664962, "uuid": "e85bb2b1-b44b-44ab-8fed-9eb95082c448", "comment": "Malware payload (ResolverRAT)", "value": "1e30e4fce01da59be525691f52615901be11d091d9f7430d6420d0cf4e4ca5cc4f5888df06e8f36d4081a6de2b50c8e9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664962, "uuid": "c700dfb7-dd41-478d-b594-e9674c0d79cf", "value": "T1AD3423A6B699613B29DFAB83F2BEE4E4247E1D104D1924DC54C2EA4D6F640C0DF81E3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664962, "uuid": "9f88a7a2-ae0f-4f17-af29-1bfdebdb356d", "value": "6144:Xb78yYE2yf2hiPDHUfnS6UbU6OFMIteWXXIbZ:n83RODCn/6OFMbWXXIbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761664962, "uuid": "cab7eaf5-3667-4de9-9f43-55840fc88203", "value": 241984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761664962, "uuid": "ff888c58-0de1-4ff1-aab5-053fcff960ee", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664962, "uuid": "c3740859-1c85-488d-a0d6-be3805ef2924", "value": "RFQ - T038 PROCUMENT ORDER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec19f83-b404-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1761659238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659238, "uuid": "7331ce18-7aa4-4128-ac6d-919d1e331e90", "comment": "Malware payload (DarkCloud)", "value": "93182f15f651e4a752863c560226735f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659238, "uuid": "7e5f40af-09ad-4f2f-87a9-ef612dec1ffa", "comment": "Malware payload (DarkCloud)", "value": "a40d1ba43b85f63d8d72f9d0d608239522d65681fc1aa6b37fd42a867e07f658", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659238, "uuid": "8945c378-e7a2-4626-871f-31036100977b", "comment": "Malware payload (DarkCloud)", "value": "17a01c44c6b24591f540d2c188906ca383b4e6c7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659238, "uuid": "e649e792-6f39-46ab-9479-776630d4217e", "comment": "Malware payload (DarkCloud)", "value": "fa23f15ec5eba2276516781cd483017c32e0772c1b8c3bced66d5edb4e7b14a272386731d83e8c1e91aa689f1c6afc2e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659238, "uuid": "3435ddd6-c160-4438-bd53-42309010c9a9", "value": "T115150B0CDAE8AF13EA3D437789E3856472F24881FB87EB6B525474A509013E953472EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659238, "uuid": "f1a28b42-87da-42b5-a658-91f2499190cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659238, "uuid": "2fbbbb83-79fc-4c57-a003-f2fb564940ab", "value": "24576:HPgPEaek95GUVDcW14BAkZXMxTBF2LzjR:HPWDEZW1qAkZHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761659238, "uuid": "349c8eeb-74bd-4f41-a3b7-e1d48abaeef8", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761659238, "uuid": "f50f1297-7e7d-486d-8a2a-843811ff5f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659238, "uuid": "22c1a18c-99ce-48d9-bc98-935da8b01aa5", "value": "Copia de la factura de pago_____________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a88888-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761636493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636493, "uuid": "30f46620-8ba7-4be5-b24f-a5dd4815ef01", "comment": "Malware payload (AgentTesla)", "value": "a08725839b28866f05aee7692afe4f3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636493, "uuid": "fe42e9cb-1661-4239-95bf-7482b8fe83d1", "comment": "Malware payload (AgentTesla)", "value": "a44f4bb4f077dd6ef056d8d460c29218534fb1cfa6a3ec6e2468cc3f18061cd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636493, "uuid": "12163f4c-39ad-4559-abdd-fb3dbad1f103", "comment": "Malware payload (AgentTesla)", "value": "0e5441bfdffb99f8b25be619bdf614b80ffca761", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636493, "uuid": "2b3af1cc-b0aa-4c74-8b3f-ae54f413fd69", "comment": "Malware payload (AgentTesla)", "value": "b4884d85747ddb6c297d5568cf1813ee69bfcbe4353ebadbb4c887e79c178a6b44e1c19f0e26f771809650e98c7079c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636493, "uuid": "b242b313-08c1-4a01-b2e9-625ba390ca8d", "value": "T14828AE027391C062FFAB91334B5AF6115BBC79260123AA1F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636493, "uuid": "ec6f7578-fdbd-4971-8d0a-7989cc252be8", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636493, "uuid": "864c5b3a-c0d7-46a5-8d63-2e92fcdf711f", "value": "24576:I5EmXFtKaL4/oFe5T9yyXYfP1ijXdaL03cuhMYN49kiVC3m2Sy:IPVt/LZeJbInQRaL0ruYIVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636493, "uuid": "63ef754b-1b56-4547-9e20-a375c30b7a93", "value": 94371840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636493, "uuid": "17a2e182-1438-4e61-912e-cd027e2000eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636493, "uuid": "b98d6bdd-9c8d-4ed5-9ac5-5e1d00049d67", "value": "DHL GUIA 1Z4815906897663406 Confirmaci\u00f3n de env\u00edo 1Z485676677665556566663406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1b38bc-b412-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761665168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665168, "uuid": "a562f5ac-0154-4c72-ad6f-cd2defd4db3c", "comment": "Malware payload (Rhadamanthys)", "value": "104e10de9305e07aa6c0900e8934213a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665168, "uuid": "d2018913-ca12-4464-b37b-268ebc683f70", "comment": "Malware payload (Rhadamanthys)", "value": "a4ba34a07d34947094033a087e3dd8da0527ff851f4a96aa8234ff1ddd2a4f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665168, "uuid": "f0c75654-680e-4ef3-bd7c-71969340ffc2", "comment": "Malware payload (Rhadamanthys)", "value": "10b071111adee1c6f164638699c821bbe23d87dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665168, "uuid": "4fbe502b-9f98-4d89-bc00-9e97114f6e96", "comment": "Malware payload (Rhadamanthys)", "value": "579f4d44c9da5b332f66eb951e400a913c0dadf2c9fedac2bf717481ad27e4d74417c78bb20bba1574c74f56a08fe13e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665168, "uuid": "a5584feb-1dba-4a18-96bd-454c0f8d1502", "value": "T1D3E5F47EA894186CD2559139AF5941523A227F4C3B2312DB1A20B634EF7D6CF7A3EF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665168, "uuid": "02e74034-0d11-4434-b4a2-e3dda18ec272", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665168, "uuid": "ca98daf5-122d-4382-898a-463fbf93e80b", "value": "24576:pkgKCdNe18u19CdrHE5Z034Ll1Tw4K7/IKB4QudpKAjC1h4On4KIjfGmDDF+WbNI:phDHe19CdY5Z03UnU4KnBXu75Zsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761665168, "uuid": "eaef3e17-4732-4cf8-810b-22ff449057c5", "value": 3123000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761665168, "uuid": "8aafdbc8-c5d7-43d4-bb77-4907689445ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665168, "uuid": "6ea46c4d-5da9-4f18-99aa-25581afedbf4", "value": "External 2.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac00981-b3c0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761629784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761629784, "uuid": "94b150d8-d1fa-470e-b829-83648285ab66", "comment": "Malware payload (Mirai)", "value": "b5487ffbb207b285e6014d12df7b1b6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761629784, "uuid": "30bdf802-417c-4977-8f55-6230d1014d81", "comment": "Malware payload (Mirai)", "value": "a4c662015b1a6698af83ffa3b2f90562d673299e8b7516c8aa4a0a145b6173ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761629784, "uuid": "bd7de38d-09ed-4383-b5be-8ec697459083", "comment": "Malware payload (Mirai)", "value": "bc6f44f793af74306b5c00ca034e1be655dd55a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761629784, "uuid": "e088925d-56ec-47f9-acd0-c140736112d5", "comment": "Malware payload (Mirai)", "value": "ed51711ef7ceac562906b3b1e0b4be0d958c7be265fda3c38fa62f42c2f66f07e1a8d4ba00ec67bc388b10bf12629e09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761629784, "uuid": "4808eee2-4724-40fa-852d-0983957bf9e0", "value": "T1B70439CBF800DDBDF80AE7764C534906B130B7B254924A377257796BED3A0A84927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761629784, "uuid": "22db0596-7ab6-402a-a567-1969e33e74a1", "value": "3072:pG2B+LwVQHrRn/ta5wmphLWn2y9uYNtPBY3N2LAzOaiBcfVKjbiWL9vB6tY4:c2B+iAR//12y9PNtPKN7JiBc0L9v2Y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761629784, "uuid": "314b5c28-7dac-4bce-84f0-638497eac85b", "value": 189856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761629784, "uuid": "b8b2f155-f03a-4304-b9ae-f7b2d3c83dc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761629784, "uuid": "cb49bde3-61ee-4b41-ac14-2e21e9582a5c", "value": "Orbt.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a31094e-b3e1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761644117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761644117, "uuid": "017b1a7f-8d3f-40b3-988a-207c746a94ca", "comment": "Malware payload", "value": "075c96a218442e065eef211165820b22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761644117, "uuid": "cfe0fda0-4a27-41ad-b9e7-0127adf7ac13", "comment": "Malware payload", "value": "a4c6a9bae5685ed4c9e2c4708b6ee013dbc5412a3111925f899197d36302e173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761644117, "uuid": "968eabdc-b4fd-4091-b33e-b48fecd1266c", "comment": "Malware payload", "value": "be89ab830a708dc1a53b7f693f115066834a86e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761644117, "uuid": "ab757857-8fb7-454b-868c-026995b5969f", "comment": "Malware payload", "value": "55b269ecff7d0fcefb0b369cb08bc23d2950c20f8c7221176b1dcd1e8d0466d64efd2499a746d68246b7b3f9adca0c72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761644117, "uuid": "fdd965fe-ca00-46f0-a5da-af49f51a6072", "value": "T139735CC2DB43E5FDE96525700077AB5A9F7AD43A113CEA81D7E46931DC22B00DA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761644117, "uuid": "c091ccac-3e28-4ed2-b16b-b8671f0e0138", "value": "1536:aa8aLzRLdTJe+U8EfMvBYlVtIMCAl1M7Tplr8sC3:tDLzRjOxVtIDAlOXpmV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761644117, "uuid": "ad167c42-b43b-4558-be61-595990dc4b0e", "value": 79116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761644117, "uuid": "3dba8fda-b201-4ee2-981b-bfec093e6aeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761644117, "uuid": "8d929d0d-a9b1-4e8a-afe9-6dd6842b30db", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63d8d30-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761640380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640380, "uuid": "8371759c-b964-4353-877a-af005b2e00cd", "comment": "Malware payload (AgentTesla)", "value": "45e119ab239f75fe40edb66b0685f379", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640380, "uuid": "815c2964-3c70-4f20-84b4-d2a7680d80cb", "comment": "Malware payload (AgentTesla)", "value": "a4fb04f808426cb820c3a3f9a4ccd608d060c0e821435596fc1c766272807e1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640380, "uuid": "625e3579-79f8-4b40-9d45-890c26b9745d", "comment": "Malware payload (AgentTesla)", "value": "502b4d236c96b24d2ab45b217f0c249669df5027", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640380, "uuid": "bdae88b9-113c-4fd2-9faf-f03ec065ac2b", "comment": "Malware payload (AgentTesla)", "value": "85b16d2dcf4f725004b1a8dd39ec55c490e14aa6d479f6c0a31d25033fefbb98c2057e2384cf24155717ee9b1ed676fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640380, "uuid": "5492f0d8-f114-49dd-9abe-a9b66503f655", "value": "T11645022589881FB5CFAC5A1880FE160E93F0068F9517658BFB3BBD4AAFF7544420B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640380, "uuid": "1725ab89-f16b-482e-a90f-c0d79c0b08c3", "value": "24576:TSEEiv3B7CSbEEMBsAQ6Rzdp+VaeS6D5W4LKUtPJ3Krqzg:GExB9UT+VaeBwUGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640380, "uuid": "33adc93d-1da3-440a-b3c3-0dadfed5e6fa", "value": 1237779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640380, "uuid": "23f767c4-f444-447d-abef-64471990b865", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640380, "uuid": "88efc450-7732-4462-b3a6-8b38597731ed", "value": "PO-7Y7EW344.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace4bc10-b426-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761673865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673865, "uuid": "d9a8075b-b6d0-43ac-9191-e3d25bd7f4c6", "comment": "Malware payload (Mirai)", "value": "2387b6d7801bb1a2ae9c3aa8a31367dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673865, "uuid": "8b2a3edb-b235-4c42-8bdd-54eec8e674f5", "comment": "Malware payload (Mirai)", "value": "a56097fdaf80a9f7e027e15c8c6d1a21825593a367e50e3a661e37ec205ba0f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673865, "uuid": "a9f856d6-59ea-470f-aed9-19726da68ed3", "comment": "Malware payload (Mirai)", "value": "74ff4e960e6168548908d4d146d9e268929c6b0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673865, "uuid": "03881c25-83d1-4d58-aa26-3c0e54c88eb8", "comment": "Malware payload (Mirai)", "value": "158c887fc52aefda4d9de8633e5727c415344900c661a0ef76e91aeb5f45545ec7ed23578ed47aa19c147693a41f4437", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673865, "uuid": "d03d1566-fd0f-4608-bb43-ac8c2edd8a2e", "value": "T1D95302681FC093638FAA7F7E0F4E24C1E535251DF926DC9D50E01D8891AF4D604ADEA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673865, "uuid": "bc80f8c3-9097-4e9b-a491-6d925a29a573", "value": "1536:yZBNffF55VIdBqfU4mk2WdtRmSVQEIUPl/pyoq1+D:yxd5kvN0b3QxMl/p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761673865, "uuid": "61b2e232-7f52-4fb1-8ae8-655c99d8f146", "value": 63856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761673865, "uuid": "0f17d751-7f40-40be-9ce6-701430e38069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673865, "uuid": "b407d563-b4f7-42b8-851a-29b8ebf367b3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4afc8c-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761646431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646431, "uuid": "adcacfd6-7cac-4a85-a684-ac6662e932c2", "comment": "Malware payload (AgentTesla)", "value": "49269c2c74f14d99fae13730605b23fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646431, "uuid": "af68eabd-2406-48b1-ad3f-13d3417c0845", "comment": "Malware payload (AgentTesla)", "value": "a5a4a5447b51ed494efaaabe4359b3e674185659f491dc2202f4082fbf2e4db5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646431, "uuid": "6e4fdbd6-a346-4630-975b-70af513f4d5f", "comment": "Malware payload (AgentTesla)", "value": "e6d89f986087965bb2378b8d70d4c7ca07bc3f2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646431, "uuid": "411b6e33-b683-4613-9d6d-73dbab48f920", "comment": "Malware payload (AgentTesla)", "value": "b6430f2b07480898289ca889d12420bfa4be00ee16227a80b4673aa4aad4c1f02a5728f44151fb78066b644906952097", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646431, "uuid": "bc30953f-798a-4056-a44c-d79e0c6b2268", "value": "T1F7E412683325D403D5A153B80AF1F27613B86D64DA22E3CA9ED97EDF3AE6F005C10697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646431, "uuid": "90ed9258-1454-4899-98f1-d8c568d60803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646431, "uuid": "d7cd63f9-a743-4fcf-8b38-c25a1ea67e5c", "value": "12288:+cVbQF6eS3vObBVtQioBha4vywjMMVruzOaGx:+chQF+ObBVCTLqOMO7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646431, "uuid": "1fd6c370-ff45-4a0a-bc76-ed69484e8169", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646431, "uuid": "fb221cbf-e73f-4604-86da-c94b0ab68154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646431, "uuid": "036b34d2-665b-4979-94e1-07f1b4bfc8bb", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39218575-b409-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761661215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661215, "uuid": "40ca9196-ded5-4589-8af3-93cda1ae8edd", "comment": "Malware payload (Mirai)", "value": "d034df584b8b411f0459e2b55685540e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661215, "uuid": "be14fb14-c123-4b4b-8ae5-c69bc17ba89a", "comment": "Malware payload (Mirai)", "value": "a67086b5ee74d6b2991598e37312bcc1455dc4b0ab0af3ac9486a51eb33c62b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661215, "uuid": "c7bfa482-0872-457a-97b2-76f611cf419f", "comment": "Malware payload (Mirai)", "value": "6d17fa9ccfeb7c2e95f3d89748bf222b8eaf93ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661215, "uuid": "6aca9d57-0f8f-4227-a3ea-72b4abc84862", "comment": "Malware payload (Mirai)", "value": "59626b6f76b5dd2536bc254bc8dbb3b041543191d494e38bb7496f10e66c39c97fb5ad75c1e0c11676630604b443c99a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661215, "uuid": "35ca43c6-9d14-43f0-8fbd-86b45e445e21", "value": "T19FE31945BC518F27C6D522BBFB5E428C772A17A8D2EE72039D256F20378B95B0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661215, "uuid": "ea86d73f-4e5a-4c3f-b33f-a32deefc63ae", "value": "3072:G0CpUom88gJAXwXcm41Kq4Iq92MG50qJ:GXvmjXwsm41dzq9nU0qJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761661215, "uuid": "5a3ad0d5-c8a0-447a-ad6a-cc1b99908d17", "value": 154212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761661215, "uuid": "12752168-6ead-4a90-a062-86a7d5430099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661215, "uuid": "5256a27a-b2b2-4475-821b-47cd04ac419c", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c560716d-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656726, "uuid": "023246b1-7e5a-4668-9a15-ec6de054fca9", "comment": "Malware payload (Rhadamanthys)", "value": "915d60287b5e4ccf8d2961f90478c810", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656726, "uuid": "cf3feb93-09f7-4c05-a812-0504e9a2d830", "comment": "Malware payload (Rhadamanthys)", "value": "a6a57c81a0c3236411c52db1f11a0cd513048cc23abf09a3707aa0ff939df2f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656726, "uuid": "6826c70c-8b72-493b-8c69-323f49ffde18", "comment": "Malware payload (Rhadamanthys)", "value": "cf76b11e58fa21a77265cf8f41bdbbb6d6a45f59", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656726, "uuid": "442aac48-4168-4dc7-87e6-6465475db813", "comment": "Malware payload (Rhadamanthys)", "value": "5bfa157231e7796109bec38308dca9bb1a0296c6eb8c19bc6a25f55f98e99051c7883c79623408305c8d693cbb34e1d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656726, "uuid": "2d4710de-9457-45fd-913e-f7e08affb7f2", "value": "T1ADA32AF98C33EEF89016A6BB78C27EF04D48B44606D0698CA42D36BAD31D95498375DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656726, "uuid": "e5213cac-67a3-4e58-9420-b5d748e1fbc3", "value": "3072:GDB7b0vTvWG6AVaqhPZCkk0gI661g1n4PQWU4GRHbLYTCegnc6BkQWkp:0ITvWZAVaqhPZCkk0gI661g1n4PQWU4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656726, "uuid": "56aba8f4-4ed1-464f-97c0-cf0b226021bf", "value": 104069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656726, "uuid": "07969688-a1fa-4148-8404-a0f7101a5a58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656726, "uuid": "b1920320-354c-44dd-9244-2fa3dc1c5dd8", "value": "invoice-1637482117.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacd5ff1-b459-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761695873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695873, "uuid": "8757c5ea-9c44-493e-a04b-0aa56720fae8", "comment": "Malware payload", "value": "10590db89a8152ca2108be85c1b80e8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695873, "uuid": "cf1fcc24-9c0f-4339-8312-d03148808607", "comment": "Malware payload", "value": "a7c10641952b8d897ff4e9062eb9f039047cbf96cec7e0f91272e9d0575060d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695873, "uuid": "23764db6-f5fb-4f2e-bbec-287631104aa5", "comment": "Malware payload", "value": "260626911d09f88ec6a57e4c9f236fea1583c31e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695873, "uuid": "230fabad-833d-4de3-bd55-62dfe64b7825", "comment": "Malware payload", "value": "537f7f68a6cb3ca0889ddeeed1d250b6021901161deb32f2cc5ea072b61e5159ff49fc67675d0323a4c458b5ef4ec5b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695873, "uuid": "c0e80495-700b-4ebd-bf8e-b93bfba49930", "value": "T1C4231A02A686C6B7D4832BF606E79B210132F97D1F178F85E32DBCF48B625887227755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695873, "uuid": "50ae3e2c-07d8-45a6-bc67-d750e0e0f1a5", "value": "768:dRxm/aDxX7Wq3X5RJrdNW3Jq/BgxSh//Id8Np/EIBkMq0uwcS:TUS9X7PnDA3JquK//IWp/E/DScS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761695873, "uuid": "12647e4b-b9a1-4b01-ab55-cee65f2d9491", "value": 48012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761695873, "uuid": "2ab92874-18ed-49c7-985d-b74508632065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695873, "uuid": "9811a937-792f-4772-a329-97f8eede6e22", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f9ba1b-b412-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761665001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665001, "uuid": "7d6fa217-1f6e-4acd-aab4-38aad8e1a4e8", "comment": "Malware payload", "value": "11591e23b1d75a593439c699fcfa0b56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665001, "uuid": "54d32813-186d-4a28-920a-bae35127a2ab", "comment": "Malware payload", "value": "a8718494d25e20141dc3a01324187c4663dba471c4a07924a7830bb884b31a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665001, "uuid": "e325672c-d3db-41af-9842-d2d438f72403", "comment": "Malware payload", "value": "aadea585f1f7c49c6d8a2ed0bd09d65a7b289e59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761665001, "uuid": "c8c4d114-2651-417c-b56b-707074ec5721", "comment": "Malware payload", "value": "25a1b11968a909d4ea5f9ad7787cbb55a39800730b8d3ec6a8056a7c829a7af482fc0710add65ca869b3a1f351c4da21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665001, "uuid": "9629ec51-5da1-45bc-a14e-d7226a5e8d5f", "value": "T13153050B779950F7E87AC23999826229BAB1B0B413321BCF514159792F727E93C3DBC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665001, "uuid": "7d80b086-9cf6-4182-af28-c19b91f70ffd", "value": "5e46714c4996e21efc220aabbbeb0fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665001, "uuid": "3badf7cc-36b3-4f23-9f1b-44a3ab6d767a", "value": "384:u3+s+G2w7vA5TWTTqlHP+neNLOTLbgxaFiIO0W1swNOZxwBNXHlTdQfBB/9qnB/P:a+RPxllwI+be8iccNXHaBapl6CAAog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761665001, "uuid": "24497bb5-abd5-4b64-a88a-9617b9da3294", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761665001, "uuid": "48bc9f52-610e-4e91-b01d-1b75476261f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761665001, "uuid": "194769fd-0db8-4045-aeec-517a060a17a9", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42e141b-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761634873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634873, "uuid": "7fde2f87-559c-48ad-9cb4-7c590df4cbb4", "comment": "Malware payload (RemcosRAT)", "value": "afa2b509fedfc6b41c9ffa214cd188ef", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634873, "uuid": "d68998f6-bc5c-469c-96bc-c30fb56d2be7", "comment": "Malware payload (RemcosRAT)", "value": "a8a6de8aa7e19d3acc75f18821cf5c10fe104ba6f0fc8838533ead75b3dafaaa", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634873, "uuid": "1fb66780-3f5b-4da9-8f87-9bb8bd4769ea", "comment": "Malware payload (RemcosRAT)", "value": "aa957f152e17d39d2f61a682bac6441334942d22", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634873, "uuid": "6d41c03f-789a-4dbc-8dcf-ba156d61c39e", "comment": "Malware payload (RemcosRAT)", "value": "6df8ed10f2649086840857807c2942431d8175e14c3d121c1eb8b10733879964558b1c71e7c91d1a3dc0cdb94c41d31a", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634873, "uuid": "511ff1ee-f835-4fcd-a210-0beba7b51ee4", "value": "T1C0C5B05D94B05C926024FE74AAC5F7938CE917851A1B4B930FE5E2A63205C43FFBB362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634873, "uuid": "606021a0-c03f-4d4e-90d1-7a8535b4ab2f", "value": "24576:1M7gpnZ7BIS9xzFFb95hMkKbzAdz3mslXrRI/rxV:dyZ/ADu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634873, "uuid": "369f70dc-0630-4239-bb5d-033db9284e9b", "value": 2681070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634873, "uuid": "adbcf69f-d5bc-4f9b-bc66-a01fefb89ffa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634873, "uuid": "c4a679a5-9ebf-470c-b062-6b900c2133d1", "value": "SWIFT Mesaji-2522ITMM25010870.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5f85b0-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656657, "uuid": "0fb9685c-b70b-4b45-966a-8cf979665469", "comment": "Malware payload (Rhadamanthys)", "value": "f463a03695e9c421fe8b5e060b0f6f35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656657, "uuid": "3aa92714-5708-4e96-9f32-ee030f864b57", "comment": "Malware payload (Rhadamanthys)", "value": "a91e7a6610078f494ee040dfd0a617a129764ac2cf4a494fe788cb75f54a1b80", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656657, "uuid": "bc284747-9837-4ba9-bfea-4a39ca84a358", "comment": "Malware payload (Rhadamanthys)", "value": "9d0cd6817a30d1e1a7dd988d252274f89ae130cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656657, "uuid": "84656092-4615-4ea5-af2b-32b61ebbb706", "comment": "Malware payload (Rhadamanthys)", "value": "716d3da00627140c2d375c23ab47189175fa77c487a892be572602fadc76e9613b46b9d218715c4483cb026f6f974191", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656657, "uuid": "897d0048-fbfb-4b0f-8e96-1309e21cc722", "value": "T120A3FBC81357FA69180D76B56CDE2BFAE628F503941C3BE74A16B3242600EE31FB3595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656657, "uuid": "18c53258-1d96-428c-b519-267f40526528", "value": "3072:GDB7b0AN333y3c3Gf3o3w373bg3w3r363CIL3J3q3I3y3A3h31x3e3g3w3c3eP3a:0/N333y3c3E3o3w373bg3w3r363CIL3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656657, "uuid": "4314d7b0-1862-49a9-b6cf-1db360b634f8", "value": 103928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656657, "uuid": "7cf30e97-884a-4362-a5bc-764dac79ed26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656657, "uuid": "06ba0ba4-a24d-40cb-9ae1-096abbc68c2f", "value": "invoice-1637482117.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8906a088-b405-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761659631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659631, "uuid": "a60984c1-c0d5-44f6-b2fd-15627305d723", "comment": "Malware payload", "value": "0185f7799317d88eb7c87c1d2fc53ab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659631, "uuid": "9d900474-6923-4010-8057-382702ffaff7", "comment": "Malware payload", "value": "a9522fbe86712f17679ad5d900408cb1258886896c219bd647253ef54c36648a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659631, "uuid": "72d0da46-186b-4617-b024-5825054ee2c5", "comment": "Malware payload", "value": "2a42c47c8a695cc493920a6d6261fb2acc416dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659631, "uuid": "973d52e0-47c6-44af-861a-25ce1e394b49", "comment": "Malware payload", "value": "d007962915e18eadbce150f7730c9752790ceb4c9763c2805f681eddb5988d49462e55402d4fa18e2ec67b65b04d2e8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659631, "uuid": "15767466-5aae-40d0-baf3-6f43122df09c", "value": "T1CF743A229EB98100F177D13C32E6E613F12B784D67E4E19B8D9CDA0B2361B4375ADB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659631, "uuid": "74283c6f-d5b8-430a-b683-cb8757ce3d60", "value": "cd25810e51c7e40635699cea0d979242", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659631, "uuid": "e4b06192-29c4-4156-94d5-3160bd6f6f3e", "value": "6144:bYZ/eKmFpAYlBpRR2bs+NwgVdk0oypA2z60yfG9ZHG3aH5eCUg8Kmv:uenFpH3pR05wgI0vRycHDeCGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761659631, "uuid": "2e61a982-f5b0-4d15-a0da-45a78d5d52bb", "value": 353496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761659631, "uuid": "cd5e9e00-d80c-455e-b05c-5173e4ef831e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659631, "uuid": "ea7fae8a-d4f0-40eb-abce-347de41d743b", "value": "winrar-x64-713 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d7b127-b391-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761609638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609638, "uuid": "241e7ad7-3641-445a-a160-00ae2382d809", "comment": "Malware payload (AgentTesla)", "value": "0bb812a4408054c6cb973bb63ed6814c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609638, "uuid": "10fa8c71-999f-4f8d-bee6-0c8ad08faaed", "comment": "Malware payload (AgentTesla)", "value": "a984813178a55c1bb5407453357bf865518ac973916a4efc69ce7692a11c6cfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609638, "uuid": "0347ff4f-f707-4030-96d1-b97e6d7c77f8", "comment": "Malware payload (AgentTesla)", "value": "67d27613931231ff520bd56f0c2d857d7ad39bb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609638, "uuid": "4f435d8f-a13e-440f-b2e8-7b5033db5d57", "comment": "Malware payload (AgentTesla)", "value": "63c27f63e05233ec13ec5f5fc985c3162d8ee821fa8683e137980be5f88fb0d54a7fcdedb5bbb4e048f62020adb922a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609638, "uuid": "ef71201e-9a8d-4bb4-94f1-9869eb025444", "value": "T13862228D7D8AB1E65362E8232E3BF4C9735A5980F9CC8157F2749160FD60718F9E2838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609638, "uuid": "b56a5ec2-3cc2-40c4-9fe3-c7464a1fee65", "value": "192:gh9CRUzAm+loXNos8m4ZlFFMfubO49CvTxwIMPZVkgApbofKsvUfqkvmlsm:o8cae9+TMfydHnRRApsSryYe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761609638, "uuid": "fadc1f20-6568-4d6b-9e36-172bd9abce99", "value": 15435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761609638, "uuid": "c72a0616-a27e-4079-9aa8-51ed63b45dc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609638, "uuid": "5d09e2d9-b6d9-4f80-9ded-00ff83b70ba2", "value": "Payment Silp.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c2a15f-b3d9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761640647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640647, "uuid": "41bc3ac3-de17-4418-907e-a56b8c9e9fb0", "comment": "Malware payload (Mirai)", "value": "1776d2775f172b774a01c58bab8313c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640647, "uuid": "c635c528-8e13-4feb-ab6d-54bffd3da242", "comment": "Malware payload (Mirai)", "value": "aa494ce4d3a15855c8980f87a912e65faf59bfbf4229e53191b6b0ebea803c41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640647, "uuid": "9808518f-40b2-48b0-9450-d0abdee46b07", "comment": "Malware payload (Mirai)", "value": "d72358a7cee326e8562b658c12366e61ab58a3f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640647, "uuid": "b8225a0a-af0d-4f59-9af6-e48656ad1cee", "comment": "Malware payload (Mirai)", "value": "2e5f110f2d29467469cb73c6c8b561bef167af211314f978af7e4d3f24ff943e10debaf00649e5443e8c8e726a82b19f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640647, "uuid": "ed5e34f4-5589-4706-984d-5041ff49bc19", "value": "T1EDA33855BC829A17CAC4137AFA1E42CD371623E8E2DE3217CE215F2137CB95B0E7A552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640647, "uuid": "b9085306-21b8-4582-9765-e671739debe9", "value": "1536:Yad8U04e5I+VV++qPpqVC8x8eVp5DI8pXWIhDjwh4+d4fT4DMPVb7y1vLDC:Y+O49+Vc+qPEx8SSLib4gVMLDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640647, "uuid": "3b6424be-b8cb-4298-afd7-292e0f3edaa3", "value": 100600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640647, "uuid": "b3978db7-0d81-4f15-b1fe-61628924dbac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640647, "uuid": "3be748c7-ca10-4e09-8a8b-e9c056dd245a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95c538e-b41e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761670423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670423, "uuid": "cccc56b8-728f-4263-ba3f-5c9b988cc14a", "comment": "Malware payload (Mirai)", "value": "d53bd344b9ab4a8d91db2ee4d6ea1b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670423, "uuid": "e6783d1e-933c-4d3d-96b7-518f4839c6ed", "comment": "Malware payload (Mirai)", "value": "aa6ddb30d15ce6c0a83afbe6dd9a560e1e5d9fd48bf3a86cac2e7b89be4d4115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670423, "uuid": "091bf067-86aa-449b-9297-0f9cf228b854", "comment": "Malware payload (Mirai)", "value": "0185db392e9173086e4ee0be7d8977f772242d17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670423, "uuid": "65e697e4-74af-4b05-8cff-06af22a8a2e1", "comment": "Malware payload (Mirai)", "value": "f84045d7ed76b4d8c0c9b5ca10dd49a68430055944313875250d0783177f4feb8c13e6adee91454fa2c53a31a93f9af2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670423, "uuid": "a8570536-bb7a-4002-b273-e7d0d6318d36", "value": "T136C3F199FA676991C1A246FDA4C04AC3C3906A728BA22344028EF774397CCFB1F64DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670423, "uuid": "703808bb-bb79-4042-ab2e-3ce4f0134393", "value": "3072:8UBHAK+zaYnijF9dbuYXSSg0+clm2CUczjMMTns:8imSP7XS90+WcHxTns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761670423, "uuid": "07ee80d6-ca8d-4a45-909e-9789457974fb", "value": 123720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761670423, "uuid": "3b276fa5-0516-42d5-aafe-a421af5ea24a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670423, "uuid": "08fe4167-bd7a-44be-91e8-b439a69b6fc2", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda053d8-b451-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761692388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761692388, "uuid": "7fa6e61f-5d49-429c-b353-28c01ea80e36", "comment": "Malware payload (Mirai)", "value": "8677e24fff9059cf43192cfd2dd21b44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761692388, "uuid": "d3949b48-8049-4631-8035-6421e1c5b68c", "comment": "Malware payload (Mirai)", "value": "ab6249099e155478f9c39fb81e44bbc259a5a07c4653ceaab3e2a13f5550b5fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761692388, "uuid": "87df441c-759a-4d62-8f61-97e837908291", "comment": "Malware payload (Mirai)", "value": "662f8d8ae31f58044e3e3641b12386672fd85eb5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761692388, "uuid": "3ce7d837-5c13-4184-8a33-a8f9a500dc6d", "comment": "Malware payload (Mirai)", "value": "3300e91da6f3a62472467165003dd4648631b9c9d77519a069cec3f9496e1eaddce3bb5f50f18066081eb0b61ecb663f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761692388, "uuid": "0b0b43ce-699f-4d9a-aac9-b482d1fd6071", "value": "T1733150E4305703B52DA3DAF3B2AD450931E26BE794E0EE2564E8B4A9424FD147453E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761692388, "uuid": "0757eb93-50fc-45aa-84ba-49c7906c905c", "value": "24:vYeaLqWeaAcceaJyeajea2JeaVea1eaUeagEZU:v/acaAcaJpaqa5a0aUaLam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761692388, "uuid": "aa2b6654-a728-40c0-9a6c-8c62207fc89b", "value": 1693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761692388, "uuid": "888d8423-c0bc-423b-bafc-9158875ade43", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761692388, "uuid": "e401d6e8-d1ce-4d26-aa91-cc4cee128387", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f75372a-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761640314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640314, "uuid": "b80713d5-360d-429f-a0a9-3108ad466778", "comment": "Malware payload (AgentTesla)", "value": "515c9667df7548e387b77857ff3c1f76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640314, "uuid": "44643c83-8814-4690-9cdd-d89a59b9f171", "comment": "Malware payload (AgentTesla)", "value": "ac02fe40e699c489822bb617932592590edda21a14116d22b1fc7314b49c5db9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640314, "uuid": "01865b02-fcb1-4c89-9246-367b26089a45", "comment": "Malware payload (AgentTesla)", "value": "cb04e10ea181b8701da655bebcc4bdf16605ee47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640314, "uuid": "f93bad45-5883-4141-ba92-b6a8afa1d12d", "comment": "Malware payload (AgentTesla)", "value": "fd78b3d066fae7a749658f8737350c62648ecb2c575ed68ab5b26e2d8363c81af551409329305f9ab4a3316896091f4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640314, "uuid": "32ec8f2a-100b-447f-bec3-908f68ea0577", "value": "T18845F1158DC86FB4CFA8491890FE161EA3F05A8E5127698AFB3BBD47AFF7504020B1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640314, "uuid": "f4373725-3795-456f-94f7-25dbe13e1a33", "value": "24576:iXbcUF3wDhwHwlWwmvfvx/ELee3iYSxqZhtdJy/YlMtBO:fbhWwFLeQbJnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640314, "uuid": "2ae2ceef-f6f9-4202-a607-1452364cc6ff", "value": 1261546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640314, "uuid": "95c58c9f-7fa3-4df9-b4b3-d905646e675b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640314, "uuid": "0a10eb66-1024-4665-8942-ac75060508c2", "value": "Nostro Ordine pdf.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaa9f17-b3f7-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761653678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653678, "uuid": "ffc9c72f-e706-4a5b-9d8e-4198a588ebf4", "comment": "Malware payload (AsyncRAT)", "value": "ac16cff4e4146906295d233cea1d26be", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653678, "uuid": "e4683adc-0a2e-4f31-b1c0-2e38cf1552da", "comment": "Malware payload (AsyncRAT)", "value": "ac1abdbe6b3e95b6096d53cd02cd8c7c7456a342f9cac0f13e4116a5d866a43a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653678, "uuid": "358f8440-52a1-41b0-8378-e83b15bfff43", "comment": "Malware payload (AsyncRAT)", "value": "d990765721d2512bf9f69dec476fc4751497cf15", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653678, "uuid": "35c9f221-e01e-406d-80ee-f698cce0e168", "comment": "Malware payload (AsyncRAT)", "value": "ef9944377b08916959125722793039123265aaeab3b5f002ac10afdf5edf26d23f44d75060f5c83a0673da4e27e3242c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653678, "uuid": "0097e10a-5dbd-4e50-b4cc-399cb443b3da", "value": "T12CA4016867AAD403E9A6A7745DB1F27906397E8EEA30C34BDBC95CEFB521E504C40313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653678, "uuid": "c8cec7c3-5ffb-4a76-85db-e84c573efef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653678, "uuid": "bd0dc276-8f7b-4613-9460-1935afd18034", "value": "12288:lOnmq09TyiNgrN5S5fhsqylHOOg29JLEDvlzI28o4a:limHYiNgrN05ZvylHOT2TL8FIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761653678, "uuid": "4bbc95c1-372d-4801-acd6-bc7b23682359", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761653678, "uuid": "9fe928d8-48b5-4d67-8a5b-a6fc6afe35f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653678, "uuid": "0e922b6d-25ad-42f2-9de5-ee8bffff70d7", "value": "BTR9876545670000.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb56bfa-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636260, "uuid": "759820f2-4bfc-4d71-97fb-92699044a0fd", "comment": "Malware payload", "value": "e648a6894d7555e57b86c48c1d0251e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636260, "uuid": "6c77c404-0e64-46b8-a484-9ab0aea78839", "comment": "Malware payload", "value": "ac485deee815191cb98de5a9635607596afe653e4d8fcb76700caf82e6f603ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636260, "uuid": "923f8807-eafe-4ad8-8ac2-85376dea7295", "comment": "Malware payload", "value": "28570b0c94880b48f7cab6f138123bd515b51439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636260, "uuid": "8da62fbf-5d58-46e7-a1d0-c47ef713a881", "comment": "Malware payload", "value": "bfa1c4a48c0d6f0dc20b98c3e11c3d77bf24ba69ee89eb5345ea93fad72b85ca2370ade2a8e9e8a7122d32dbf00416ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636260, "uuid": "0161b80b-b8b0-4282-8005-3dbb7487d713", "value": "T10F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636260, "uuid": "65928893-de48-48e3-b3e4-d96171cb3692", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636260, "uuid": "bc368d3f-8e21-4406-9fe4-3b4dde963153", "value": "98304:a9T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:O2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636260, "uuid": "87f2452c-2615-46b2-a5e3-9561c7f920ad", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636260, "uuid": "e33c5bd4-e59b-45bb-8a7c-5dfc006ab169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636260, "uuid": "6a79c336-41bc-41c1-a083-147c630ccebe", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51abba1d-b42e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761677148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677148, "uuid": "f33f848d-9751-432b-a284-f415da623780", "comment": "Malware payload", "value": "95346e8f5954c7ff3f90e864e2b60da9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Trojan.BAT", "colour": "#76EA0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677148, "uuid": "7b3f8abc-0b75-4e1c-a125-57550943766d", "comment": "Malware payload", "value": "ac5ce135f96d67e8cc61887a9343468f72cd034af266ae65da2d5f1797ca28e7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Trojan.BAT", "colour": "#76EA0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677148, "uuid": "f0dbbbdd-dcb0-489f-8062-524397b72842", "comment": "Malware payload", "value": "145f3a43d27410b21f6e4a42606225e02e7cdf2d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Trojan.BAT", "colour": "#76EA0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677148, "uuid": "5c016651-190f-4cbe-b270-412bdb431e3d", "comment": "Malware payload", "value": "4ce63bcfc2ee95fdec47f15336c0a69e506a21c360170b4845d8f5704fff2f59d36f19de48e426b5df4a8ea36435b4a7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Trojan.BAT", "colour": "#76EA0E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677148, "uuid": "5d272eed-7e58-40d9-8eb9-4aa516a8e4bb", "value": "T1A2549C6C36D20C281A6428AEB4ECC1477E5985D30E27F6CD02DF819AA74F3A55FF8D16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677148, "uuid": "398d92c1-a3b1-43dd-95ca-ee266f6c033c", "value": "6144:CGbojZIdTP+f93oJxeeQwS0VSmaV68+YX7U0u:PdTc9462R8pUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761677148, "uuid": "8b7853f2-8222-4606-bb9e-f5ad59b1a197", "value": 282418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761677148, "uuid": "26968409-20bb-4b1e-a3f7-304aa3f7e76b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677148, "uuid": "3e162c69-67a6-47d0-9a2f-5e50aee93847", "value": "launcher.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a64c148-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761639742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639742, "uuid": "0aab3db0-f381-443a-b215-5b6df24820cd", "comment": "Malware payload", "value": "2453c21f63804119c6c0c7004482a1c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639742, "uuid": "e77f995a-143d-4881-a439-cdff2d1c732a", "comment": "Malware payload", "value": "acf2b498af5720755c800dee3152e9774e25808f793b0cdeaef58511b27f446f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639742, "uuid": "3087bd75-cdbb-4931-baac-e311db599ee8", "comment": "Malware payload", "value": "6b346b724a9275b106a482e8d177e746a1698a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639742, "uuid": "ff700914-06f9-4ba1-8059-45f40353bfe4", "comment": "Malware payload", "value": "088ad84cee535d56c24632ce434b64002e29fb83500c97a94d5d2e39c4d78c429c924318b3f9e4f7271e4323a55dee6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639742, "uuid": "aecc4433-779a-4e58-baad-a82eebe0dc80", "value": "T10E64882539AF601EE2737F353BE9BA8FF72E63712A17955B5200024B0D12D818F62779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639742, "uuid": "ca761c7e-55eb-4b4d-a809-c655004312ae", "value": "3072:0AlsrKvofVbzS5socz5BEdLAMNU+ANjdcNjMxzCum3aTYcpxxs:Ds4YVbaW5BQA2UdFxzCum3aUaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639742, "uuid": "26bdbb28-643d-4f9d-ab6c-dd0b71b6f4cf", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639742, "uuid": "700e3640-fad2-4b24-90c2-af404cb16262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639742, "uuid": "8c42ec5c-ea65-40e6-b5e6-47ebf56565ce", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315b8efd-b41a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761668503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668503, "uuid": "c1b14396-6882-4674-afbf-6cedb182ae98", "comment": "Malware payload (Mirai)", "value": "cdba26ea10327638f410d7940f6c7ba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668503, "uuid": "865ae909-c019-426e-8981-bc42dd5b0cd4", "comment": "Malware payload (Mirai)", "value": "ad16408499ca43a4bd96d239a768c07316329c1db5b309ca4a3d09f01c507b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668503, "uuid": "926c2722-376d-4cdf-a080-eaebd0b5820f", "comment": "Malware payload (Mirai)", "value": "52b939f840f21d06701a239def065acfaa309e6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668503, "uuid": "52f090aa-5b9d-4ed2-a14f-44e9f05252ee", "comment": "Malware payload (Mirai)", "value": "34d4a11d30c4fde5027626025776291e887fc8edfe3e707d8aebe1f79bb0b56a26b42034e25fd5901aab6521fa84b560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668503, "uuid": "9f70c5ae-b95b-4f45-97cb-82471c03d058", "value": "T1B1A32855BC829A17CAC4537AFA1E42CD371623E8E2DE7217CE205F2237CB95B0E3A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668503, "uuid": "8c3b8db2-cc5f-492a-b202-c3746c78d9f8", "value": "1536:3T8a+gk1r2Cyu6WPpa1TkMp/yBp5DI/pXGIhDjwR4OdIfT4E9/xab7C1vvDC:3Qa7kB266WPGgM1qxLSb4AacvDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761668503, "uuid": "7d0792ce-9836-46bf-a214-d5d2f745841b", "value": 100616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761668503, "uuid": "067a0b44-1fda-497b-811f-bd579a635c72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668503, "uuid": "b3ac8081-edee-4fc4-b1c9-ffe41ceadf71", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b414e0e0-b41c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761669582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669582, "uuid": "b56bd661-ce1f-4adc-af19-2d7a6f802aa8", "comment": "Malware payload", "value": "535f981323353419b58fc06f6afd5bda", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669582, "uuid": "db22711c-a88f-460e-a380-4b9b629ba7b5", "comment": "Malware payload", "value": "ad8dc63bf6a91bf6f0220c59bd6fd6c754c344ae9f1b15aa4ecc875d3a60827f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669582, "uuid": "0b29d816-9958-4134-bbbd-7d575aed0c71", "comment": "Malware payload", "value": "bfc8e882d58076d2993aa8c4531fe8c90543e275", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669582, "uuid": "2e8597f1-83db-4fef-9cfb-798007c4c894", "comment": "Malware payload", "value": "06c122bd90713f6e8d165026d2c7bba440418cdc8c169bcf5a793d2d8c3401b58c84e75d51f16ef9a0508b8779b2e3f6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669582, "uuid": "0a87b0d2-f401-4a39-8286-06f3cb29c8ab", "value": "T1DE516D9E0200DB31D70C8A5FF7F2B1B4A10FA183E6EBCF46A950186C0EC9D4CB686E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669582, "uuid": "7c9be54a-780d-4eba-9dda-af752aecddad", "value": "24:pJk4942JMvRxRbiBTtituZLsEcsEnE2EhEmHnscicbwGukYEvxvJUfTbYb9bhM3S:FS2JMZnbiBxQuZ44cvyZpbwYFhM3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761669582, "uuid": "3dcea66b-65bf-4534-bdaa-f90d774639d0", "value": 2933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761669582, "uuid": "c4546f98-57e0-4541-b58b-33ce92cd4a38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669582, "uuid": "05380d27-57c7-40f2-b245-1dc8f869b05d", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8819020e-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660059, "uuid": "4ba55122-789d-4fcb-baf8-08ed7efe4d70", "comment": "Malware payload", "value": "ebeab5f47a2ea33c6e4f6a11c37dd9f8", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660059, "uuid": "a9c6b41c-d935-4e86-8f13-8d54033f2a21", "comment": "Malware payload", "value": "ae983051c548d572acb8e6830bf8740914f5d1f5c8a3b8413692e76a60a36ea6", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660059, "uuid": "bfbfc5b9-b882-4752-be13-3be1e20b2b17", "comment": "Malware payload", "value": "2498269ef535db1fd610028c0a45121d0fc8804b", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660059, "uuid": "a867d762-05f9-4e2c-9618-9851eff3756e", "comment": "Malware payload", "value": "f23e553e6c594e59e9567b8d4ca727de8aa7009a0a610a74c845b7222704c111960d21bcb9c2cf38aaf48b4cafdaa187", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660059, "uuid": "4358bdf2-2bfa-46ff-a048-db1a75254752", "value": "T15241344B9C48605DA071D716E8D4548FEF5F142FA86A065B38FE804E2FF036C43AD69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660059, "uuid": "857a25d6-eb2f-49f8-80c0-3ffbe7720a9a", "value": "48:gk8jxAib44BUO1XogVHay4BhfGGYzuBSkfipNSNXKiOo2TER0I:4xAKiO1Glhuv6AncygRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660059, "uuid": "bfe85ac2-409a-495c-a517-9ac1be71f27b", "value": 2074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660059, "uuid": "e1fc8bcd-f559-4b51-ba28-6962202399d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660059, "uuid": "2f3a534a-a555-44ef-beaf-6ccb43aff3c7", "value": "alter.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43671f37-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761635892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635892, "uuid": "79db9605-4f10-450b-a2d9-45d8ad4519c4", "comment": "Malware payload (Formbook)", "value": "923bda96428654f4c5d04a2523094849", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635892, "uuid": "ca338fae-85cc-4be6-9ea7-13f6c180923d", "comment": "Malware payload (Formbook)", "value": "b018350b6bc1b79b22a9a03738f76bcb67e7bc635857b89eb02f4a8a3e67f78c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635892, "uuid": "7a2046bd-7597-4e1b-82ce-e48f1d996c3a", "comment": "Malware payload (Formbook)", "value": "46b83fa955d20624764fb37c096296264370b375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635892, "uuid": "3b939332-2b97-4a8b-a97a-f18d66d75c6b", "comment": "Malware payload (Formbook)", "value": "196fdc24cc16a903beccb23c2e57b7a0099fea78124a1b81e185cf3ac9bfd1348e9f435b475629ebc0f0aea0876b4341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635892, "uuid": "20986e6b-14e6-470d-8467-77f529f07f6e", "value": "T14EF402843366E417D9A50BB42DB2F27603B82EA95121D3C65ED9ADCFB9F9F018C20357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635892, "uuid": "c639601c-1c61-4443-9c04-f84b8f91e52d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635892, "uuid": "7bbfe420-3864-427d-ae90-a62ae2d93c6c", "value": "12288:95DybQad2a8xlvkwK1YnmDXF/Yj70ntlZjSj88KOzN5Y:HDOQaUpxlNXmDV+wlZgKc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635892, "uuid": "2ffb531a-9c91-443f-a2f4-1c5a645df7d0", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635892, "uuid": "093e1033-e4ac-42d8-a7f6-25b08749ec18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635892, "uuid": "ef29f80f-d38e-45eb-895d-9cda9a3a748d", "value": "comanda noua.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b72f503-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656602, "uuid": "0467525d-bfa8-4b3e-9970-c425a96bb186", "comment": "Malware payload (Rhadamanthys)", "value": "268785bdcee797c9c467544b3fd5e973", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656602, "uuid": "c3785eee-3279-4795-8a75-7f973baddac8", "comment": "Malware payload (Rhadamanthys)", "value": "b066d44393154fad5409b74b2c69897b8451f749c23fb830b80164661f6f305d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656602, "uuid": "c250cd4b-5ec9-4ac9-b276-94c00211eed7", "comment": "Malware payload (Rhadamanthys)", "value": "ffe62478a7bb5622e220293e19b01b598741a124", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656602, "uuid": "99b2fc79-c357-4712-bf06-a0b1f5a78ae5", "comment": "Malware payload (Rhadamanthys)", "value": "3ef12e210d35597a3c7d9cd0214d0f1af6132a8f07e3fb8d3d18e8daa8ec0fe9bc2600c1769a7360a0148cf25cbbb4be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656602, "uuid": "4edbd14d-43b5-4ee4-8ed8-5ee68a86908b", "value": "T1D6A32A212CD090BC559DDCA4AFBA35F5F43519689896CD1AF949E3BAB03DE4C0F0A387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656602, "uuid": "a4e51681-b07e-4722-8f6c-e3175eb1a64f", "value": "1536:GDB7eKg20V2x2or9rm4/2I/29p2F2W2OAX2h2S2KGs6BkQWJ+aY:GDB7b0gB3CiGs6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656602, "uuid": "b6079356-20cb-4510-b991-0823319461f3", "value": 104701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656602, "uuid": "b2156484-0c4b-4fee-9fd8-17e467fa4929", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656602, "uuid": "86c9310c-c72b-47ea-899d-9fb49a3880c3", "value": "invoice-1637482117.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12482419-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761635809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635809, "uuid": "8223c3e5-5777-45ed-a93a-f84aa95aab07", "comment": "Malware payload (Rhadamanthys)", "value": "ce3d662c71f1c209223ae26be9cb8a61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635809, "uuid": "644930e0-a7f5-411b-a07e-5cca91d77439", "comment": "Malware payload (Rhadamanthys)", "value": "b0979feb4a93df650390165b47430d37a5e88cf4a4786633b5f2286d6ff64412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635809, "uuid": "9d802951-453d-4af7-bea6-76ba816bd406", "comment": "Malware payload (Rhadamanthys)", "value": "a17ae67c6579d4b60c5b3da7e330cce9be2d09df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635809, "uuid": "f14b4bb9-6dc7-45d1-81b0-5fc9ecf301e6", "comment": "Malware payload (Rhadamanthys)", "value": "948edfbde5f4e9500b14e5f4d99a79c3c8a4685a2b896385aa18af81669dc2f1d481a2a21329e71a8e86c5257e86d689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635809, "uuid": "e9e7f996-858a-49c3-b669-d79d04e36eb2", "value": "T130266C03BD918195D06AB6BAB6A36253B73C3C54573533C31B807B79AEBB3D0663A704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635809, "uuid": "b0bf07f4-761a-49ed-aa3e-f760e42de8e4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635809, "uuid": "5f00e65c-3348-4eb0-b39e-50bfe4c16eeb", "value": "49152:bIK4ZrqCkcbdOisOrqsKsKlOxF3uWx2xzEoq3:bUAYLpCzvq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635809, "uuid": "7fe520b5-a14c-48b8-bc46-26add321b148", "value": 4576632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635809, "uuid": "aa4d2d4a-5d8b-44c9-8c21-d6d4cba08e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635809, "uuid": "7d547995-e6ab-41f7-ad04-f29d8793127f", "value": "SecuriteInfo.com.Trojan.Packed2.50046.31380.22500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996b97b2-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656652, "uuid": "26595850-ae6c-4ab0-b350-c6e86492df68", "comment": "Malware payload (Rhadamanthys)", "value": "c41bf51a3f35a40ae2d270b18ba8f02e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656652, "uuid": "3199d37b-2207-470c-a69f-9209a9fc177c", "comment": "Malware payload (Rhadamanthys)", "value": "b0b250453062b96f32a9c1c6289a081774691713c0948d6a4a1ae2e1bdf3de7b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656652, "uuid": "af577372-e834-4216-b86f-b74f4d923868", "comment": "Malware payload (Rhadamanthys)", "value": "bb398895fa2b2bea51044c306d0bf364d464b631", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656652, "uuid": "d42046bd-122a-428b-a77a-97f0fa482787", "comment": "Malware payload (Rhadamanthys)", "value": "96692f5423f9180f1bf716996694664b06fd50518147880b25d4df1500533fc3f26ce29a5fbcb0e261d20b5b7346b61d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656652, "uuid": "b823dfd0-2ee2-4c17-841f-b63ce6c4ceb2", "value": "T1E5B3191435D5CCB6DAC436A1BFA84FD07D095AD19648A04BEC1AF61358EEB502E0EFF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656652, "uuid": "18f3acb1-d8ed-4192-a498-10763275534f", "value": "1536:GDB7eKg20VaiceVplQdTYtSZrJBl9LopCBnC2lKp24/ZtrrVRkzArCpAm/kTWpkM:GDB7b09BLIqrmwn6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656652, "uuid": "97905ee2-f379-40fc-ad59-537345d25157", "value": 108597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656652, "uuid": "ccb32e2b-44a7-450a-8aa9-75cbf290e9b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656652, "uuid": "b20ac553-3867-431a-8dd3-e465ddf050e7", "value": "invoice-1637482117.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e697c5-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761635817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635817, "uuid": "1b8a54a7-a138-4221-bf6b-0cb089d973d6", "comment": "Malware payload (Rhadamanthys)", "value": "5ef3c213d5cecdecc1b09e44d8947e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635817, "uuid": "09d985b7-2366-4a00-b462-b287aeae2ae8", "comment": "Malware payload (Rhadamanthys)", "value": "b0dbca94cfff8b7ad32803047380926197490656d53ffc16514327284a989f70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635817, "uuid": "82fd9cfd-6470-4e7e-9323-df19c918e727", "comment": "Malware payload (Rhadamanthys)", "value": "2879563fa1341ec0f133aad9cf5d703720da96fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635817, "uuid": "75baf9e6-8fdd-4721-9f3e-298addaf2c04", "comment": "Malware payload (Rhadamanthys)", "value": "b13963f71d9007f40c9f17319fcf941701f4a65fbdbe061f07a7d8c7e68debd1b88b74b4557c17fe9f8f24ee739a5e0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635817, "uuid": "882b530c-3bc6-49c9-8731-a0ce67e55193", "value": "T13ED34A9BB3F530F8D177853985920A05F772B87657616BEF03A4426A1F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635817, "uuid": "a5e91ecd-680d-4a4a-9eb7-237743bd47a8", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635817, "uuid": "1828fc68-0e10-4e2d-8fba-7d0f3c9c474c", "value": "3072:yv+zxFifIup9RzJ3oZBysYCbpPRVTGbbZEGqWDA:2wQRzJFdCbprsTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635817, "uuid": "d429e873-377c-4479-8d22-267875966fdb", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635817, "uuid": "461c8f09-e0f0-4a45-a91c-8d957eec53ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635817, "uuid": "43c47728-409c-4977-b525-a42ec7515e37", "value": "SecuriteInfo.com.Trojan.Siggen31.64782.22670.30040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32354221-b3d1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1761637152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637152, "uuid": "4af0ef66-ed7c-4e80-b63a-7fd01a3af7ec", "comment": "Malware payload (Gafgyt)", "value": "480cb64c2bc53cfbf3b0dbd7dc43f632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637152, "uuid": "33b6da82-4597-4c73-8959-1b8dbf79b2aa", "comment": "Malware payload (Gafgyt)", "value": "b0e27837c93017deefbf8cc0f3e96e3e9a9f8ab2c11c533273419f228edabe71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637152, "uuid": "afa9a92a-50ec-4a7a-812b-56dc09b41901", "comment": "Malware payload (Gafgyt)", "value": "636867e4d01d147f4c5582fda4f153f9a5058311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761637152, "uuid": "42e67376-8683-4479-9967-633d31bf4ece", "comment": "Malware payload (Gafgyt)", "value": "e711c21143a8e050d9554fde279202a2b3729837b4c16d67c74c789371a5fcb54620cc569224e90ffc0b943aab839265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637152, "uuid": "b40bd9f4-e9be-4c5f-8381-db152c05040e", "value": "T178D3D50ABB500EFBECAFCD3705E91B06258C656722E92F357274E928F54A14B0AD3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637152, "uuid": "5e295024-cb4a-4849-824c-d413a9072bbf", "value": "3072:yNiCFgNM+1KLZl3YNhNjZx9QcmBxTyYMpaGDwl:TCFEMYKLz3YNLjH9Ps5yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761637152, "uuid": "16573997-5aad-4d61-9d29-d4ceba49e9d2", "value": 132112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761637152, "uuid": "9d9f688f-1d46-4030-aa45-56fd3e6f5732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761637152, "uuid": "5757f319-9289-4dac-8385-3fad516f575b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d724324-b442-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761685811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685811, "uuid": "2bc58e50-bebb-44fe-a606-b3a882d9bd51", "comment": "Malware payload (Mirai)", "value": "be9cec5210eb310580428fcb7f4676e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685811, "uuid": "fe57be01-4a31-46ac-8eda-570936ee64a7", "comment": "Malware payload (Mirai)", "value": "b17853d890f2e9bc170f0f4c2290d007b99836c254a414e67ce1416889936408", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685811, "uuid": "f793e7bc-3d0c-472f-b690-b97bb7788b5d", "comment": "Malware payload (Mirai)", "value": "0dbb43e29318f933b404edecf61d7c1e516c81ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685811, "uuid": "763d8ef8-3952-457a-b9fb-bc2c6d0eb4de", "comment": "Malware payload (Mirai)", "value": "5ac2335295ed33a1488ab08ae3df0a5d8bde71f4a8081941d5ff0a034b52113fb9b94a8ab45155c972ac5bde11b2d5ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685811, "uuid": "6e7f71ab-a9b0-4466-9545-5195b50f6588", "value": "T1FDB308567B10DFB2C25DC13109B3C7966BE92AD129D29449B36CEE1C2E7130D681FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685811, "uuid": "58befd08-db48-467d-a6dd-dfd9b2fb5d94", "value": "1536:eiXIsT+lqhPS9WTacaAnr16LXbTATEXaffRiH0GTBcuZvqyvrnWT:jGeSvcaAnr1YoTEqfJq0UBcurjnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761685811, "uuid": "348512a5-7823-47b1-a759-11bd5424e484", "value": 111296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761685811, "uuid": "c2f4e6d7-8410-4dc5-a698-1879bad0b9ae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685811, "uuid": "429c897f-a607-491b-a2de-c786ce2c72aa", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278ff4a0-b3d5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761638852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638852, "uuid": "8183f9ba-afb4-49c6-b8d5-fb174b46e51c", "comment": "Malware payload", "value": "c4741944dbe63ff26b6ccf49f29f2507", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638852, "uuid": "d51d459b-cea2-4d4c-87e7-8504e8bce57d", "comment": "Malware payload", "value": "b1f9efeaf5d48b4e3467c69c0987dd0475608c3129cc1f16db7e1fd662ee74d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638852, "uuid": "0453da68-dec0-43d7-9891-4867e53c6205", "comment": "Malware payload", "value": "c177b5df186d7b5067305606e9e74242493966e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638852, "uuid": "7b23df2b-24f5-4c7c-9e08-cacb64ff1147", "comment": "Malware payload", "value": "e61215ff65e3fdf12b6ed6a0bced2c2641a5abdb38d8bfc8fb1e10b3a9f71b8a2b416e1f881e24615a404dcf8fda6b99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638852, "uuid": "b234975a-37dd-4fd3-8ddd-ff93cecfa2ba", "value": "T1E8C3C40E7E618F7DF3A8C63847BB4D35A39D23C626D1C685D1ACE2111E6434E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638852, "uuid": "a3fa1d22-feea-4eff-8d04-c03c05ff478c", "value": "3072:d2T0o+z24/DM9IzZ6mQTpwkjn29RN1vdtI0oDcmM:M0oK2MHQTpwQn4rFvmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761638852, "uuid": "f3f2023f-0688-4571-b4f3-6087d9b7b48c", "value": 128416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761638852, "uuid": "c7a1d651-7ba2-40d7-88af-df3937519598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638852, "uuid": "81a3f32f-b0de-444a-8581-31b261479b32", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193fb3a4-b3fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761656008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656008, "uuid": "9f1c750f-89a7-416c-afb2-352c08b96898", "comment": "Malware payload (Mirai)", "value": "0d1a4e8e75ffbc665f52baa2e1b23a9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656008, "uuid": "b8e9370a-a7e3-4322-bbbd-cc047112bb6f", "comment": "Malware payload (Mirai)", "value": "b2e253cf921f5fa59cc07a287d2a028d545ad5a7f21541bed5200673bc00d7e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656008, "uuid": "3fd37d0f-d01f-4fa9-9189-31c8be196cb0", "comment": "Malware payload (Mirai)", "value": "5b3536f87e90694f958ebb00f820dfe98a4c0f58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656008, "uuid": "0ce8d897-1d1b-4f62-a6bb-e0a0b5aca797", "comment": "Malware payload (Mirai)", "value": "cf8f969be24a51b385903e20e8dcb61f92c43d6dfb6b460a2a6f388a147eb808d96e4da9ca33b9b229cf2967d51b9917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656008, "uuid": "fac81078-0c5e-4dea-b59f-6b7921732ea1", "value": "T1C2A30856BC829B12C5C516BAFE1E118D331327BCE3DE7213DD246F21378B95B0A3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656008, "uuid": "b59e632a-9dac-4908-8f9d-42aa4405e52d", "value": "3072:o8tPqj6Vota02hpoCdMyTbF4magZtQ47yJUDk:o8tSeVota02hposMyfFjayMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656008, "uuid": "7d857138-b72c-44a0-84d6-370b693bdb55", "value": 105040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656008, "uuid": "62aa63b8-42c8-4888-81c7-efd8f66d5317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656008, "uuid": "91a22d2c-a926-442a-ae8d-5b48aca6dcdc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca26b77-b400-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761657570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657570, "uuid": "b3dfb0df-b99e-43da-bd28-c18cd65f6887", "comment": "Malware payload (NetSupport)", "value": "9713297a816e8d10a1095a2284395eb1", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657570, "uuid": "19ac5418-493f-4b78-bf06-eb066b48a4cc", "comment": "Malware payload (NetSupport)", "value": "b323b54c8d73a1dac1c71be5efff0131fca604069155a71b9fc4fec7ba48f5b9", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657570, "uuid": "1b8d3b14-b174-4577-97ac-237b18cecd6d", "comment": "Malware payload (NetSupport)", "value": "4df8c93442474c7a4baca3c035bc52ee0e0104af", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657570, "uuid": "d1c3da54-20a5-4fb1-b6b5-feccf1290da2", "comment": "Malware payload (NetSupport)", "value": "e8229d43528885a2cc55798922fd1410637fca313076cc4472ab15697856bf25541a0a2d8fb1bb25a9ebf6d09d892c68", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657570, "uuid": "b285d57b-e123-4b2f-80a1-2302946bde94", "value": "T1CCA5331F88E726725D4D6BE3D61CBBED5950B11E09C24C04068A64B3BC6FAF071BB9D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657570, "uuid": "f33a76a5-b02b-479b-995e-941e4b0da9fa", "value": "49152:EYGSRscBVptJC+1BZIvzLthlTyQ585e4HvDaqeTietUHCZGNQ0:BGSl/ZC+1BZI9hUXe0DaqevQQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761657570, "uuid": "d1666599-0f7b-4bb1-9a22-b8425cd071fe", "value": 2256762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761657570, "uuid": "98b88d98-001a-4b44-9410-5a144351f5f9", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657570, "uuid": "dec7f0af-b267-45a9-baf9-3c872cab1fe6", "value": "b323b54c8d73a1dac1c71be5efff0131fca604069155a71b9fc4fec7ba48f5b9.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8eb5ad8-b3ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761649081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649081, "uuid": "8f36fa94-35a9-4294-83dd-7815b2d6fc96", "comment": "Malware payload (PhantomStealer)", "value": "9a030c11db520eb33837e088655b634e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649081, "uuid": "9f14ea80-c95a-4544-a06f-8653d8758135", "comment": "Malware payload (PhantomStealer)", "value": "b377951890bdc6072083dad3e99ce512bd5f524695fff8331c42b274c05e5550", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649081, "uuid": "7ecc66dd-45d0-40e6-b3ab-fdcfd06ffdaa", "comment": "Malware payload (PhantomStealer)", "value": "941a52c5853d1d9f5a2c6f7651cc2824c1c4f7d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649081, "uuid": "ced52300-25d8-480f-8d1c-6eab7217749b", "comment": "Malware payload (PhantomStealer)", "value": "d0dd129fc9733635a60ced59ae06a228fb5afae192aeeb3abf7ec3e3f74fd6837ec59d8038c1f2c3821c24ef4a2314f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649081, "uuid": "da1fd686-2a18-44ea-9309-0f1fce7ee440", "value": "T11D254B61DC68075A8E4727EEAC9047A2C57DC609443391F5F2ED0B8E72068ECE37E5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649081, "uuid": "d1b4629d-7370-4c7a-8f53-be410a7a0375", "value": "6144:nfYcWfYsf+fY9fYa2fyfYc5fYzfYnfSNfDfYUfDfYEfYcqfqfYGfY9fMfYkfDfYR:4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761649081, "uuid": "c96b0e71-17de-40b5-a4c5-fcec2e7d81f2", "value": 1033394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761649081, "uuid": "46d31733-0053-4ded-a847-d8bdbf9d8423", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649081, "uuid": "91c44663-5da1-4f15-a91c-5b9148b588e4", "value": "Advance_Payment_Confirmation PO-0252615028_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f53ff3b-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761636476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636476, "uuid": "100ee2d8-027b-4946-a7ca-a46198052794", "comment": "Malware payload (Formbook)", "value": "d413ffa53ee0199ae4a0975ac9cee07f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636476, "uuid": "11c80a18-f4e3-42b1-9ec9-c5d03449f2f7", "comment": "Malware payload (Formbook)", "value": "b40dbf3b939fc0c2010b85eb35518c040707fe3e69f207d64173ced0235fce2d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636476, "uuid": "bf0d852d-a619-4327-a2b7-3002b35bd3ea", "comment": "Malware payload (Formbook)", "value": "c753c9c2e0016fc7e02411bc8d0133db8a5a3eb6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636476, "uuid": "676dea05-28c8-4390-a0d9-fa579f39fc20", "comment": "Malware payload (Formbook)", "value": "adc1228395eef52170a673c232863511f883cf5463aa334b14a6b17518f6ec561a64112105681f0d284c2034de9ed297", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636476, "uuid": "67c9dae7-de4f-4990-a2cc-b1580a92776e", "value": "T10645BF027391C062FFAB91334F5AF6215BBC79260123A61F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636476, "uuid": "39b3b1ad-f855-4954-9d5d-b75d0677e484", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636476, "uuid": "08b8cb35-900b-49d3-8922-cc81d7c12235", "value": "24576:o5EmXFtKaL4/oFe5T9yyXYfP1ijXdamE2pjVwKWiPvLLO5B/0:oPVt/LZeJbInQRamE/K13EB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636476, "uuid": "2e0ef8d0-cdd3-48d9-b0b0-127610d4f675", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636476, "uuid": "b61238bf-413c-4b49-bd96-29100b85e8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636476, "uuid": "987aeecf-94b0-4b43-ab1b-a6d25e7642d3", "value": "DHL_Formular_de_Contact_23647892145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e7b2ca-b3cd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761635735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635735, "uuid": "4529e203-0ccb-4319-9d0a-1573df43ecd0", "comment": "Malware payload (Formbook)", "value": "5e8c1a3fd45a1ccc9e8c9c257032a56a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635735, "uuid": "e16936b3-30d2-4381-81e4-3c1b10e17432", "comment": "Malware payload (Formbook)", "value": "b54d9e5f20604e783c807f9be4dfb87cc0d8417b54a3429d66fc64249804afd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635735, "uuid": "2759d0f5-3f49-4579-85b8-2481622df3de", "comment": "Malware payload (Formbook)", "value": "6fd28419aa34655af228c40502017386284fd3ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635735, "uuid": "419ca691-debb-4f55-8895-f7c00b049a38", "comment": "Malware payload (Formbook)", "value": "85026523b451e26f7e166c985c5d577e8905e0b297f97ea5aa1eb594ab1998e1372ec0df28d18d34e164abc5b6d09383", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635735, "uuid": "76ca7fea-16f8-46bf-a49b-9ba7a43f8f40", "value": "T10117AE19A3E80461E46BD734CA66C333DAB1BCA25A35C60F0559F6061F77E52CB2F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635735, "uuid": "49b7afcb-1331-44d7-ab84-2419d457faa7", "value": "74db5e4084cae8a29e1bea9e518dc2e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635735, "uuid": "964bb349-dc38-4d1c-b23b-3bf4d484ef11", "value": "196608:QD3L5NuSKgijffdsEZKxlqhk4ehMGK6vZF2Cb1341KGPU2:QhNu4ijffdsEZKxlq64+MGNH3DGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635735, "uuid": "2822d72b-1241-4671-a8de-24cbbe1da1d1", "value": 19175424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635735, "uuid": "67918b51-63ad-4cc0-a7a6-c4a0adf30967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635735, "uuid": "c82e89e5-fd48-4f28-a3fc-3b2503ba0e7f", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95935cc3-b3c1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761630446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761630446, "uuid": "21592bd2-56cb-46b6-a03c-edf9d3c7fd6a", "comment": "Malware payload (Mirai)", "value": "593407b5d1b4c5350c0bdff2589bead2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761630446, "uuid": "de17ab2d-b127-49db-b633-08e593e9d60c", "comment": "Malware payload (Mirai)", "value": "b5846eca199ef8384fbee0f918fe939a8a0e8c7e50a56566af8e469550ad6cc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761630446, "uuid": "e7f56e92-f30c-4cce-b941-efd5851665b5", "comment": "Malware payload (Mirai)", "value": "d4157f8a10f21d1803c4928335538bbfe5d32e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761630446, "uuid": "aab4eeb2-f11e-4010-9436-eefbb600fe93", "comment": "Malware payload (Mirai)", "value": "05b0c5a80fe696fc8d4534a6826533e84cea6249a40963e8fd859035f1209305d726713c69565b55e5f873f4c4fbf426", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761630446, "uuid": "5596cbb4-d074-47a5-ad79-8ffe9f9c8894", "value": "T1C1A39F47B56076BEF4E16D3E84538E17A719AF7005C71B2D61BCF9A0AA3A3503292F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761630446, "uuid": "2b9fb082-0871-4e3c-a21c-31f319442c5a", "value": "1536:d6elGlhitypRsPWiZ5cpEA+/u9jFDXgvT4sv7aBX9H4zCjVTQ8O0e2r+rP8rYy:kIGSypRAp24/cjFDgvTtOTMCjTe2gUYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761630446, "uuid": "f02825e2-641c-4352-baf2-c87fadcc5d6f", "value": 107064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761630446, "uuid": "c97dd50b-300e-46eb-8465-1ee8c8ed4423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761630446, "uuid": "1ad4a115-919d-433c-aff1-c18b0d966b26", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec970b3-b3d4-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761638434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638434, "uuid": "40fa0876-e8e8-4f07-bedd-7862f19c5650", "comment": "Malware payload (RemcosRAT)", "value": "c5692b97d14c00bec4394f1c50b7431f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638434, "uuid": "d9237d3e-fbff-461b-9a01-3cab00153c66", "comment": "Malware payload (RemcosRAT)", "value": "b72ad9f5170c18afe5788fff799541fa6e034702ebde25f35279ea39e5385a67", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638434, "uuid": "5aa0dc7c-d739-4a5f-9f73-74d38a2feb41", "comment": "Malware payload (RemcosRAT)", "value": "a74a3e76d06d1cfc595bb65a7dcfa72df6f50dd6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638434, "uuid": "30efacc7-ba73-48f3-aa4f-2e55ec307956", "comment": "Malware payload (RemcosRAT)", "value": "1f9bb4b1690dddfa5ab72bacd034a253867e52db9373a1855df87aa358c328a865116007c713fbe81468035d7b15b4ad", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638434, "uuid": "e44ba73c-8eee-4b06-98b9-50a77b59dc2c", "value": "T1FFF21F089A51E18C9DBFA7194EA9820BEBF7431735008ECDB8DF61F14F7A4A18D10E6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638434, "uuid": "270d9040-85a8-4240-aa15-7f4a2f71498b", "value": "384:iJjLVmmL2DkiFoBKaAi4w2CaCvtqxkYhcy:6pFWoBKrVOkcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761638434, "uuid": "fa2f546e-9a28-4027-91f2-0d278bde4848", "value": 35138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761638434, "uuid": "40381e80-5fc6-4d17-8a59-81fb3cdbd9cd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638434, "uuid": "2c73a2ca-677c-4019-a9ff-906bbc8b3528", "value": "sdf09sd09djisjg0s909230090d9f09g090g0df0g90s9g09c0v909d0saf90as90f90s9d.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca84950e-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761646427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646427, "uuid": "ec64c867-080b-4799-9f33-f13c025e0941", "comment": "Malware payload (Formbook)", "value": "18d6c061c5deca939ed41b9f90f379c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646427, "uuid": "3fa2a586-a729-4877-8f63-b0faf0d5d4ab", "comment": "Malware payload (Formbook)", "value": "b75f2dc2c8dc3ffa44e02d896bdb8e2cc8101f96de6d823c04c30947389a40bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646427, "uuid": "df7b1408-ac95-45c0-9fc5-fb3fd1437726", "comment": "Malware payload (Formbook)", "value": "82050a9bdfd805effd36ce10db414d826451b714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646427, "uuid": "aa9f5d34-bbf4-4575-bcc9-25647fd18212", "comment": "Malware payload (Formbook)", "value": "6718a81c96c76f42d9f916f69ec4cd46ab7455f7352974e45e883bca8dd91073620a3e1e8f16847f6dc74a82af69b043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646427, "uuid": "70144acf-cc98-4e05-ae9a-8e80e668fd73", "value": "T14EF423C6AB809450C95573308832CDA019787C31DC29277F873AE61B7C746E7EA97BAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646427, "uuid": "15ef17e9-9608-43e7-ad0f-aa0c80990c06", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646427, "uuid": "aca4acd1-507b-4e7a-b8df-e85338b48dda", "value": "12288:kz7hU5I5yuNHIgzSFKxWltRohBfSTso93U6gje6KhBHIgXJ24f2UveDzqUcx3qZe:kf+iN57Gtene3x0e6KhBooJ24fvGDzqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646427, "uuid": "04a4f3a6-6fdc-4de1-88b1-99162098d63e", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646427, "uuid": "70c9a09c-d741-4aff-a41f-424f7bdff2f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646427, "uuid": "87c90a3c-375b-4d7b-a4d3-e79c93bd1eb3", "value": "RFQ6780.98748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd297b9-b436-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761680736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680736, "uuid": "54197512-1ee4-4ab7-a323-a30b3aac7b56", "comment": "Malware payload (SalatStealer)", "value": "d1cc56c7488535093cd05efbb322ced7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680736, "uuid": "50915cae-8945-4d17-b30a-e82e1d7c8518", "comment": "Malware payload (SalatStealer)", "value": "b7e283301f2b631a4a6088ffa58b206855b1ff3087d330a02d559aba2badead6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680736, "uuid": "86953409-ac47-4326-93e2-3552e3a4d824", "comment": "Malware payload (SalatStealer)", "value": "18f2fa7a0a053677f733da667a657104fb24a8bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680736, "uuid": "13aa91a4-06f1-4721-b1d4-fb7c32d3daa0", "comment": "Malware payload (SalatStealer)", "value": "a7e4ccd5bfb7880a74e47a7ec41551a3588c25d25d2cab78da66b2afdd001e6b24218ed5b91aec7bb13ae1d75dd59cb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680736, "uuid": "85ba3607-5f9d-426b-92eb-209bd704987f", "value": "T1B2F5334AAC3D023BC1385AB4CCD65EF90DEA53865AEDC677319447E34A3BD4E402CB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680736, "uuid": "e0bf9fbe-55b9-4eb3-a259-782da64e89db", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680736, "uuid": "b6092358-4610-49e3-ba46-45c5e9eb30c6", "value": "98304:LLSXYepig633WIx1fQeaoFw4F0UriEwe+mWv:L2XJ63bx1L/FlF0Urij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761680736, "uuid": "be27bde3-9146-4f0b-aeea-f27cd271536c", "value": 3558912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761680736, "uuid": "e81862be-9f3e-43e6-a60f-3eac2a23bc4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680736, "uuid": "abebe9e3-38c1-4335-af03-f0f123b17c87", "value": "Crack wallpaper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4316399a-b3b6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761625583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625583, "uuid": "09bd2d7f-5fc5-4f71-ac59-54a3ed5469ef", "comment": "Malware payload (Mirai)", "value": "1686ea0b5376f7d85f559115ecd54df1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625583, "uuid": "bb810280-b0c4-4ff6-9f4f-9bebb79c3c0c", "comment": "Malware payload (Mirai)", "value": "b83b4793e6a53b632258559f1361143bb88c8671f9871e7f1f92d9a4f4fe23f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625583, "uuid": "39b4b542-f0b3-401a-84a1-0244f8b1b79c", "comment": "Malware payload (Mirai)", "value": "1b7b3e9fb678b2fbca609e7cdeec00bd7dc61732", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625583, "uuid": "967e7e2b-d191-4a87-98eb-80b7343a2de8", "comment": "Malware payload (Mirai)", "value": "5e262d50fda8eaa34d3825bbdb17bf16907e6844d8eb8de45ce5d86af3d142fcff0f7fd9dee3e6d733afba894e1087bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625583, "uuid": "f8b6712f-8b5b-4dc3-b378-920b9e3edf72", "value": "T1D443024747A489EAE25F933827CFEB4B9840552E93A4C96867C03C3A1CA4F4D7B9C1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625583, "uuid": "39ec5741-84b0-44d7-ae57-f9b07e017317", "value": "1536:JGu22CDcdR2UNjR775bDp0qMir7HcNu6XOwnouy8tyN:JGu22CDcKUNjRn5aq17q7poutk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625583, "uuid": "96f5f40f-eea4-49e7-a3c4-c4a531dcb6c5", "value": 56648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625583, "uuid": "a9cd7e9c-3e30-45ae-9e42-b68e8c56868c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625583, "uuid": "a6cfa445-e427-421c-b611-711a7de24843", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e197ce3-b435-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761680067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680067, "uuid": "69bee9dc-779a-43f5-a9e6-eaab5294583f", "comment": "Malware payload (AsyncRAT)", "value": "ae9cf6365abad6d93755fa0dc674d0c9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680067, "uuid": "d95c5ec8-a2af-450e-a46d-cca42b76dd32", "comment": "Malware payload (AsyncRAT)", "value": "b8dcbc9dc8888e7f39de7d70d5d9b76f22c9a2806e5714cd6f7afa6cb77c932e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680067, "uuid": "82c2adf2-e548-411e-8658-15af87fb50ee", "comment": "Malware payload (AsyncRAT)", "value": "dc55aaabf342aa368321e062f579d52d01c4e94a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680067, "uuid": "b89a12be-6d1b-4e32-8e3e-ee8b334d9c4f", "comment": "Malware payload (AsyncRAT)", "value": "7ee8a36b0637a842540ec240db6e3f7d7485e3a133fdee382158ffdbd329e07ca205cb70f02b4fa4f475d45faefe7ba9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680067, "uuid": "b7008992-a35c-4bb7-a404-dc8b563e2027", "value": "T1CD539E5CBBD40215E2FF6BB01CB62206CB39A7138903E65F7CDA41DB262768DCE416E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680067, "uuid": "bf7c4e48-7daa-4d33-8725-71b1e08059e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680067, "uuid": "0754bdc6-1ae6-49d4-b62c-031c4647e7f7", "value": "1536:FL7YgZc0x5tvMe3zJcqTv3wbptE1KbOw6mgOghBGM:9sW93zJcqTvAbpLgOgDGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761680067, "uuid": "8511db28-8b57-4756-a3cb-0d24c500d291", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761680067, "uuid": "c8d8a80b-3feb-4084-97e2-eec675b236ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680067, "uuid": "b2b1c3c8-feec-41a5-b4ee-54dc69595b70", "value": "wa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ace149-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761636459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636459, "uuid": "5f05b574-c79a-479e-87f3-f08571820f4f", "comment": "Malware payload (a310Logger)", "value": "b4026e653d8b4cff628a7db4cd31009c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636459, "uuid": "57891416-c307-4b64-a312-9779682673ff", "comment": "Malware payload (a310Logger)", "value": "b8e61acf85a2a2cd74273924522f735464171c456f707d4b3b7355b629d589bb", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636459, "uuid": "9f3bd766-df56-4b7e-bd93-a1a761d92301", "comment": "Malware payload (a310Logger)", "value": "65272f1fe2902937f4ae854ace85adc5330180da", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636459, "uuid": "8a1eca69-7f4f-428a-8848-c9631a0ab9b0", "comment": "Malware payload (a310Logger)", "value": "a6fbe6312e52fee261f8e78b5636d8724a25de3dfecc59e3ef2d1ac79559475d7d1f7b30b8f05ad792a9471f77f32276", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636459, "uuid": "faff4c44-31f4-4873-81b8-5d28d0c5cf40", "value": "T161E412543356E517C99492B81AB2F271237A3DA9E500D3C29FE92EDFB8F9F006D14287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636459, "uuid": "95318f33-4445-4462-8e8f-27a58d38567c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636459, "uuid": "6a1c965e-1f9f-4599-b243-6115d1d7e01c", "value": "12288:ycVbQ8dRMBe4AoGZWyBZVlWxcuAcCmVWVsYTpGK62TYDWfKIMT5Q+m:ychQ8dzhoGzBZVcyuA4Ia7264hE5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636459, "uuid": "3e8e237a-700b-481a-96bc-285b78d7065b", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636459, "uuid": "859982d8-e955-4dd9-8f97-6fa699577698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636459, "uuid": "62972b5e-c881-4892-86f8-e509d19660f9", "value": "KALIANDRA SETYATAMA PO 1310098007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79cef8d-b401-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761658018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658018, "uuid": "50a99a2f-1241-487d-9635-b5e4be9542c6", "comment": "Malware payload", "value": "006e989642754be55fe8ca003ee745d9", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658018, "uuid": "f3068f76-cdfc-4c2e-8694-ac434f22d6e1", "comment": "Malware payload", "value": "b93aa7378837a140823a81a109ef6599e9b2f30985bd7eb6007d2934b2a390c6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658018, "uuid": "f32a2907-b11e-47f2-b89e-4e4a718c91e8", "comment": "Malware payload", "value": "9023bf5eb93f4c36b79d9ce004df0eb2563615c4", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658018, "uuid": "7b6d04e5-d71e-4f6a-9f93-a05ac1f9afc3", "comment": "Malware payload", "value": "8dfaeebc685dd820551855d48b2bb6be71c0e29206eeea651e234dbafeaf3b007386265303d3965c3d18325b0e104437", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658018, "uuid": "5ae6eace-8e5b-4857-af41-3c3e79395d2f", "value": "T1EB1411D5AF0A0F3113F5C9A746E895818E8488E4FE7E4706F4CFC861984D985F2A76CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658018, "uuid": "6a5d42bb-0426-4966-866d-051ee2fb4082", "value": "1536:IB/ioYUec67aM09uPDmw2ol/YUK3bUX0kFTp762zUf/gBcs9LLEJo:Q/PYUyYCDY93boFd0/0cs9ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761658018, "uuid": "9ad3f640-19e4-44f3-92a2-4e648fd7699e", "value": 203891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761658018, "uuid": "66f13db8-a876-4afb-b57f-6075075cb269", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658018, "uuid": "02bee97f-df16-4d2e-8b6e-b8037176be8c", "value": "bgoyaxqz.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf08a83-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761640362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640362, "uuid": "e5a435c0-8cee-4683-8bbf-bcb18d99c58a", "comment": "Malware payload (XWorm)", "value": "57ec44a99269bf2848275d7ab68e5c3c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640362, "uuid": "448f7d69-cdd5-4256-93bb-a928457879fd", "comment": "Malware payload (XWorm)", "value": "b9673438f2064f7660899c46219889f3b76db3b64efcc1d074023bceea7cd043", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640362, "uuid": "8ccd83af-aea2-44ce-b830-309b5469afb4", "comment": "Malware payload (XWorm)", "value": "2e8e519df9040735ec2ef66fcbbe650eb657fd9f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640362, "uuid": "b3a9f8fa-ffdb-4baa-bc7a-fda59e12ec8d", "comment": "Malware payload (XWorm)", "value": "e32d797544b33385ec1aba189f48bb2778da2c203c58e4545093d5a9d07440cbdacb035375ddb1f66c393d6899083afa", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640362, "uuid": "4dd1776e-15e4-4b24-a341-a42d41b7b214", "value": "T1B382B7695E780FF63FC77ADE0763EB19C2A3172601D743C1A7E86A940A93F8126504BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640362, "uuid": "5c9c0481-cbaa-49f6-8b78-8dd6caf992ce", "value": "384:Aabdbf6ZtMA5mANfEsWjz++ct2PD3/6NHJX3Y/WbIT:WqdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640362, "uuid": "4c2dd74b-a42c-489a-b73e-dda8fe89fe4d", "value": 18879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640362, "uuid": "dfbf5691-10c9-452c-9f53-bbbe402b43c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640362, "uuid": "2b450b83-8bc9-47f5-a2bb-3e2580425476", "value": "PO- Purchase Order_376863489793.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e60db72-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761639803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639803, "uuid": "e9e6c133-780e-451c-8427-e916512b3241", "comment": "Malware payload (XWorm)", "value": "0ab74b8044682208325db46d23f7367f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639803, "uuid": "ebcbd2e7-3e49-4fa8-8d6f-7495628690d3", "comment": "Malware payload (XWorm)", "value": "b98edfd28820ec109133049fba0bdeaa887a9f447831e0218f73f3014fe38bf8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639803, "uuid": "5c98d99a-be9d-4749-b7d8-e0278db59ec0", "comment": "Malware payload (XWorm)", "value": "2ea301a253a7537b8723f678d2f1ac738ba6aef3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639803, "uuid": "abd55c1c-6c61-4de6-9490-4b3325a2ee98", "comment": "Malware payload (XWorm)", "value": "1d12e40a06f804815992400f0542d2d873edd2e447aa35515f94f0cb98403faa533b5bf7a49d1c985c8657f12a396648", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639803, "uuid": "d5694692-e278-4ac0-94c9-f91e27520d5e", "value": "T1B6D512BB98B279536A904663EB0F2C0A339B19D13B14D345E94195AC2F3B1D38F92737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639803, "uuid": "f9207ed5-9e17-4944-9316-25d4cec2b410", "value": "49152:COc2yD4lTPegBpQ46N3A9Dte3PEelg1uF/Z2uCFekPpOmh7wXD:CoyEFPRBpcN+te3cece/jCMwpjZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639803, "uuid": "bec72bb4-f17b-4baa-a069-766f5a67e1a2", "value": 2957948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639803, "uuid": "6b31b599-cf65-4fbb-8541-f7c204b7f0cc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639803, "uuid": "ec24aea4-bbb2-4183-aa43-6c6617d807b1", "value": "PO_ JWPO20252201.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc834fe4-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761636149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636149, "uuid": "6ffd6b8b-f094-403c-a469-658d50c9a9d2", "comment": "Malware payload (Rhadamanthys)", "value": "3ed0c8eb3920a3e7c6958e8ba2a86efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636149, "uuid": "4d3c62c6-8363-489c-8850-9eec0ad8f079", "comment": "Malware payload (Rhadamanthys)", "value": "b9b3f2e3557fb17dcd6b7ba6592ff1529c0c93c76878572dcd105ee7044def3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636149, "uuid": "6686207f-f972-4ba8-82c3-e32e056c58ca", "comment": "Malware payload (Rhadamanthys)", "value": "271193fa28949dec2e6659232d7c3f279e2e4413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636149, "uuid": "c829d10f-16d3-4ef0-8bb7-e078ceb5f06c", "comment": "Malware payload (Rhadamanthys)", "value": "dbcaafa00ac63348f8caf67fead60cf99b719cf3b55832df7e39eda0009c6b6d141164457630d057608209fe713bbde8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636149, "uuid": "05f49811-0fec-4c6e-b005-f93788548c04", "value": "T1AE9533625D77C9F8E984A271147F82D531AF293B48E797809E9C89BC1E4F643F76C0A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636149, "uuid": "b80381b0-6fd5-492f-892a-cb00f336f127", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636149, "uuid": "aae18c33-081b-41ef-8dcb-23855ff14d36", "value": "49152:Wha6kTJgzF7FtErhLwOqun9WsMbGp3HR+:gaPT6xErnX+cXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636149, "uuid": "b78e873f-0938-49e2-ac29-a4fb4343b17e", "value": 2020352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636149, "uuid": "5c1b0423-e906-4ea6-9767-a59c4f715924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636149, "uuid": "d7594aa3-e5dd-4ac7-b877-38a56d15c4ec", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345eb120-b442-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761685688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685688, "uuid": "65610f0b-4b24-498d-987c-a2bc1c277f8d", "comment": "Malware payload (Mirai)", "value": "6a6fc1d69f0352e9a8247972ff197e7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685688, "uuid": "2696edff-74f7-48b2-89f4-3dfc80c61d17", "comment": "Malware payload (Mirai)", "value": "ba0e335331c60b641c1bdc72629607521594a09cb185fcbab905655b7feb18f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685688, "uuid": "d75bdd06-5fdd-4694-b4da-569dfba39c83", "comment": "Malware payload (Mirai)", "value": "7ff7998353560120bff324c20c00682e4e18bbef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685688, "uuid": "e8418ffd-d23d-4790-9eaf-12a91ad58566", "comment": "Malware payload (Mirai)", "value": "030596153e1253a59b892af67c3387cebb1a3d1c423be73e9ce884c775470cbe6571b49289122c8e66f23066791663d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685688, "uuid": "d2efac98-6ced-48dd-a133-53a635d9e939", "value": "T172737C68B90EBD41D2C6E37DFD558BA1712B3C98931AC2B23C01A34DC4F6ED4CA91927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685688, "uuid": "f0162aa0-741c-4acd-aedf-60f5e1409dce", "value": "1536:Dfobli2uwVjjbPX7WLtRmLHyVvKmN2LsApUM9oMgKauTJIrxH+:DfoblwwxX/7WLGLyVbizKM9XgKWxH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761685688, "uuid": "84d7afff-9224-4708-b780-387a9749d894", "value": 79488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761685688, "uuid": "6e377cdc-a434-4d54-99b3-0d9d7d3994d8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685688, "uuid": "c6676949-6937-4bb5-8486-945fb25976f7", "value": "frost.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5b5468-b434-11f0-91c6-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1761679665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679665, "uuid": "a797f9f7-8bda-4669-a82f-ff7c557ac55a", "comment": "Malware payload (BlankGrabber)", "value": "d8ad12b847b286334508936bc19a7940", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679665, "uuid": "17b5bfd3-a8b7-4003-a077-8ae0f9809253", "comment": "Malware payload (BlankGrabber)", "value": "ba492c46770da3da687ef915ca0f61fd4b6f73a670551481ca5288f0b0db9c26", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679665, "uuid": "7d96f0f8-6500-4fdc-a664-b8cdb0ffb4cf", "comment": "Malware payload (BlankGrabber)", "value": "f5b92a3029956c3e4267b351d67350b1d929ec14", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679665, "uuid": "89edf8a7-5c4b-4062-b151-ccbb4c502999", "comment": "Malware payload (BlankGrabber)", "value": "01e55f25318ccc7c1ddf58ba524fa81d7eae7f8ab25d96ac7173a59c9659444b4030959cc78de01f409ab68f75f8dc6d", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679665, "uuid": "fa1b4306-cdd7-4c1d-a80e-d8afb1524494", "value": "T12BC633495AA509F7E5A3597E8823C936ABB7FD901FD4C7CF022413242E575E20D3B32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679665, "uuid": "ad9e9003-34b3-483b-ae7a-92cc085111e0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679665, "uuid": "7f6fb0f7-2d49-4a6a-9796-edfef22fea9d", "value": "196608:aLidFbywvTXXXuj9fZwQRCgafs8rDkfCRcbM6uoy1PZAM9qxgxR3DbMyDndkyC:aLiHvTXXXyw84fsekfxbM6uoy1PZ/wkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761679665, "uuid": "270c466b-5744-448d-a638-42c5bfa72c6e", "value": 11512505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761679665, "uuid": "e111e2d6-94db-4350-bf19-1c149f1dc2fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679665, "uuid": "4f8138aa-017d-4bcc-be4d-81df2f67affe", "value": "Built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc0e03a-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761634592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634592, "uuid": "432046d7-5050-4597-9370-6b37359559ed", "comment": "Malware payload (SalatStealer)", "value": "0157bc8e75c6d4902f1b4d7aa79e8105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634592, "uuid": "acf0e95e-ff33-4358-984c-5d783fa904f7", "comment": "Malware payload (SalatStealer)", "value": "ba4de9abf51a20310e466aecc3ef3a74d6dae2a3f8171a326217851a6ed20eec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634592, "uuid": "456ce403-a6e8-4123-bc4f-3e373e5f2107", "comment": "Malware payload (SalatStealer)", "value": "d8c3655f92384affc4daf38557344f8dc045d46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634592, "uuid": "9e15f362-018c-44ed-b4b6-758c089e9186", "comment": "Malware payload (SalatStealer)", "value": "43edc0a6bb6c7d0ffef5350e23b397d54e452bed8fdb4fe0afa2df7dd779ab65740249197e8999e71725ed4b3cd11bfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634592, "uuid": "1dae351e-e159-4836-8d5b-1e855a41c49c", "value": "T155C633542BA844FDF6E7F53ED201D815E2BA390197A2D8D7069083522EB33D0BB367E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634592, "uuid": "01f5c2cd-fee7-416a-ae09-c3774af1e164", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634592, "uuid": "e02e667d-6451-4c9c-8d21-4b8ab80498cd", "value": "196608:6VEdmkT4kGBS3k9GFexbBCHTg/vD7igourH3Q3qemdUSCtjzoMi6o8M9qgqmz+:RTMBS04wx9RnD78u76mdUSCJazw2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634592, "uuid": "d7f22af6-897f-435d-bc8d-12d60a6174c1", "value": 11756733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634592, "uuid": "5487d68a-6f02-40de-bd0f-0cb3c2cddaee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634592, "uuid": "5442bfe3-6fcc-4f31-a99e-c68af6a3a0d2", "value": "0157bc8e75c6d4902f1b4d7aa79e8105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe7b17b-b404-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761659287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659287, "uuid": "850568e0-c3d5-4ef6-ac2e-3a7be6fd280a", "comment": "Malware payload", "value": "81100af35165638e57296beb499b179e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659287, "uuid": "523c0d85-b7f4-40fd-9967-81980a3a2e3d", "comment": "Malware payload", "value": "bad943cb91191c65c0032dfc79e689802c2cbf9a968e4bff79da72b7d5aa6878", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659287, "uuid": "b6eff037-e8e0-4a7d-a35b-65ba545eae0c", "comment": "Malware payload", "value": "32ce1da3631612e414f135e7d78e67b3a83216ef", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761659287, "uuid": "c9db5629-930c-4228-acbe-ee1e79bc1114", "comment": "Malware payload", "value": "361c75bf6658c6ec51919c646ea5c4353699ad777535e880db241df9499387bd2c9a17ddda4bd4ffe9b6cd748b77accd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659287, "uuid": "e4ec82e4-cf00-4c7d-afb7-5dbd121563d8", "value": "T1DAE502BB44B269539A904567FB0F2C1A339B29E53B64D301EA11916C7F3B1D38E92733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659287, "uuid": "dcdcfb95-cb33-4ba1-a376-e9c4f707197e", "value": "49152:2Oc2yD4lTPi7cG9KZTSqbTqaChi6ZAoccnIMHRCb3WAUfMVApR4JdOTaf:2oyEFPi7cG4c+TqaI5ZBhIMxCbWp0VAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761659287, "uuid": "791fa95f-aa70-4cb0-bf3c-0862de912cef", "value": 3092131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761659287, "uuid": "40b3ad11-b22a-435a-a094-0ade758b618a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761659287, "uuid": "6dc22aa2-9d0f-4940-9aff-ccc62bc66a40", "value": "RFQX-XCurrentXTransducer.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c32b677-b409-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761661140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661140, "uuid": "f875e1cb-7dfd-4bf6-8e23-5518066591c5", "comment": "Malware payload", "value": "86c07f4c5695e2be78598e3487f620b6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661140, "uuid": "dbcb095d-cd0b-467d-be37-af63d87e987f", "comment": "Malware payload", "value": "bae5a7722814948fbba197e9b0f8ec5a6fe8328c7078c3adcca0022a533a84fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661140, "uuid": "c752f9fd-fe53-4066-8f78-0dfe1cf492f2", "comment": "Malware payload", "value": "79fb35a26df2a30b61597481ca4c9be7aeb889f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761661140, "uuid": "bede9538-a153-43ed-95d6-54b21095d3df", "comment": "Malware payload", "value": "dce67b6be794e77f021b9da1ac1b37cf77f165bb7e7b10a2b0ed80967bd787e6e4b715be876d46424068d5ff1fcf89a8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661140, "uuid": "2c52a3c1-8284-4a6b-ba85-241ce6f90bf2", "value": "T135B156B457368D7EA23265019C32EC0CB9B099B14A4BE43B6E173C99DDDA5E40B6039E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661140, "uuid": "5c2f405a-624f-4c78-8793-8f3df65a619c", "value": "96:VrijSqkMfPFdzdAKd8tZN2aUBhKB2a7IX5hLnNxiJwqxYGmYXSkX3bohru3+mW:VrCS3oiZtZN2PBhKB2kIX5hLnNxiJwq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761661140, "uuid": "7a02309c-02b5-4f06-99d4-996b09e1812a", "value": 5531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761661140, "uuid": "fb42bdc2-9dcc-4d22-b8cc-646da4984784", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761661140, "uuid": "a190698e-9d63-4d88-a4ae-51a52a2e5001", "value": "bae5a7722814948fbba197e9b0f8ec5a6fe8328c7078c3adcca0022a533a84fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387d2e30-b41f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761670663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670663, "uuid": "c4e2ffc0-8870-46c6-b774-4b4b87c1f2a6", "comment": "Malware payload", "value": "31f86fcd8e17f6d5aabc5ecc1100ab3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670663, "uuid": "b88965ef-abb6-4ee1-99e0-da888a03d3e1", "comment": "Malware payload", "value": "bbf273a6c071d057883f29356bafeb79c628e6fbe366a5c8601a6e32de5547d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670663, "uuid": "e6d8dce2-b91a-49d4-8606-1530387280c0", "comment": "Malware payload", "value": "88f7053ba00cd98ceb4001c6ea3490070dff84d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670663, "uuid": "1630944f-0b10-4a81-a882-a5fce44e2818", "comment": "Malware payload", "value": "b985fb99382c3d5eaa151ca8241190716c9f174131c25cf60ceb8c53f1f8f04d5ddf4a9d924560a47e4c89f5a047ecbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670663, "uuid": "9b1c3c7c-0142-4458-a74d-c3464fb8227b", "value": "T1357302A7FC8426E5F78A0C79AAB54EC1B28BF2F51371D13DF5F887896C009355C1A682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670663, "uuid": "c93f4b97-e8a0-4c1f-8d22-5cf348505d74", "value": "1536:NyiNMGkM71v6wWlf9wDq+DD+8jMhs3lCF+Q3QSrTPmf/d9xPskX3orL:NyieXoijwDq+DD+R6q3QSH+f/NEknSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761670663, "uuid": "58f625d8-8efb-4d9f-b5eb-a4ba2af7e5b8", "value": 73572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761670663, "uuid": "b2b97170-c8cc-4e53-a049-168489cfd495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670663, "uuid": "ac8e4cd8-20d8-432e-b5fd-bf0db09d4450", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7937e81c-b424-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761672919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672919, "uuid": "e4cded4a-9e50-4675-b709-6c0a39227bd1", "comment": "Malware payload", "value": "08c93ee1a4c34421bf0ae1d0dc08050c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672919, "uuid": "5e794ff2-a0a1-481e-a0e1-750de473d612", "comment": "Malware payload", "value": "bd28c64bd5dd602d01d522665de77a4e9bcba7698ec9c86ed9651b8bfb4ca27f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672919, "uuid": "cb139bdf-6186-4688-9d85-e2386536cf5d", "comment": "Malware payload", "value": "797a7ceaa5ae0d654c92e5a41756ee35b97af3c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672919, "uuid": "438ca2fe-f974-4137-b699-8440db1473c4", "comment": "Malware payload", "value": "4909c7446302bedb6a054b12b5b8a99ba1add21b86a8066f1e94d41d1952370d57f132542a06e628a5b0aa9797eeb0bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672919, "uuid": "c5761059-47da-41d6-8df0-d1b0ebb3f98b", "value": "T14DE54A03AC954467C45AA2398FF21192FB29BC250B3223D72E50B37B2FB6ED05A75774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672919, "uuid": "0fcd8621-5707-4438-af5a-6be4bb1d693a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672919, "uuid": "4edae164-87ff-402b-ac49-a374c0a41b71", "value": "24576:5MzXBoDzvVyCQ81P/WSbxTU0R1WqpyVkOLfUJeRB1wpvs6p3ngkBjfGWDR5+C+cH:5MzijVjduStTU0R1WqpyV9DhwP9v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761672919, "uuid": "b484392a-fdbd-42cf-aa97-34478c9a16c9", "value": 3049632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761672919, "uuid": "12088ce5-a356-4b1f-8b0d-158b2ecefcad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672919, "uuid": "8855e137-8ad4-49aa-af58-00f1da641e1d", "value": "S\u0435t_u\u0440[U\u0440d!].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4ebf89-b3cc-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761634971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634971, "uuid": "4b252f11-149d-4816-8b90-87d1cbca5270", "comment": "Malware payload (RemcosRAT)", "value": "5edb374b797a5f3c0e95876858039bd9", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634971, "uuid": "6f49688e-2ea6-4adf-8e81-ce9a28ddf55c", "comment": "Malware payload (RemcosRAT)", "value": "bd90fee8ebeabf19da740a40cdef96b54dd49760f449ddb4a918447fa3a08746", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634971, "uuid": "8fe403d4-06e1-4a88-842e-16ad36e8579b", "comment": "Malware payload (RemcosRAT)", "value": "8732f9f9b5192244e9bac2cc76aa3dddd8c08aa2", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634971, "uuid": "e7cdebcf-1938-41cb-acd0-e739cf07d3ab", "comment": "Malware payload (RemcosRAT)", "value": "b691642abee23cc886f344d6790ef4c3a91471a9260853f6328a378e06788fa52e7f0b049053abe1a02f38d2b65886ff", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634971, "uuid": "c1bdb625-a82f-4667-a5a5-a0f354e52133", "value": "T1E7358FBA5A1404F60BDE73C661BD0918153D4687F26394DE27B4638AF202761FB6B3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634971, "uuid": "b01a1ed8-8714-40f2-a59a-4adc591e0e9f", "value": "24576:H2DiO5TM55A+KaG+9i3qAxJXqJ27cLCb18li1QCx2kLYEvQx3258:WDiUmqxt8lBC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634971, "uuid": "04edad9b-59eb-4b30-a9b4-127d6d544087", "value": 1081598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634971, "uuid": "a466ac27-54e6-4bc9-bf7b-426591732506", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634971, "uuid": "71659783-e0e1-4425-8e30-e1513fed6c10", "value": "Purchase Order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305d6a0b-b3cc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761635001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635001, "uuid": "096ab44b-cb67-43b7-9b3d-be8e4fd38acf", "comment": "Malware payload (Mirai)", "value": "7ab7b728a0918cf291a0b8f29a0b5143", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635001, "uuid": "9f5bf509-f6ad-4325-ae10-205d0b804a09", "comment": "Malware payload (Mirai)", "value": "be0d482d9f8512bac4624a3639f5abe88963c7851370041a85f9aa9522969818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635001, "uuid": "b285f34f-495a-4506-a171-584ab9c70d1c", "comment": "Malware payload (Mirai)", "value": "fdd691d47621c58670c8646f10e3bd5e55850014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635001, "uuid": "96e8c18a-fa44-4151-8887-6d6aaf4847dc", "comment": "Malware payload (Mirai)", "value": "658d62ff1d244a62b6c9364e490315a858c6b00b59ae7b5062219373258d74c686e4278ad2edc3530a31f7e2b68bca05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635001, "uuid": "226d91a8-ffa3-4210-838b-8283d1fdd1cc", "value": "T136839C23C9361DA8D84804B0B0B48F755BA3E515C4572EFB599AC63AD483EDCF68A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635001, "uuid": "4e0f0470-284f-4d51-bfa2-eb1f34c4c1b0", "value": "1536:KxD+xE86+GxalPshbEKRvyQV+XRCaW9x7IHyk:Kl+xsx8E1rRz+XRs9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635001, "uuid": "112e0d7a-1329-4deb-bafc-4550410d05dc", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635001, "uuid": "f7687799-e02f-4f25-af63-8bfdf79d7763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635001, "uuid": "2b24d072-daa5-4eaf-9fe4-bce6b1a3f35a", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a74f4e-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1761646412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646412, "uuid": "e2b9ea50-e0f4-4bb0-9cf1-14227fb2c469", "comment": "Malware payload (MassLogger)", "value": "4249099e46354a965317f3590458d8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646412, "uuid": "ced57259-e334-4312-9160-ecb0fdc50f2f", "comment": "Malware payload (MassLogger)", "value": "be2b7ad86e35116cc79f4c25e67c6b1a511e5704e4cfc35e128da566c838b96b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646412, "uuid": "6b87f854-b841-458e-a751-0948f23f5c74", "comment": "Malware payload (MassLogger)", "value": "b4df1a05f189fe391d6beb729ae81f1441e53713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646412, "uuid": "2713d6fd-b53e-4b31-a6ae-882ba2ed3afc", "comment": "Malware payload (MassLogger)", "value": "848d94e5997d3cd36170edcd0114b7834bcee8e381677d500c167f77f539717eba67e1595fef2f724b4c363e1ae722c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646412, "uuid": "97888373-a1ab-451b-afd8-6720808d9944", "value": "T12055AFE27381C065FEFB50777B4AE61035FBBD6A4163910F12982939A9B13A1017FB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646412, "uuid": "42e2b3f6-046e-425d-a828-4096a28d8ebc", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646412, "uuid": "35c06c3d-1071-4f0f-820c-af7515f3902d", "value": "24576:r5EmXFtKaL4/oFe5T9yyXYfP1ijXdaGiHlwsnx:rPVt/LZeJbInQRaGaws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646412, "uuid": "de7fc5d8-2336-487f-857a-3c3cb4972213", "value": 1297920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646412, "uuid": "efd776fc-07c9-44e1-b8fc-183e78611f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646412, "uuid": "ae511135-8093-4cc4-bb16-c02570ab9646", "value": "Invoice Payment Remittance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66447f90-b432-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761678900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678900, "uuid": "77914af0-f975-48c0-b09a-72b65c6a8129", "comment": "Malware payload", "value": "7f69f3680c53ef19ca474488f559c2db", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678900, "uuid": "94629399-ccb6-4e1e-985f-8cd1996914aa", "comment": "Malware payload", "value": "be5327cc54087eceb1c61e09bc5153a811f6b0f13114d4ede45860794fe52c6f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678900, "uuid": "32cfe32c-d0d5-4f01-8f21-32dcebcc80c2", "comment": "Malware payload", "value": "0fcd32fa078e6869665c40245303d0189119270a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678900, "uuid": "469bb3af-b962-4cc1-ac88-277dbce7bda5", "comment": "Malware payload", "value": "2d102478c1640a90e0896780b35872858088b2d9303236b1afdc7e88b0962a141e9b2dd422937272896094a9b67e0816", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678900, "uuid": "4968160c-8790-474e-b9d3-9d300d9510fe", "value": "T18275C086B3A841E8D67391748D539A4BD732740513E0A7EB16A41F2A2F33AE25F3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678900, "uuid": "535a96ee-5b45-484e-a1db-d7a10ba06469", "value": "aba87277c3d634995a156c3846e5154b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678900, "uuid": "d162ab81-1d34-47bd-9f3c-278ba98045e3", "value": "24576:51EDE+AFX63GU15aA8vKdc5SMU+FuqMQmbmdfOKB498mr94diBZo5nLO/9nK1XgU:3HSGUJcEMUS4QmbmdfFBxmlS56ihu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761678900, "uuid": "e4393bcb-0377-4612-8a9b-c79d4fa2fbd2", "value": 1605864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761678900, "uuid": "cf6c5032-b495-4ae1-b4cf-3705db1984bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678900, "uuid": "3cab4978-852b-481b-900d-c9eb9178e483", "value": "Timber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc0e734-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761634705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634705, "uuid": "5c0c0f0f-f95d-422f-80af-f6438d3cf050", "comment": "Malware payload (RemcosRAT)", "value": "028c6d615fdd1184714496253c25883a", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634705, "uuid": "5c8231ac-ffc0-4e32-9559-848b50d165e0", "comment": "Malware payload (RemcosRAT)", "value": "bf3dc89bc4d1ec4e9d48575a688da6463acbbc9bac171f24efd71097a3868506", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634705, "uuid": "69f47ae2-acfb-413e-9401-8b16d859c6c9", "comment": "Malware payload (RemcosRAT)", "value": "c1d8f1169ee039929e2be705f027ae282e847639", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634705, "uuid": "937be3df-c28e-401b-940e-13c56f7237d0", "comment": "Malware payload (RemcosRAT)", "value": "548222aebe8b0da8e86aab8ab9e592dedfab761ee373ef5212816fc64e2c64cb513b18246d9f6ee3cd8ca8cf8f6e4042", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634705, "uuid": "79158869-9cea-425d-a7ee-63b4770ac91f", "value": "T153C5CF5D94B05D926024FE74AAC5F7938CE907851A1B4B920FE5E2A63205C43FFBB372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634705, "uuid": "16b74f1d-237b-4829-bc88-7c25345bed6e", "value": "24576:IG9hAi05H8BB4/CRWsXhftvosXsUx+UBUV5o:lAibjX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634705, "uuid": "55a8960b-194a-48e5-920b-590a4908f613", "value": 2652370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634705, "uuid": "0a7cd8d0-0dcd-40a6-9224-1243c315d34c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634705, "uuid": "2608c90c-ed58-40a9-bae7-0c984446c868", "value": "Scan_20251027_081558_pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1cebb4-b44f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761691555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761691555, "uuid": "accaae61-0b1c-452c-b5ec-e4b22e9c9977", "comment": "Malware payload", "value": "115eeeeaf40e53f8813ffa3a078f8c4a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761691555, "uuid": "3539f632-0adf-4c08-be8f-c32fb10d6f7b", "comment": "Malware payload", "value": "bf817dd5a8019c1485707c9ebb4502b1a5b687a80718083f47faeef67a4323f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761691555, "uuid": "7c4985f6-b78f-427e-9df2-5e1d6cd369bd", "comment": "Malware payload", "value": "1e2ad1eadd4176653ae1ae6fc6c093c1ad99ed37", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761691555, "uuid": "712cc8e4-84ec-49bc-8eb0-31a47ba863f3", "comment": "Malware payload", "value": "7210bffea09942353241db8608a5b0376c30e776529ccf0456ae58c5a40faa7a684c5827268033ce8ba68309b1b412d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761691555, "uuid": "31abc668-bd42-4ae3-b2dd-c02a9fbcf9cd", "value": "T1ED4150CF45D0165568C0FE84B5E34C2CA8A8B5C62CD01EDDDB6D24E26398B84B41EF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761691555, "uuid": "d643841f-04ba-4a9d-b228-b5181bd1b348", "value": "48:ToGGhL8QopCZKCyk/GU5k/Xk/fk/U25k/Dk/xk/Lk/jk/xk/Y:8zhnWj5k/GU5k/Xk/fk/U25k/Dk/xk/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761691555, "uuid": "1ea8d15b-813f-47c2-b1ef-82ac385382d0", "value": 1883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761691555, "uuid": "6167e936-3234-49f7-be05-a73d94b5432c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761691555, "uuid": "cd88a5d9-b3d8-4de3-a4cf-0c2d1c7be0ac", "value": "toot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04260e1f-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (MetaStealer)", "timestamp": 1761636215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636215, "uuid": "249a6ad0-b054-4da7-a979-dec6e597a7f7", "comment": "Malware payload (MetaStealer)", "value": "ac9af7c8ef463891c55a36e50667cdfb", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636215, "uuid": "998c2748-750e-4bcf-97b7-d21901eb5b51", "comment": "Malware payload (MetaStealer)", "value": "bf90501b49ed366ef57d92c6e49cb36b35772043525ab9351fe5b72fa51d68b6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636215, "uuid": "3cc7163e-b2a4-45a0-92cc-99d27099343d", "comment": "Malware payload (MetaStealer)", "value": "34c067d0356bb07bf59cfdb660d583c924a86680", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636215, "uuid": "033c2b68-94d3-4d3f-834f-b9d439509d59", "comment": "Malware payload (MetaStealer)", "value": "7c12fa958a829c24b7be4b11b7b61d81e4b333cace68719408facce203b392fed68b898a2319d3a71dbc8d5aab148160", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636215, "uuid": "9a828ede-c5f0-490e-b30d-ccf3c82823d4", "value": "T12C510F1137EC0768E3B35E3B48769B058977FD86CE258E5D0391998C1866B01E834FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636215, "uuid": "315ca01a-eb0a-4775-91d2-a42060f8af4b", "value": "24:8dJfH569JAyx+/5+HyOxA2yn662Ym7ZZG1LZG7lqdd+5Cww9dsquWgncWgssqMmu:8DHTNeyOxAdnnpm72OMdyRw9ducBBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636215, "uuid": "12775597-cbbd-479b-a869-9011596c5406", "value": 3015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636215, "uuid": "3af2e129-77a8-4aca-8d8e-560da0a07c9a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636215, "uuid": "1770ae97-38d2-4c95-90af-70a4ba1143d0", "value": "manual.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75e398d-b3dd-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1761642609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642609, "uuid": "e4c4a914-42c1-407b-b19d-27e7f371fe82", "comment": "Malware payload (njrat)", "value": "bbee93a0ac50ba30615cce0c5bbccc73", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642609, "uuid": "5a887215-59e8-4774-a2c3-002c3484c7ab", "comment": "Malware payload (njrat)", "value": "bfc67c5bc98de4693e91dd9ccff75b01eed7f8148341f721b2e8dc78da54891a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642609, "uuid": "eaadb956-5cf1-4f8f-b74e-32c797d53b2d", "comment": "Malware payload (njrat)", "value": "cc140db5cd689d403cdc3f0ca5dca9da86375657", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642609, "uuid": "1d2eff9a-de2a-4efe-9f23-42abd3101151", "comment": "Malware payload (njrat)", "value": "26c5d0cae1f44be12e34c8b15d8ad1666423fe219034e02663bf7d62dd30ddbaed4df4534c2486d6f9ce4aeef4aba7ba", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642609, "uuid": "f5cedc88-ab84-4a4b-af1d-8047b0590fbe", "value": "T11EC30869C767F89C02ED6CDC75E92A4D2E488E7BF52039188C2057F806F7D5C9B1AB48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642609, "uuid": "7754157b-9547-45e3-9ed9-12a5db031403", "value": "3072:Y5s8/jTGu0Zp4wcU3ExeObIO9zVpT8AFHuG3qHhCqbu+Pl8bh:G3jTGu0Zp4wcU3ExeObIO9zVpgUqHhCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761642609, "uuid": "4d8d3adf-9bda-44cc-8b34-63b0a5d47783", "value": 118342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761642609, "uuid": "8794e386-9ec4-463c-98a0-9e5b78595a34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642609, "uuid": "8d090bdb-e3f6-44bb-85e5-a8e38b7b95d2", "value": "output1761640754.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686adc61-b3ed-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761649268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649268, "uuid": "45aa8531-698e-4ea5-b7af-d15d9760a0a0", "comment": "Malware payload", "value": "e504d5ac090f2bb0f864b91fcde4963d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649268, "uuid": "80649860-b024-4c91-b5af-eb9476582ddf", "comment": "Malware payload", "value": "bfd4833b3423fe5bef9460f46e2a9638107e4ff148a75506d1da154ecab03c9d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649268, "uuid": "adc1a084-9419-4947-adbd-6bf1c8a25475", "comment": "Malware payload", "value": "5725ac04c2eacef10722c75477f971e475028916", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649268, "uuid": "a427a80d-b989-4521-974e-ed9b7b0f088a", "comment": "Malware payload", "value": "9151ef7f3503282824139765e42cd03863e3927ed3721ce55bac55cdbfbd0cb8cad01c55b3730c5b794f70963b15286b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649268, "uuid": "bbac1b59-addb-4639-8d04-a0201f0a18ef", "value": "T1F2E712E3E319EC68D0F38B36937510A3B9659C609B13F3664502F638AEF3AD08549ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649268, "uuid": "cb03f588-84fb-4b3f-ac6a-9c6b0d340cf4", "value": "1572864:n6VwLxG01mbHi1vjAC+lZ1wJL+SuOYgw6tcgxP:n6a1TJ0C+Uaq3mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761649268, "uuid": "c3943800-13fa-48a8-aa48-24302d682b39", "value": 67156829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761649268, "uuid": "996adbe9-b4cd-4d55-9ef1-a27d1777d8df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649268, "uuid": "1ec45cfc-1700-4e14-b17d-31607d6ba7f3", "value": "InstaGain_1761570262686.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f6b810-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761636136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636136, "uuid": "66bc7116-c250-4f87-9cca-fc440d0298ce", "comment": "Malware payload (CoinMiner)", "value": "71d89fcf8f90d3a9d8532a259f451fa2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636136, "uuid": "a7d7f5a7-4e0e-42d3-95b0-fb8cbc2b4521", "comment": "Malware payload (CoinMiner)", "value": "c1a1d4c22500e153a3cb7cb95735791132718879c54d094a05495f3e6fad3ce4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636136, "uuid": "6e5f2126-3141-47e4-a2b8-3dbffab83b0d", "comment": "Malware payload (CoinMiner)", "value": "98128ae8d2f69db692bc7d1907e1277bab5f77df", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636136, "uuid": "91babb5c-d98e-47be-b4ca-1ca28f1a398a", "comment": "Malware payload (CoinMiner)", "value": "a8fb853a709024a858b5f9d5ab9e10f64e543445a887623afcb356b1939062314fb9b35f603759ff3eeb5a21a97b305d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636136, "uuid": "cf5a2338-af0b-4942-b96a-66771424af7b", "value": "T135B6334593E144ADF8F7403D95B2D059F9F2785B0B68C6DBA35C22A32E335E06938B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636136, "uuid": "520a1b2f-502e-4949-b4e8-18e58b9487a1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636136, "uuid": "d1ed3f43-ef50-400c-afb6-a3b31c52541b", "value": "196608:ICNG0veSYXMCHGLLc54i1wN+QjXx5nDasqWQ2dTNUGTlS+iZT/SOm9W6jfMLH0I2:ICjmXMCHWUjojx5WsqWxT54TrwtjED0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636136, "uuid": "6ba08f93-3b9f-4d8a-afc1-3cd88c3c3e82", "value": 11442067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636136, "uuid": "9352a7b7-015d-4ec7-aaf9-6d2b548114f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636136, "uuid": "9f233f65-21d3-481b-b009-f51828af66e7", "value": "hello.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fa0ca1-b422-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1761672195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672195, "uuid": "5cd2c625-e356-4fc7-8a1b-b717a6d1f0a9", "comment": "Malware payload (RustyStealer)", "value": "efbae8d7bd809f1df3a00d44bca3143c", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672195, "uuid": "b2cec109-74e6-4488-8e20-e230ad9ac4e4", "comment": "Malware payload (RustyStealer)", "value": "c1fbc4f422bb21364b7e14cfd84bfd231fa21c7e36e3607aadd6ec0b342dd2a2", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672195, "uuid": "87e3a7fb-e2e8-4a01-8d96-8b00e01d7907", "comment": "Malware payload (RustyStealer)", "value": "f2c8335825bca42db735ac11e9c50e16300ebd36", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672195, "uuid": "57efb3cc-652e-4487-be40-9163ee88cd1c", "comment": "Malware payload (RustyStealer)", "value": "dbca526ba80e826660089651359cbd45df890dd985ea9917391c6a87c8b522df96f3566b5ae660c95ebf3c99078086fe", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672195, "uuid": "34eb4712-2d20-4556-bd68-4a52ef4e91d5", "value": "T10B25F132BCF350B5C05651334825C66DE3E99CBACF418AEBD2968969CD65FE0C63221F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672195, "uuid": "d06f4940-d242-44c4-914d-f54c53624c76", "value": "af6bd3a1591af995ace7bdc58ad3a061", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672195, "uuid": "61ebc0f8-d47b-46ef-8d05-e4e27b77b163", "value": "12288:Ak8BBB5i1a+Teh/bRZwelws09MhgSUpCNk3iMylts3HYZHjxTvfn1n4aLseFHMpE:AkqBUa+TehFZFQCyyl6HYLrRFcMwPzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761672195, "uuid": "da8eaea0-b13c-4988-b20b-f17940f683aa", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761672195, "uuid": "115f3abc-46f3-4b96-b099-0ed7bd32415b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672195, "uuid": "40f8955f-ea25-447d-b295-97b2a61d30a2", "value": "NetworkLabsAu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdee6e9d-b40e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761663612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761663612, "uuid": "d92edde3-be09-452d-a411-c5c8803ef95c", "comment": "Malware payload", "value": "8bc238ffe9f02dae149f12f3a5664f95", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761663612, "uuid": "44816645-2e2b-4011-ab5c-9ce0cb6db272", "comment": "Malware payload", "value": "c252d5ff111e4001f0588dbeabb284146c535beb285bb3ee41f971bf721ad838", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761663612, "uuid": "ed37c208-2b0f-4440-bd3d-10e629226f13", "comment": "Malware payload", "value": "cef9731362bf8b3e93d8ca06a45c7bd2700a38a2", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761663612, "uuid": "a12a378c-5c63-4c1a-888d-d1ef9272cadb", "comment": "Malware payload", "value": "6e20462a9c0bf24c2b7af3c054ada476b8f39a1e0d6305dc0d4b0d611505c12c414085912522095f38be2e700ad60dfb", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761663612, "uuid": "0a3442df-d763-4c67-b6e1-e884d9f4100c", "value": "T190B4223566A1760BE8FD5D350E7EC75833296D22DA62C1147FD2F287A7EAB01C273224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761663612, "uuid": "a39099c7-271b-4a87-ae52-1bccf66593f3", "value": "12288:vx2bQsD9UV1BoLy9EegXbGkogANJt4+TB3VhiG:v876v8y3gXCkogACmB3b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761663612, "uuid": "203f4b17-1cd2-45ff-b613-9e00734a6f8c", "value": 509256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761663612, "uuid": "60de5e92-2526-40a2-9047-f584480fb402", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761663612, "uuid": "06e90bbf-5f18-4aef-8f1f-92296b3e91b0", "value": "nOrden_de_compra.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e8fdae-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656760, "uuid": "733d4832-b383-457a-a216-2595e1ee0b76", "comment": "Malware payload (Rhadamanthys)", "value": "36c9786c7814136b3d00f1b4dec9ca7d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656760, "uuid": "173cadae-51f5-4f20-8787-289b0a60e12e", "comment": "Malware payload (Rhadamanthys)", "value": "c27f4084c8f47ef938b26f0e41a7053e8f1e3cd652ca4a1fadc1fd0d3895b25f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656760, "uuid": "90e75c55-0e04-4672-b751-ac2ecc0b732e", "comment": "Malware payload (Rhadamanthys)", "value": "84017f5ab6585e329b152253f5e013349f1fb4db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656760, "uuid": "b456596e-43dd-47e6-8072-7a19910f3ee3", "comment": "Malware payload (Rhadamanthys)", "value": "12b61fe4579fd464cd974640cbae246e6f57bebba994138954c51c44e92eb26e6526493d8c2a4fb933d31c873a4e901f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656760, "uuid": "8185c528-4bfc-4b5d-a088-23a006ff8ce5", "value": "T143A318549972FDAC014CB2D5BCC8885EE75C2C8F056260597C8F63133A5E9AF4AFB1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656760, "uuid": "10da98df-b6d5-4aa1-85cb-843e8b292ac9", "value": "768:GDhd0i7J4sYKgY/CMNfWdkUPrX7jrm5G9HDEATs6iNojSLAuAAroQW+FF+Ec+0FY:GDB7eKg20rrvrm5GBEATRl6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656760, "uuid": "141beef3-81c1-449a-b770-aa4f86c07819", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656760, "uuid": "b963dca1-7b27-4ffd-a0dc-b1f740c004a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656760, "uuid": "79eb2bfd-17d7-4d83-9223-f28e94f687d5", "value": "invoice-1637482117.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0018ed2-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761646409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646409, "uuid": "118aee7e-e42f-45e6-be99-7a0c76d76afa", "comment": "Malware payload (AgentTesla)", "value": "11c680bfda67456c852987bf2bd0a714", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646409, "uuid": "3a413590-1026-4b1a-b732-b0b10353cb9a", "comment": "Malware payload (AgentTesla)", "value": "c299d556c97d0efb665ebdcd3f47593b689c3a997c019c27914402361b3d28ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646409, "uuid": "9e2e5941-668b-49ee-a117-8b71fd5060b2", "comment": "Malware payload (AgentTesla)", "value": "72897ca53822a4768357b37008c7d6d4e511fc27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646409, "uuid": "d758aedf-9a45-40a0-a112-ef1096eb380a", "comment": "Malware payload (AgentTesla)", "value": "7a39e4fe9128a30606482fa8dad284edc125857e7abe568e7621c5a1cff2188b5b0f96dca1e43aabed3f14baae7f0849", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646409, "uuid": "ba12e50d-cada-49d7-90f4-c095e7fffecd", "value": "T1DD95F682F4A515A1C2469BBDD0EB044E4F296297EAC7D00FF19C2BC51F5BB81B9C7A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646409, "uuid": "17914cbe-4541-4d09-9520-574fb566cb9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646409, "uuid": "07819cd5-c5f3-4a4c-80a0-c6172869b47e", "value": "24576:SSr1oezrKA0590BxGPGZD52Agy1w5NCaW7ES2M7xA:tJotGB2mD5Jw5NCR7wMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646409, "uuid": "0236f324-ef02-4c16-9b23-a77973b18d1e", "value": 1998456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646409, "uuid": "6d33376d-f70c-4199-9824-0eff0af7e3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646409, "uuid": "972bff0e-de8f-40d4-8ba2-f228d16a1cbe", "value": "IMMAGPAYT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbc5f57-b458-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761695156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695156, "uuid": "b88ce719-57c0-4423-aa9e-d5fa4a609730", "comment": "Malware payload (Mirai)", "value": "925f3d057588b897f77b128922d29a35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695156, "uuid": "91258148-5aa3-4fae-8865-bc53acdafb42", "comment": "Malware payload (Mirai)", "value": "c2c2f0b5c3ee9ae3006777341dd076b34a4f8c96753062242d233dab7492ae82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695156, "uuid": "e620133a-5abb-480e-9b19-323681c8c5ae", "comment": "Malware payload (Mirai)", "value": "e6c94d3cff4a1c5a3c808e33424d932b183e15df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695156, "uuid": "d9e2e386-3ce2-4013-b8ed-49cf174f7177", "comment": "Malware payload (Mirai)", "value": "3dcbcaab3775bd47a66eb830741cfc96da80c64992b0cacf08d581d0ca0a8ccfd38292c6a4656d105559d1ab614f4cb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695156, "uuid": "905089ea-74d6-4261-b61d-f690831ed10f", "value": "T1CAF31A46F8819B16D5C052BAFE1E128E33131B7CE2DE72129D246F247B8A97F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695156, "uuid": "10f85a6c-9b6d-4565-b508-624195eb6937", "value": "3072:e6zfvnRrUwpN7omX6W0/8eaP5AuV0gktF4gCds6CUi:e6zRUGNZXz07aRr1kt9EsJUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761695156, "uuid": "e9863837-0c2d-4ab3-b024-421f9632ca60", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761695156, "uuid": "284ef8bb-6003-45a2-89b3-7376335f63c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695156, "uuid": "168da8c4-78c1-4b1d-8e45-eb01662e173a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb078504-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761646401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646401, "uuid": "26082124-a3e4-4812-821e-e4d3cb4a39be", "comment": "Malware payload (Formbook)", "value": "ed3dfe3d8a566cf809235dbc094a3031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646401, "uuid": "4145d21a-9035-43dc-9bce-dcac9b03f18f", "comment": "Malware payload (Formbook)", "value": "c34753d6a802dcb3570354a7ecc7e930d957a28cca0d63e698ac0c0cbe67e6cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646401, "uuid": "af2c9144-c276-4650-84be-a686bbc3c771", "comment": "Malware payload (Formbook)", "value": "b78501b57f08caa07977d7d8e1561af4f895af90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646401, "uuid": "fe20d5ef-043f-47de-b4ff-bb47f2d3b67a", "comment": "Malware payload (Formbook)", "value": "69ff2bb8c846074d6adc918ea716b8e504d92c567fe8a4d720edd898f78b6da0beb9aafcd6a116e58a313fe32b10e602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646401, "uuid": "60d90fc9-f25f-4364-8a95-a86ae20f6735", "value": "T1B4D402586329D602D4B5ABB52E70F2B017BAAEA9FA12D70E0FE47DDB7156F404C04393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646401, "uuid": "4837e50e-1f3f-45e7-bef2-823e7f7c78ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646401, "uuid": "81ed4602-1909-4758-a532-6ce503471653", "value": "12288:mbLQZ100hieTde7LsrExlkqCiZR3PRtphIPcljiwv4AV4R1Q:SQXbiuc6EARiZZPTbMcNjvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646401, "uuid": "dce4fee9-efca-41d6-8401-177f393640cc", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646401, "uuid": "c6b1735b-d4a5-4ecd-832c-1575e0eb6640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646401, "uuid": "143491ab-707a-488e-a0d6-3620a03979e5", "value": "Banco Credicoop Comprobante de transferencia 20251027_ARS84595280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd569b8-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660126, "uuid": "76c65929-1f3d-4f1b-a9cc-382c8c145e49", "comment": "Malware payload", "value": "d18beb3e292cc3936f88b7336b0e2a16", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660126, "uuid": "dbc58809-456f-4076-bf3e-d5f637537258", "comment": "Malware payload", "value": "c3651befba6f87651334684b2d3de13394e5bc12e2db1f04a25f476baf308ffd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660126, "uuid": "13ad8ee9-9692-49e1-b3d1-19cf90966489", "comment": "Malware payload", "value": "11e3ef82b72a72105161cf50c9d44e3003bdc79a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660126, "uuid": "ba350ffd-4e38-4471-b329-2aeb25d8bc7c", "comment": "Malware payload", "value": "56bf5a73a760f2104685c0d3d3467edfae269bd4f2712bc55a5b100a0550d00d988d784bbd843b973db450b713cf712e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660126, "uuid": "f71f1da2-8e27-492b-a2ac-f40e37e2f2ad", "value": "T1BBD023727E507D480735C8D156894A4516B581419374D5DBC17C9B1C4D5415FD004C18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660126, "uuid": "e03f484a-38be-4ef8-b5f7-e4119a7c1646", "value": "6:hmRZHYuvQ69Mv7AedMGsVRc7hHLNKDSQ98lkKuePn:wb4u469MzAMMGsjctcDSQ98l/dPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660126, "uuid": "16001785-6509-4e4a-8b2d-0a7d6ff0c31f", "value": 211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660126, "uuid": "df79db43-ac98-407d-bd0b-d3b0b3dfe7e3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660126, "uuid": "8b5b7b17-b023-4c5b-9bc8-2455899c556b", "value": "file.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4766e412-b3b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1761626879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626879, "uuid": "1eb8e8a9-d79f-4080-8280-6258b5772c69", "comment": "Malware payload (Gafgyt)", "value": "be0410ab073de1cbfdc7fa8255727db8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626879, "uuid": "f5fb5576-604a-4b8c-b9b8-d4fce8264d54", "comment": "Malware payload (Gafgyt)", "value": "c380cceb8ea357d68519a8d8d50036d8cadb68c0d3bb1ae9fd3b90a47c5502c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626879, "uuid": "0e37606d-8ee9-4717-915d-fcb6f9d05931", "comment": "Malware payload (Gafgyt)", "value": "5c145717973f9cb2096279b39ee2cd31eaa713ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626879, "uuid": "df652286-8c0f-4c4d-8405-01c7d7e7653c", "comment": "Malware payload (Gafgyt)", "value": "626871f05029668d9c8c2a0d543e6a5928d93e5c27abc0ff3c4370a06fae97eb320e9ced7cb83352e11272396a7dc4e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626879, "uuid": "b4f0893c-1f7c-4d7f-871e-481b1ed779a2", "value": "T1C7F32A85F8C19E12C6C212BFFB5E428D372657A8D2EA31039D266F21378B56B0F3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626879, "uuid": "74339d4d-9b35-4c3c-ae10-e51de9cc6419", "value": "3072:slmye/ipIuM/lHOjCMri9T4W1wNEDIEeVZPdM:slmye/ie/liRrGT4ywODzeVZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761626879, "uuid": "abbdc71e-e853-49ae-abd1-dcdbf970a135", "value": 172288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761626879, "uuid": "ad696493-b8ba-4711-adc1-a745ce591a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626879, "uuid": "4da6be57-7079-4c21-82a2-f6253a114052", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9391fc64-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656642, "uuid": "af2b0976-6e6e-43b8-a149-5ebfaa98dcd6", "comment": "Malware payload (Rhadamanthys)", "value": "14aefb3e92108c32ccff93c2873799c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656642, "uuid": "2be635a7-7224-412e-8cf8-0f3df2e3b663", "comment": "Malware payload (Rhadamanthys)", "value": "c3e234084cd5a0d2547bfc1f61abf12c7ba3efd273fd37604023e7cf8d5fb0ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656642, "uuid": "e5f1c4be-389d-46ff-8c32-21195825f811", "comment": "Malware payload (Rhadamanthys)", "value": "df02824aac033410f2f8843fe34eb46906f837f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656642, "uuid": "77900c04-6e88-4a6e-a7cd-4875669dadc9", "comment": "Malware payload (Rhadamanthys)", "value": "1ec648903114efbe018164084243d09285e45b07057d36921b713e7ffca550564869abde2daec7e1cefe353764b22591", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656642, "uuid": "c64c852c-8265-46d3-8260-44223bfc3702", "value": "T14FA33B28EC83CED12062EDBDCF8218F5B6C756581900952EF309F76BAD8A31B5556C8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656642, "uuid": "7113b10b-831a-4c40-9b5c-8b5a0fac79e4", "value": "768:GDhd0i7J4sYKgY/CMNfWdQSlu38rXmcr84TVHsbbKA8rIdSLAuAAroQW+FF+Ec+p:GDB7eKg20w8rVr84TOqA8cd6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656642, "uuid": "96519431-0af2-47cc-9650-69be94c174e0", "value": 106013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656642, "uuid": "073301a1-bc75-4ad5-9d6b-e20589283266", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656642, "uuid": "7a681fd4-b8d4-472d-9f22-4bc2535ae541", "value": "invoice-1637482117.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c410cf-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660136, "uuid": "e4bdb9cb-02e0-44ac-bb82-1329768ffba9", "comment": "Malware payload", "value": "18b644b7c3bbb6d17f6d79f3bf795ee9", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660136, "uuid": "783db5bb-d435-4f43-b4a5-0ba1d4c21bba", "comment": "Malware payload", "value": "c439b559fe891543200570a660a89fcfb58c05dddbe1a7aa66ec37476d73ecc3", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660136, "uuid": "e7585eab-b82a-4321-8214-0558d1d26f01", "comment": "Malware payload", "value": "990eafc677bfadac0845d8de1541e1655e4654fa", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660136, "uuid": "bc21509f-d3c7-4fc9-bfd0-7395f54c6ca5", "comment": "Malware payload", "value": "9b1e03e0e73b08044101e9f85fc134ff6f2457c33b6d1ced0d09c193f1821915ad2dd643869555f6a6a45fc696be86a2", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660136, "uuid": "644460de-c90a-437b-a6d0-e0a940704f3f", "value": "T19761BB1BA94F1063C0B27FF47C861018FE1A601F640A2614BA9D84DD2F77959C6F9F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660136, "uuid": "37369f80-e301-440c-a0f2-10b8d5697357", "value": "48:7pYp/Sf6iE04g9Gg14FFIIY7uHn3FFz7dlFO0JIKSJBQbBVWDBvQY:7CiN8gs174o3fKuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660136, "uuid": "0991f881-5f13-431d-94f9-0429ae9d2304", "value": 3335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660136, "uuid": "42396280-3c0a-4df3-9d44-c1c28611cd2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660136, "uuid": "4152cb20-d2a3-4475-9add-783a9c98b369", "value": "GetBrowser.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e517962-b3a2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761617093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617093, "uuid": "c9406507-dfbb-4ce4-acf6-34ff7632e499", "comment": "Malware payload (Formbook)", "value": "59b45720ffdec913119cabc379980082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617093, "uuid": "a8634aba-a52f-4cd3-953c-c4e4755e71cc", "comment": "Malware payload (Formbook)", "value": "c621cdef483f72a72f9e9b3296c85c7c8d064a707dfdd2c11d7fc21d75d123ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617093, "uuid": "3b8d1b38-827d-48a8-9317-79486f340e4f", "comment": "Malware payload (Formbook)", "value": "14225156b7d2398e06cecce52edbae5792e40955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617093, "uuid": "6bfd0180-e41d-4744-9ac7-578393862e3d", "comment": "Malware payload (Formbook)", "value": "85bfa1a0272c3454396b8aae53fb6f1c0c6980a939a0158bf7406d2034d09535354ed176e6ea303e42f3e1a5876db25d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617093, "uuid": "fefa554d-9fe6-4b6f-a7d6-aa8e7c455f71", "value": "T17045DF2363DE8361C7B25173BA5A7702BEBF782506B5F86B2FD4093DE920121521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617093, "uuid": "592f5256-b791-4097-be0d-e2a07efbae18", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617093, "uuid": "19aebf8b-3311-4c06-8dfc-3fddc3831803", "value": "24576:Itb20pkaCqT5TBWgNQ7aRBmd/n+3+yCZ6A:RVg5tQ7aRBU/+uyy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761617093, "uuid": "5b65e316-c0bf-46fe-84d7-af95c167612e", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761617093, "uuid": "a6b08d69-4d60-4beb-b2eb-d5cf50729b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617093, "uuid": "1a4ef1c0-bc7a-45b4-9c03-570d041f739a", "value": "Doc-1027202597633.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd7d515-b391-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761609633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609633, "uuid": "a16e6e40-69e5-4ad0-b72f-c11d87136bff", "comment": "Malware payload (AgentTesla)", "value": "d10e86064a68351b5281dae016ec81bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609633, "uuid": "406b07d6-cc1b-4714-92c7-bfae0dbbdf28", "comment": "Malware payload (AgentTesla)", "value": "c641e1a66f2dd003f88021c7f365c7f7fce6e723e09320194658a513c899c197", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609633, "uuid": "2b6a7ef0-ae65-45ef-8e2a-9b38fc5746bf", "comment": "Malware payload (AgentTesla)", "value": "df4d7550521ebb53aa772bc7957dcf044fc2fa3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609633, "uuid": "3ee506a3-f797-40ff-8819-a5791f3ff99b", "comment": "Malware payload (AgentTesla)", "value": "6c0573b81806ef33af428a0a445c1d1197238ad420298226e9cb0d4ecd84931b34e1ff01240c2ef7ad8573bbef4e1d19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609633, "uuid": "5d4da0d3-d25e-4d83-b882-84160ac084ca", "value": "T12D72138D7D8AB1A6D362E8332E3BF489735A5580F9CC8157F2749160FD64718A9D2838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609633, "uuid": "5395c88d-37fe-40a6-9d4e-b87a7f7232b7", "value": "192:ph9CRUzAm+loXNos8m4ZlFFMfubO49CvTxwIMPZVkgApbofKsvUfqkvmls:p8cae9+TMfydHnRRApsSryYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761609633, "uuid": "462725ce-3162-4350-b0f3-f5713e0d0a56", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761609633, "uuid": "9c37fd05-bb8d-481b-b4a3-4faaaa14a790", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609633, "uuid": "7e6cac65-1674-4d89-b242-bf48dfecde24", "value": "Payment Silp.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c2f53a-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656534, "uuid": "77cad758-262e-4ce7-8565-f59480f8efe9", "comment": "Malware payload (Rhadamanthys)", "value": "6ae764d974981823d554c3ba6b82e0ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656534, "uuid": "6491ba7d-0e7e-4db8-89f0-19f2da1006da", "comment": "Malware payload (Rhadamanthys)", "value": "c76eaed0bfd2383c50f9ad4841fc89445ddd6758e5f740e4049393130d819ff5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656534, "uuid": "8fad4bdf-01e8-4682-bf2d-4f8b5e81e2b3", "comment": "Malware payload (Rhadamanthys)", "value": "7574660d9af432df1f1cb7429b489d1792fa5ffb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656534, "uuid": "6a019eac-60df-49ea-b83e-25403ef06179", "comment": "Malware payload (Rhadamanthys)", "value": "13294b4ce219a2a54deb936cf35d67cc64c204e9e7f6aff115c8676d4b2dc627fed54b1b5f5e1dad467ebbe306da8456", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656534, "uuid": "3aa2ed28-09d4-4d5e-b005-8e2a7aa19aed", "value": "T114A33A2A1AE1AFDB231D7CF926D785F5840FE46787092181B73EFBA47274B6845003CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656534, "uuid": "91521c9a-623f-4f92-8cb3-c37e3336c435", "value": "1536:GDB7eKg2043drcrm/QOtAX3D6BkQWJ+aY:GDB7b043lSg5k3D6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656534, "uuid": "9fb27a7b-893b-47cd-9da3-38061555361e", "value": 102105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656534, "uuid": "c43bc045-ce4f-420c-b4a2-329d53a8fae0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656534, "uuid": "5c6ee61d-90a1-47f3-91a9-4f656d373a55", "value": "invoice-1637482117.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf15a49c-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761646407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646407, "uuid": "a04ca872-e293-49be-9807-3c14ec37cf97", "comment": "Malware payload", "value": "996aea97ce2f4194a80e898b28efe500", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646407, "uuid": "c67589ae-29e6-4cd2-8c6f-d57c9a6cdfca", "comment": "Malware payload", "value": "c7901737aac985af2419bc008a3b5c89f2c6386c1cff9b16d91aac664f14d455", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646407, "uuid": "b5577224-7175-4508-838b-0a30b97a5ca6", "comment": "Malware payload", "value": "fd4499de53c379a0c358cbb68df4b504717aed06", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646407, "uuid": "71c207ba-5ba6-4c85-bfa1-566ee963b3d6", "comment": "Malware payload", "value": "a6f7d9171614595bae7a30910223ebf43de24d4ce8116caa555c4fd7912daf4a4d0299915e730f264c436f4e74c943f1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646407, "uuid": "0a0c51df-f0fa-424a-ad70-d6eb0d2e3ae2", "value": "T1EC153302F475125BCE961077B067A321F371E7F64D6865A3B310E2646A7C3222F29E7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646407, "uuid": "bfaec769-b35d-4fdc-9981-60cf4204da2f", "value": "12288:smnSsBWLiwqzn4iXrtlYic3MHhCbUuX3w0IoSayMbTKF7DgU3duSXjv1:PnSdLiwqzn4i0x3MBCBgsz47D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646407, "uuid": "ee1606e9-8dd7-4127-aa38-1ff35fca28e2", "value": 918566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646407, "uuid": "55404717-8938-483c-a9ec-8d6186081901", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646407, "uuid": "dc27ba37-b8da-4018-8fac-6362bcbf473a", "value": "FIX_slimBOXtv_11.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d696d9de-b421-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761671787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671787, "uuid": "8d3a251f-418f-46fb-a04e-b5ca2923921a", "comment": "Malware payload", "value": "be9d862182a8bd07e6ff4ad383108ee3", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671787, "uuid": "2de9a9bd-ef8c-4fbd-b7e6-f689ff5684cb", "comment": "Malware payload", "value": "c7cd46cda9e6c35346dc5039ae6a4f49dbddf10d2082d331aa1a51fb58e417d8", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671787, "uuid": "efca0d26-38df-4be5-94e7-573921932a92", "comment": "Malware payload", "value": "7cc3214e38d3aff64c3e327a264b149d25ebb3c3", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671787, "uuid": "a65b7ca2-c5ee-4aa9-9f6f-3b75f81fa0ed", "comment": "Malware payload", "value": "247478b05fc560b353ff71901c3fc22521c98787f601d00de3326e5b59efa7fb8c244adbf2b81b11d4169c26542481b2", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671787, "uuid": "20d6a5e2-6e3d-494d-a848-e4fb3bf84336", "value": "T1D307337561B518B9F2F1123242A284C66B63FCB41722CBDF03AFE1951E6B2618D72D73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671787, "uuid": "448e7a90-1b9a-496b-b0ee-ea5fffeb3893", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671787, "uuid": "02c84aa2-1f25-4da2-97d1-9854c3dcc305", "value": "393216:lqgG88DedL01+l+uq+VvL1+TtIiFMXvB5IjWqQlz15dssQbdF+da:8GYeR01+l+uqgvL1QtIH/3ILQBds5F+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761671787, "uuid": "3ba0169a-142f-4bea-a19e-d97b2ae9ffd7", "value": 18053987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761671787, "uuid": "9640ad66-79dc-4aa6-b2dc-1f9c8c0a889b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671787, "uuid": "91b64c35-813b-463d-a717-91ac8a7a1686", "value": "controlnetupd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa0155b-b3d4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761638436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638436, "uuid": "996bb601-a022-4e96-971d-301423f3dc93", "comment": "Malware payload (Mirai)", "value": "b7221b09f5da15931cac607ab8174f18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638436, "uuid": "d9f95301-4f28-40e5-a69e-01c1e33c29ab", "comment": "Malware payload (Mirai)", "value": "c85b67faa04393ca57d8a65f7d3dcc78b7e76ab68453c456c9210dbf9623bc64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638436, "uuid": "508b4998-2b35-47ba-a2d2-d9dd68bdd804", "comment": "Malware payload (Mirai)", "value": "31a9f8fa098f267f60ed434280b2cd11991d364a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761638436, "uuid": "b43b5005-5d0c-412c-9afe-8c434d6c63ca", "comment": "Malware payload (Mirai)", "value": "0cfc7dbbc57e6b572881ae3d26248d8782fbf22e3dd578e17403fb0497db05569a084a1cf6a5fb20e62c9ca15822c920", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638436, "uuid": "f148b0c7-2589-4a02-963a-e8f1fc44ff87", "value": "T12B931755BC829A17CAD4137AFA1E42CD331663ECE2DE3217CE255F2137CB95A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638436, "uuid": "159df35f-f325-421e-80d9-01f5a9bcc002", "value": "1536:Ea4NBgxudzsno6jPRhpQ7ZfG3pPLVpsBPpDjwl46dfbpfBJOuh1B5DC:EaMix+zR6jPd0ZuRkaNblthtDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761638436, "uuid": "afecbb63-92b3-4d53-a559-0f8fb36a35da", "value": 97488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761638436, "uuid": "02328457-ae6e-4a35-ae25-a2f86bffe1b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761638436, "uuid": "e9fd02d8-c009-423c-a019-98ac5ef0151f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c16393f-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1761634725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634725, "uuid": "4a12dfb9-97f0-42b7-abc6-44db87630237", "comment": "Malware payload (DonutLoader)", "value": "9806763ea55981a8f3d77ec238a68fb8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634725, "uuid": "d4a9969f-a407-40c6-8b3e-560742863580", "comment": "Malware payload (DonutLoader)", "value": "c880b07833516db3450a16cf33c94dc08ff6aa49990bba2a2c1f3b5b93e61b8c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634725, "uuid": "662ef35a-a00b-4a09-898a-81f504c79e8b", "comment": "Malware payload (DonutLoader)", "value": "7e8fc4df99e484dbe0fb4eb33eb4d2246a2e1a0f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634725, "uuid": "b9ff5f14-cc45-4c92-84f2-8fc9d30f62cb", "comment": "Malware payload (DonutLoader)", "value": "1a38c91c0a75e623f39c97db13f8add9c21a791e7d3e06307561da2b13424d4278b5c959dc2db7b3a2076dfeca57cb8f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634725, "uuid": "292652ad-c736-4dce-bdeb-f3e46ce9ebc0", "value": "T11205E027D96DBC94325C3DDC53E72A0A10CB9AB2B4281ED9D4F50C9F1CD3247EA1E24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634725, "uuid": "fc671973-7680-4f9b-a360-3011d178d5e2", "value": "12288:Qe8hpau4pd8P4Tp8x8p4g8x8FN4PewaP+SnWuAfc7fKTYdIT7Otd/ULMerhz1rTV:RWTczoBT74d/yrhBrB4w1x0p9OAza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634725, "uuid": "03d492df-97b2-476e-af50-6e5d9288d62c", "value": 802480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634725, "uuid": "65bbba8f-1dc1-4b68-8e0a-357524898218", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634725, "uuid": "cec10448-7a83-4cc3-90db-b935c8827684", "value": "FPHSB0000063602.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da86c48-b40d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761662967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662967, "uuid": "480f2177-1d4d-47ed-8c60-a446e30c6a89", "comment": "Malware payload (Mirai)", "value": "90210c845f4191ae92af6489906bcd22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662967, "uuid": "93d7975f-b940-468b-85aa-6341f3cfbde8", "comment": "Malware payload (Mirai)", "value": "c918030a7c316eb7cb2db3e83775b667af05d563f0c492faef69535c564332d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662967, "uuid": "ec6648c5-08d6-4ff1-8215-f29e3056980b", "comment": "Malware payload (Mirai)", "value": "3ee2a04fbfbe1d3d82766f3bcc50d68d6be496f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662967, "uuid": "e36363fc-a6ee-4326-886a-6758d647e52a", "comment": "Malware payload (Mirai)", "value": "37637a8d0e8ddcad2dc65e37adcce7517180dcb2dae9c18ac310f2a8b1025ebb942dc88475f35a749b293e40dcb1b074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662967, "uuid": "e99a0891-b760-480e-aead-5de3578b32f0", "value": "T17A04881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662967, "uuid": "f3c8447e-8349-41fe-86ab-00b7452594cf", "value": "3072:jg57Rd7LHZwbq1YSBan1yvbysxr1uGSuI:jglRd7LHZ0Bqyy1BSuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761662967, "uuid": "d4ac7d85-19e1-4333-9cd8-0e398248e070", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761662967, "uuid": "dedc98eb-6414-4518-8fa2-c7fc5b7d5285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662967, "uuid": "185ad720-e877-462d-bfc4-9723c633368e", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94966a4-b3ef-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761650263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650263, "uuid": "973b9c92-1b92-48b4-bd37-53c0038a4717", "comment": "Malware payload", "value": "3af08858f9e1791aec985cb1ebb8a309", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650263, "uuid": "ca53062d-2842-4432-82d2-616705b9f7de", "comment": "Malware payload", "value": "c91f881df7c4a0840f9076c91019bc2619328fba7a2f72c41e941440a6edf9b0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650263, "uuid": "7c7b4a47-3f88-4b2d-a5c9-fa54856744d8", "comment": "Malware payload", "value": "f3ec00d5a2046fc9c16241fb9e7a1d6496b94f6d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761650263, "uuid": "e1e02f2e-6abd-45fc-85b1-cf3c9db55df9", "comment": "Malware payload", "value": "3306d171a95c121de63c64a64dc0449972063b2d915c1bb697dc8f85e9ba921296d5eb8868bb8461765adc0df7e982f1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761650263, "uuid": "49dc03ac-b4c4-470e-b92a-160a5cca6df6", "value": "T134C08C85883CE0B157350A4EB268F1F8A91295244FA478A2D424C940A4B40700C4F33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761650263, "uuid": "ed213e92-4ceb-4ccf-afcd-69d909eb74a4", "value": "3:WFBIx8sv3uy9Fb+dNMfeA4LRzdXXctbeeymHgmQmk0QQHFxaFOd6HhC:/9vrbsMfeFzxclebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761650263, "uuid": "4c61dc74-6a2c-4fef-a1a7-d7ceeaa67d29", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761650263, "uuid": "cbdeefdf-d10a-4b86-93b1-cf1013044a63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761650263, "uuid": "59167e2d-d95d-4f0d-ad55-8a00ec9cee37", "value": "b821bej3te.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc481247-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761646403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646403, "uuid": "6278d625-e7fd-4971-9600-2f56fd0f248a", "comment": "Malware payload (a310Logger)", "value": "9fd389da6ef25130eba37934266e4f80", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646403, "uuid": "0f5c0c40-6a8a-4c61-9507-30481c82ebe6", "comment": "Malware payload (a310Logger)", "value": "cc396210891720f553f38f329ab600593f16a6dbb8d32bdf3973ab7e857bd8bb", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646403, "uuid": "9da54f23-d2a8-4fe3-a8bb-647e87660a52", "comment": "Malware payload (a310Logger)", "value": "aec71a133cabaa6988aa46c60fd2d061435edbee", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646403, "uuid": "23d7de56-ca92-4644-91fb-678e7d7ed755", "comment": "Malware payload (a310Logger)", "value": "da6216f6b7cf28987b014e759f5e030fdd829210b468049e38201524fe56958c2cfe3a72358b87c4af4feb24085663bd", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646403, "uuid": "77c63647-1c46-47fd-8808-e69a3ee1fdb3", "value": "T1B275D021EE528C3AF11E357DD82BE6D6181D7FE02E14B41E7AFE3A486F3D5836416092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646403, "uuid": "23414b25-2fe0-46e0-bdca-6dfac5d57ad3", "value": "85f9f0766eb9a2e132753e8630241bf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646403, "uuid": "5b2a615e-7ce4-422a-b19c-85165f2d7f68", "value": "24576:1XlXEs0szK9diw/WxQrafjYXDEFkHbXVayeZQl4vxE1lPAOJPKup:1a9W6mUXY6TVayeZI4veA2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646403, "uuid": "c835cfd0-4031-4b51-937f-36d8f9272962", "value": 1652224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646403, "uuid": "538a2a81-8b65-40f2-bbcb-179233bb3439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646403, "uuid": "1e05c700-9b98-4415-af51-a2fcd0e403a6", "value": "Comprobante transferencia.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88d9b96-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761646423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646423, "uuid": "1197fd7f-8a64-459f-845f-259e5bdc6001", "comment": "Malware payload (Formbook)", "value": "2f609c9237303822ae212cee6aea3960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646423, "uuid": "ec64ca6a-134b-4159-ac5f-f81e6ee689ec", "comment": "Malware payload (Formbook)", "value": "ccd3778fe181869c2e3d909a55f2fe3e409d7f23e0f774dc775d8965dd5e1533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646423, "uuid": "bee818ba-eaee-415d-ad11-b1700d86c62b", "comment": "Malware payload (Formbook)", "value": "631c1d185dedcfb4fe7ab04e5013c6f67eb2a707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646423, "uuid": "48899068-aaf7-419b-b5f4-5d50a981b86f", "comment": "Malware payload (Formbook)", "value": "34bbdee40ea3618e72eec8059a5bbc2995c32ee87cf29805dfd4fc65aca1ae7211681638acbbab8cef3b557c1b6e1fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646423, "uuid": "cfce3611-ba9e-4ebf-9be5-e729d76b69b5", "value": "T1651501182B5ACF12E9915FF50972E37813789D6AAD14D6128FE97CEB323AF042D19313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646423, "uuid": "04ca6959-60ce-46c5-88f1-e357ee15c1e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646423, "uuid": "8b770d75-6a46-4570-b08b-c52d9986be73", "value": "24576:fRf7PPV6O/bXqfZQqZJGBTHrVOarX0pxjClJgy3X3N:Jf7AOjUQqZg5DujxyH3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646423, "uuid": "bb6003a9-dacc-4ff5-b6c0-4c7e8e820199", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646423, "uuid": "3dea22f1-86e9-4dca-a2a0-5fddb45ab0f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646423, "uuid": "ce61feff-a7c6-479b-8458-7fb7baf7c386", "value": "QUOTATION#00785220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002747b0-b422-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761671857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671857, "uuid": "cb89cab6-6026-42f2-ac8a-fc5873699a47", "comment": "Malware payload (AsyncRAT)", "value": "99816f97f9d1e41e24d49e071e25c4b9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671857, "uuid": "03684ace-238a-4685-9468-7244fe1e2127", "comment": "Malware payload (AsyncRAT)", "value": "ccf8e91c6e9ea085ff556a8f43ff2612f24533a56a45ec881959f3a59b34b46e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671857, "uuid": "488e23f3-4f38-4fb5-a812-034d87a4e097", "comment": "Malware payload (AsyncRAT)", "value": "8959f7fe9ae5346666e7a2cd9b848b7c0e79886c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761671857, "uuid": "7e44476a-e4fd-4417-b5ab-db16bd405af3", "comment": "Malware payload (AsyncRAT)", "value": "b1ba1a5950e3fffe2d900914a5b6291f7045dc843d77a8ed5e88f792f7c0da363a433fa7790c08a60b6a8d63db4255c5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671857, "uuid": "b9287640-4a48-48d1-922b-34941ec0d6e3", "value": "T181F35B42B751C2E1E0794A33E5A6E5F10F35BD1BEF06651F3084BB473933581AE13AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671857, "uuid": "501f19b4-380f-4b59-bd2a-f1a65f617491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671857, "uuid": "33762aa0-a99e-482c-a4ae-cb455b057383", "value": "3072:455RLi6wbShWH8ZNOSz+BBz65/M6If+3Js+3JFkKeTnA:4pLhwbM48ZeBxBt25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761671857, "uuid": "e9ea749c-1f0a-4d4c-b80a-ea070f298943", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761671857, "uuid": "d790ac95-65b4-411e-b63f-7cfa331ba9bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761671857, "uuid": "210f23e2-dc1b-4c95-9443-7b72bf68f744", "value": "UltimateTestVersion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403aef6a-b432-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761678836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678836, "uuid": "b6fa9d0b-d5a6-4e54-990e-9cff69a26f74", "comment": "Malware payload", "value": "457b06c15fae79463f99c1881c2e7da1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678836, "uuid": "410e3299-9164-423f-8b10-b05fcc8356b7", "comment": "Malware payload", "value": "cd14d28faf0b5f24544833bb0f1485cdc211766f7971c5d8a56db04c672b6786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678836, "uuid": "2c8d4fc5-0d86-4745-9183-e3d6b98f8ad7", "comment": "Malware payload", "value": "542526fea26a0018d1871c81142fa6b31186416c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678836, "uuid": "23130c94-c223-4375-bf72-b51c2f3c11a2", "comment": "Malware payload", "value": "bf7e38b10cc6d3ccbb75d41676df21403d65178c15ce71fd04fee8c359938c420649381175fc4d03a2ed25657a7e526e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678836, "uuid": "21de4f69-04e6-40ee-8f28-caa31aedfa9a", "value": "T1DDD3D50ABB600EFBECAFCD3705E91B06258C655722E92F357634E928F54A14B0AD3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678836, "uuid": "ede7bd55-26fa-4ea5-8e32-71c07795968d", "value": "3072:x8LCFgNseuNEjGXYlJFMO9LZGBxTOzyDVDw:ACFEsjNEyXYlTMO9lM5OZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761678836, "uuid": "adedae09-50f5-43c9-8d92-8f7d6326f2c6", "value": 132144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761678836, "uuid": "9e62accd-6144-43aa-87f2-5bd69a554919", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678836, "uuid": "6a0aac1e-2a53-4f08-a2ee-fc4e3e86c028", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f89a8b-b3a3-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761617701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617701, "uuid": "4c934f19-e707-4064-badd-2e1e7a44dcb0", "comment": "Malware payload (AgentTesla)", "value": "98079328ebfffd30ce2c4c53f07325a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617701, "uuid": "65512102-cfcf-4944-953a-5208977454b0", "comment": "Malware payload (AgentTesla)", "value": "cd28f4cec3a0409bcd2b192b2b8a9b374773ea05dae2169893ba36818542bcba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617701, "uuid": "756729b4-c83c-4929-b149-cb78d3be815b", "comment": "Malware payload (AgentTesla)", "value": "df5019e36fd4490aa95fcf2b94e476c7f3099bd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617701, "uuid": "bc7cf6d0-f0a6-428f-9b43-4e2de7de3a26", "comment": "Malware payload (AgentTesla)", "value": "4faf6f1206c1514b56f283f12fd571157d6df23018e075ef2781e4fbecd159bbf9a3e63c431c4a8c05dfd7d35453c947", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617701, "uuid": "93d7d0f7-59d5-467f-ad9d-237b8d3308c5", "value": "T1C772238D7DCAB1A6D362E8332E3BF4C9735A5980F9CC8157F2749160FD60718A9D2838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617701, "uuid": "2003de0b-fbe2-4389-88e2-ab47831582ec", "value": "192:mh9CRUzAm+loXNos8m4ZlFFMfubO49CvTxwIMPZVkgApbofKsvUfqkvmls:G8cae9+TMfydHnRRApsSryYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761617701, "uuid": "a8ee78c4-6897-4dde-ab0b-4defca2a0110", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761617701, "uuid": "2a983530-f421-4bbb-b166-c941c0216ff4", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617701, "uuid": "109e7088-fb07-44a4-adcc-2d4a56a922fd", "value": "shipping document.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822afccc-b42e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761677229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677229, "uuid": "71803700-5ae2-4adb-ae2b-0702ab175fd5", "comment": "Malware payload", "value": "369ab19eab99f90f5ccd7d418f627ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.Generic", "colour": "#209922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677229, "uuid": "72e0a3f6-8558-4d5e-84fc-4926b1ebdd29", "comment": "Malware payload", "value": "cd6e6a5113fb23bfb3694639f0874baef1ba7ed7e7c1a94d6b6f1faba3ea2192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.Generic", "colour": "#209922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677229, "uuid": "cd403752-a150-4aa0-91ae-8e44196aa815", "comment": "Malware payload", "value": "f2631a45b25e53187c4ab724aa8831b755856eeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.Generic", "colour": "#209922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677229, "uuid": "869e3263-5ca7-417a-8c9a-ded7a43c5dd8", "comment": "Malware payload", "value": "218b27241679f961428c21804250cc73fc90c6c6fd2ea9859e5ae5fcb233e856e70eb88a7c3eb64835921c67a5ead28b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.Generic", "colour": "#209922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677229, "uuid": "909f7a05-ae74-436b-ba3d-293b4734c14f", "value": "T176473349FFE40CAFD41B4178C8F1EA6652E234B20794955B0BE88D7A2D771E9AF30B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677229, "uuid": "3652a46c-cf89-489a-838d-ff7de93cc335", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677229, "uuid": "6966572f-2adf-4bd6-bb9e-3ea8ffbe59fb", "value": "393216:7c1or2ElRy2e/FInEroXXNVK3vL6CpILuYvDarrv2q7+bcZ05t14S2lDqcMTEepJ:7c1orBlpErUXK/+CGLuoDarzoM05UcdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761677229, "uuid": "99314f9d-c478-4ece-86b5-6643a2e39477", "value": 25110002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761677229, "uuid": "7dab96f7-b6bb-46c8-b8e6-919b42ef8602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677229, "uuid": "b4a03eae-0417-40b7-a672-b7079a5d0859", "value": "bridgerton_gui.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3e6522-b3cd-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761635563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635563, "uuid": "877e8cd6-7d42-4130-ae4f-441b7d36e0b9", "comment": "Malware payload", "value": "0bf5b2153831603511c9804c92ec3a81", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Instagram Followers", "colour": "#B9D54D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635563, "uuid": "20e522ee-bae6-479d-90b2-aad50057523d", "comment": "Malware payload", "value": "cdfaf0bda2bee638f5c5c6f547df1f5ca830a034253731f6528177745ac8ffff", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Instagram Followers", "colour": "#B9D54D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635563, "uuid": "bd210082-b77b-44f7-8e6c-a659c80ec310", "comment": "Malware payload", "value": "7d26b6ad9f7e0ad95a73fdd663522ef51144b540", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Instagram Followers", "colour": "#B9D54D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635563, "uuid": "d474555d-8a10-4c36-b23f-d842d3bdc821", "comment": "Malware payload", "value": "352167ee220edf5d8f388d7b60ca70ad2f62b725e5bf062319df8d1f8cd9b545a87890a93c7ce5cc741c5e5ef11d8c72", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Instagram Followers", "colour": "#B9D54D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635563, "uuid": "285204b7-0a3c-41b2-9e19-6ebecf708c46", "value": "T176E712E3E319AC69D0F38336937520A7F9254C649B53F2670D02B6386EF7AE08548ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635563, "uuid": "6364639e-f892-416a-a5bb-4cd54f18f3cf", "value": "1572864:Euts3ZG01mbHWzvjAC+lZ1gNC7ve2+gg/iiX:Eua1/j0C+SNuu/iW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635563, "uuid": "efb2883c-cb62-49fa-9fc9-433e41b1b7f2", "value": 67173213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635563, "uuid": "845ec88c-8699-42d3-8bfb-148f0034d075", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635563, "uuid": "6b191a96-6e18-468c-9eec-bcd44a72fcb1", "value": "Redeem_Free_1761506846857.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c690c9fc-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761646420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646420, "uuid": "39a1c3b3-57eb-4f99-a6e6-ccc678335961", "comment": "Malware payload (AgentTesla)", "value": "e4ae78ae1264e0a009792aede4864bab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646420, "uuid": "5a0f7509-5f86-4f0c-955f-7a064b4f564a", "comment": "Malware payload (AgentTesla)", "value": "ce12e8c0c63d8f86bbf4f6850ae4a9a4abcf18ef51a040bc0f094f398e6c9282", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646420, "uuid": "bce665ab-59ca-466f-84f9-416024893205", "comment": "Malware payload (AgentTesla)", "value": "bd0af25e7c45b256bf18e5dbeaefd4ca1b272713", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646420, "uuid": "5f7f9c82-94ae-4f33-a229-4ddb0bd27364", "comment": "Malware payload (AgentTesla)", "value": "143fe3c6885a7da8bd893335c24ccf98d21a3f245d65c905725197c2bede92621c3ec7ea228791659045bc5d3705751d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646420, "uuid": "611c0c2d-a509-493d-96f8-cb94a86ae419", "value": "T12A45AEBF6BF9195CF175C8F6FDE371209206AB2C0E0B4A45CCC9D2662E2164CD5972E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646420, "uuid": "e379036c-cc4c-4bef-9c34-866ea1f07a9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646420, "uuid": "7d63a180-b691-415d-8616-881a8d2bc66e", "value": "24576:J1yj5blHlG/eAvVptfagxqse0hSaNPmdAQu:oKv34gx1e0hxNPkAQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646420, "uuid": "98303a96-cbe9-450b-8e04-5496080fff2c", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646420, "uuid": "da80d6a4-6187-45a9-a2de-11da8ce41d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646420, "uuid": "2e5cc336-7432-4003-a20b-222138c1dfe5", "value": "PO 4502632014 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6eb5ec7-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656755, "uuid": "2485863a-3708-4a09-80be-587f09068aae", "comment": "Malware payload (Rhadamanthys)", "value": "9a9282fd8d8c52a08922d24f8d6e87ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656755, "uuid": "2f4ae804-3b7f-405e-bbf3-a3b4c9cffe28", "comment": "Malware payload (Rhadamanthys)", "value": "ce28446f56fd5f91c563142fbe8d2187594351fd58c7e9bf524ccd247c4888e5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656755, "uuid": "a23613c5-732d-4429-9ad2-f8ccf8f6d6e1", "comment": "Malware payload (Rhadamanthys)", "value": "4af612c9fb1da74e0a0875a26eb0c2cb690dd77c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656755, "uuid": "e7354a8a-c0df-4f25-b673-c179b083b3e9", "comment": "Malware payload (Rhadamanthys)", "value": "d262102222ad42b998c424843848784dd0bbf0247ba345d2b4a18c5f6314eafe9b4bb4d38967d15d5d9583dac1d40411", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656755, "uuid": "8b98d62d-166a-4478-bc71-056b20f2d902", "value": "T1AAA319565D32983221937A9B0D224DBBC8CD0F44613A29A6D21FE748DA3CF7D256F3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656755, "uuid": "2b3138a6-5d7e-4c4b-a437-98e504ce6245", "value": "768:GDhd0i7J4sYKgY/CMNfWdpjD4TEhzBgrXIsrg4Xo32HMpDSQAPjCE1QJSLAuAArt:GDB7eKg20pWrRrg4Yl/AzCJ6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656755, "uuid": "91610f61-3f0a-41d7-b94b-5101d44e56f5", "value": 105361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656755, "uuid": "e649426e-acac-4d24-8db5-2a1d27fe3fee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656755, "uuid": "dfe5c043-6bfa-468e-acfe-b55506a82faf", "value": "invoice-1637482117.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56c1c48-b41f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761670926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670926, "uuid": "f5a5e8b2-607d-47b2-b148-5f167209e1b8", "comment": "Malware payload (Mirai)", "value": "11f9fed4f28916106ce3402b19a8a9de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670926, "uuid": "5a757fcd-c5b4-4250-b4f6-ef784fe8a77d", "comment": "Malware payload (Mirai)", "value": "ce41f6732b70e4fa9f53dd07d587ac61ba34aef35c2f5659ecf1115af2eb1bcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670926, "uuid": "9630b1b0-7555-453e-8342-8b288eb28ba5", "comment": "Malware payload (Mirai)", "value": "832b537733eecefa3d5226c97f0f678c3ba72be2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670926, "uuid": "e2997290-f514-4ede-8c72-17ff70bbaf83", "comment": "Malware payload (Mirai)", "value": "01081d1eb571e837f98ac20117a06c1731bb424e90a22d8108c9aa06220b831907edd219e10a607aaa51f458f7231209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670926, "uuid": "72d39479-55ed-4e58-8b0c-aaed67e16ae1", "value": "T12204C588FD54977AC7E272FBFB1C03CD773A0798E3EA711689310A6137C9A65593A011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670926, "uuid": "39219cf0-5ca9-493b-a64c-681ae56f8105", "value": "3072:6F1fS34eU99Dv1lEgP67r5i/r54ybA2NrjC13wUYVNm4oo:OL3PD54yk2Nrm5wUGN1oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761670926, "uuid": "fdda6567-44f5-4923-b1fe-326eaadf4cd8", "value": 183332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761670926, "uuid": "a942f465-cb59-4a5d-a2d3-2d74cb1d93d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670926, "uuid": "9103912d-22cc-4b40-afe4-4d5feb0f3ef0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4962b216-b40d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761662960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662960, "uuid": "d4d9eb58-c881-45bf-9b41-09838e2712e6", "comment": "Malware payload (Mirai)", "value": "151e771142491e6d13685c1710d24177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662960, "uuid": "91a52606-86ee-4758-9a34-072de835d785", "comment": "Malware payload (Mirai)", "value": "cec14d8fd555aa1f8e04fb240effcdec0496789a5598e1124772d15033c865f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662960, "uuid": "ea81d4ad-6eb1-4bf2-8055-e66c8f2ed808", "comment": "Malware payload (Mirai)", "value": "ea1e64f372d2c6be80af6ddcd76bf5cd106a25df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662960, "uuid": "1cb0b9d0-6658-466d-9510-b9a6bd850a43", "comment": "Malware payload (Mirai)", "value": "fd28e78d3c9e1212ae7531526f2cddcb19fb779c7daeddc8cd976e42ad8d807ce0bcbfb3abdf2d269bf90b71d39187fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662960, "uuid": "f0e0b94c-059a-4b2f-a536-d0a179408b60", "value": "T10F04B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662960, "uuid": "b19a2acc-205b-44a9-8b65-7a81606904b5", "value": "3072:nKpzGQeNkSfcQqmav8SqaRVlnYz650Vt:nKYQeNYQqmeqavlg650", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761662960, "uuid": "ae6baf68-c386-488c-8c1c-04033c911b09", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761662960, "uuid": "d4f526fd-07f3-4737-96eb-77221cb7a2ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662960, "uuid": "40c792a6-688b-4f3d-8049-90c6919291bb", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eabf485-b3cc-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761635052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635052, "uuid": "3f9609c7-c6be-4155-a51d-00ba4ca63705", "comment": "Malware payload (RemcosRAT)", "value": "d0516def9e198962d49e3bee01360bd5", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635052, "uuid": "524d3b77-a810-4594-960b-1ea08b82ee1d", "comment": "Malware payload (RemcosRAT)", "value": "cfe70c1563dcf679b3c29c5ff07c7ee49502bc9c68b6e32020c33c2131b996db", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635052, "uuid": "69a52993-3367-4570-9055-9c4519488db3", "comment": "Malware payload (RemcosRAT)", "value": "11773f534e8de45659274b69586af94b4ac6fd57", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635052, "uuid": "cd0e2a02-981e-4b63-bfa2-9c9b336321c1", "comment": "Malware payload (RemcosRAT)", "value": "b3ad629d52c76ed7b1211fa3e9da231db66c1eecdd478e7fec2e3a48bfb7e7912e48eacbc68e235867189a91428a96ea", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635052, "uuid": "f88aa2e8-2a80-440f-9401-c6a06782d345", "value": "T19E356C1AF167ECDB193912EB7E401D69284C8D87C2FACE785D4AFC2760C559850AE3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635052, "uuid": "895ef408-0ec3-4b3b-a2c4-675ee6418dd6", "value": "24576:Tgw8wF7tunN1z/vVneQ8RmGkYiQd+53A21iG/BOIq3uNAtXWl:X8wltuN1zHVen3kf53AgiqBOI0Ntg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635052, "uuid": "1d80c373-163f-496d-9d19-795eb6b29ac2", "value": 1071598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635052, "uuid": "8e4f15dc-00b6-4fd7-9ce5-bc307a1f0a82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635052, "uuid": "2e7a3ecd-8529-41be-a166-d9444e4e8e01", "value": "Purchase Order and Drawings-2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cec41e5-b41d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761669945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669945, "uuid": "08a5f0ff-2af1-4b4b-bcaf-87fa417c459a", "comment": "Malware payload (Mirai)", "value": "dcfc9eb7ee2fc7b51ebbe5dc4320918a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669945, "uuid": "0b4c9af3-b2e8-444b-ae84-ae3e0b8bcfd3", "comment": "Malware payload (Mirai)", "value": "d078a3e7322a77f9a9eb36622e3e19ee75fa6725c6309c2d486460085687cd42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669945, "uuid": "06318764-1276-49d5-a4d2-28c4244a9f5d", "comment": "Malware payload (Mirai)", "value": "b5ba1741cddd953df7240cfe5978b63c708791d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669945, "uuid": "41e019d4-de50-4108-adbd-d2051d7bdb78", "comment": "Malware payload (Mirai)", "value": "c96af4b65561dbdbd9ee65a8597ded57929214f7a2348647fefa2f0ec55837e02a84eea27d7f5f2ed82d14f80a9b3d10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669945, "uuid": "2489e869-0030-4eb4-b67a-8db9168b89c6", "value": "T15FB3E195F210AA55C02262FC71860950D3B25EBE5B5B250A54A3F6746EBCCE43F0BFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669945, "uuid": "9e3dc757-07e5-4bf8-b565-b4dee429b8dc", "value": "3072:iff+x6DS5hXOTvlFrY375BZYO5SY+1hwuny:9N3+TvDYr5dtMhwKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761669945, "uuid": "ff875141-d177-44c3-9e89-560a7b12b605", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761669945, "uuid": "3aec3a85-93f5-4c51-89ca-ed5cf9cbe3c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669945, "uuid": "aa3e7431-a136-48be-8e64-ce9108e4acf2", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752626d6-b434-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761679784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679784, "uuid": "a4ddb923-e8b7-4237-a315-8f2843b83914", "comment": "Malware payload (AsyncRAT)", "value": "1757944c750d5311f357d4edad133588", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679784, "uuid": "41ffd16c-43e2-4cbf-abde-cd921540e693", "comment": "Malware payload (AsyncRAT)", "value": "d12bdc9a6526d3c116a0d8a3cd9b1f2d046056da3b473df3256fd657b27fbddd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679784, "uuid": "b7d46c96-5725-4932-8e27-a2988754d922", "comment": "Malware payload (AsyncRAT)", "value": "36ef65da8e59fd60a18a25e064fc466528d89e12", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761679784, "uuid": "6ce3330e-0bd3-40a2-ba20-77bf6afe1de1", "comment": "Malware payload (AsyncRAT)", "value": "1f75723aab1796095477148615a12f34fe68c92b72f6a482aebb0533b5c5ea06ca6d1b8c89eb9837d4b722c68125825f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679784, "uuid": "50c4a2b2-5b33-44d6-b5fe-13a3158f8951", "value": "T18A76331A59CEF178F63239792E3853917BE4B5E198B17A29604F34C80F76D64A3210EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679784, "uuid": "6c5bd5c5-b176-4fa1-8187-b5260c0d11d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679784, "uuid": "9c7379dd-239b-4205-86d0-9e94f0f7748a", "value": "196608:58ZGnUgM3pnZp/MSuH2wN+hzsY4T6sqZYu1aHF46i1z:58Yn5spZ1MSuHL8gx4Ua6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761679784, "uuid": "f08ed8d0-d65e-4b89-8684-52ca38416d46", "value": 7735296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761679784, "uuid": "96670792-afc2-4c56-8d1b-0a5243d79d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761679784, "uuid": "71a55cb2-259a-440b-8859-376d524e883c", "value": "LoaderPro (Media).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983d4c40-b3ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761648919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648919, "uuid": "ae9123ae-da15-401b-a432-5dd3a95be2e9", "comment": "Malware payload (Mirai)", "value": "f51543664952ea7af26e04e040293f50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648919, "uuid": "55c822bf-5823-45eb-a356-0b7d09d6de4d", "comment": "Malware payload (Mirai)", "value": "d13d7ef177dff9f231e974c6d8f2ff0222f1e1feae1db8c2829eef2a453dbd3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648919, "uuid": "8608b8f4-ecd6-4c57-806b-143fb1edce80", "comment": "Malware payload (Mirai)", "value": "882c66d445edc45c5c74856e8744da95957d0d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648919, "uuid": "e661df6c-2a54-474b-916c-ed107b3aad18", "comment": "Malware payload (Mirai)", "value": "b30b3f1a41fe1847f55b082477132bed2d9b862f5520f9e574cbe224ae7a9b36f0738de2a5aff4b224a53bb19dd77e7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648919, "uuid": "7a384c53-bcdc-4873-a9d0-14c04f80b7ba", "value": "T162A3E1A57110BF4AC06666BC70850A44D3A27FFA179A260A5873B5743EBCCD83F06ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648919, "uuid": "06ab2e0f-9b4c-44d9-98b8-d77555d17194", "value": "1536:Se8W7g23l8q8CpuqAJ3WCYTAFvAR751epSbnV82UY5uaZMtD91gOKSrppFphwgFU:SuZl8q7BAEACR75wMUY5D6DzdzFDwuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761648919, "uuid": "189b7f07-da59-4536-9dda-a5943ae90baa", "value": 99696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761648919, "uuid": "c568e92a-5dfd-4c24-86e6-5ba84308d5c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648919, "uuid": "d01bbc8d-04e9-4d7b-9ad4-866b39e21d62", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f29c14-b41c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1761669345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669345, "uuid": "c6efd33a-fa53-481d-bbb3-83c406c20836", "comment": "Malware payload (Gafgyt)", "value": "ce97257f4660b5d33c696293e6d15155", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669345, "uuid": "da87cfa6-1e8d-4aaf-b4a6-45d7a83239ba", "comment": "Malware payload (Gafgyt)", "value": "d1bb6b5fc330f5da4b04ce29fb3cf48d5d378dfe20fb287a9ce107fc22cbb2e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669345, "uuid": "e4b5508b-6eaa-44ed-97c0-0a6e81b6ca61", "comment": "Malware payload (Gafgyt)", "value": "f0c7b1f0c3066073d36415f34307c2d299998538", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669345, "uuid": "72953b9b-d76e-465e-a20e-4d017f5b407c", "comment": "Malware payload (Gafgyt)", "value": "91d3633719f41229cd1221028b80ea7e4d07f2397b20ad1c70443b1f15f3872b8d551101b5dfffe50e419172b3b7fe2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669345, "uuid": "95ae30fd-ee4f-4888-86cc-d76f264dfd66", "value": "T104530291C46DE275EEBA963F86E5C8F63AB9681FA4EC75870AE8A38C3431164047D109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669345, "uuid": "a60c451f-30ad-4b8a-bcd3-3247fe2c00e0", "value": "1536:KX/DQAFuvxb+ChEAWGFmbaM6BjnCmK9d03yO:0Y5Hhle6dCnd03yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761669345, "uuid": "5b496510-6a3f-4ef1-b5c2-1ab70dd743db", "value": 64324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761669345, "uuid": "71e84550-6010-4c99-9777-771be42d4988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669345, "uuid": "55710ad6-9f47-4bbb-ab3e-5343617568c9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8194909-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656730, "uuid": "52a65da8-b240-4633-b77b-f4538024e77c", "comment": "Malware payload (Rhadamanthys)", "value": "d57168d132de32b5e57aeeb950cf134a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656730, "uuid": "5c964941-7c6a-422e-9208-03afdcc26c28", "comment": "Malware payload (Rhadamanthys)", "value": "d1c99b484babe4358a036c523e8fbf53c8aa61dccdc1fb16283c05a3599726fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656730, "uuid": "cff4fa81-ccdb-41c4-a855-63be582c749a", "comment": "Malware payload (Rhadamanthys)", "value": "2fb52d2a9701fbae3c240a0011f109ed7b801406", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656730, "uuid": "0f42fb6c-130b-4d71-85ff-59886f00a99d", "comment": "Malware payload (Rhadamanthys)", "value": "1cc8cfb2a0e0f966219019a3ea842ad2f1c96e95e2d4ca723397509e70450d95a57c5a46f82f7d8fe3af9592eaa9dac1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656730, "uuid": "428e847e-7a15-4834-87dd-95a49aee3611", "value": "T123A3C86E0357FC92DA053B39BE0F7994BF0B02A6542331AE586DFB615047707B819AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656730, "uuid": "fff8404d-2365-4980-8dcb-e20bb4d41d30", "value": "1536:GDB7eKg20GCOrPr7jy1XAJz06BkQWJ+aY:GDB7b04Dvowz06BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656730, "uuid": "b927f4c1-fac8-4e69-9eaf-ba172138465d", "value": 105452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656730, "uuid": "54330550-6bba-412c-a448-ee0077c2f4e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656730, "uuid": "82e75199-cfcc-463c-9aa9-18fc62a05188", "value": "invoice-1637482117.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2053225-b453-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761693308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761693308, "uuid": "bdd8015c-bd13-4aa3-bbd4-70866e9a2de5", "comment": "Malware payload", "value": "609556419ddc7089052a924ad556647f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761693308, "uuid": "35551baf-8ea0-4cc2-bb0f-5912f67692ac", "comment": "Malware payload", "value": "d32da5dae38dd68ccb81be7a4a84b2004bfe47fe46c13a5dce2d649c5864bec3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761693308, "uuid": "bbbafe9a-53a1-4977-b75f-7968391ed72a", "comment": "Malware payload", "value": "aab15d5da218ba182f210ea27d4d74b90eafa26e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761693308, "uuid": "e11589a1-4de2-42bc-b401-9b8324bb710e", "comment": "Malware payload", "value": "372ef92bd30aa61d0fa6a10e6cf156659fd0bd7000c4542574dbd5de88a746e48ca44282e83d423044c4bbbda8571628", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761693308, "uuid": "4676c8ec-eadb-403e-b7fe-4910f73a5908", "value": "T15DD004044D053F54D41305CCCDC3F010001C04107F01D1C14F04443D404133C0F305CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761693308, "uuid": "7f1900a7-7b0a-4fa7-9ad8-3b7c78ea88f3", "value": "3:4cVr2t1uccs3GNKn:4e2663GYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761693308, "uuid": "b95ad542-1081-4eea-b292-ca21c63221eb", "value": 195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761693308, "uuid": "78b5d185-c690-4132-b0d1-f2a6dd052ec6", "value": "application/json", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761693308, "uuid": "30dd07ee-d099-4229-97fb-806a2e29ebbf", "value": "testfile.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa45c77-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660144, "uuid": "355bd11f-38ee-4c99-a320-d61260e745c3", "comment": "Malware payload", "value": "8145db87e52cc46dc41e67629b22da60", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660144, "uuid": "dfeb1537-4adf-4ac1-9a55-06ec4860e8ed", "comment": "Malware payload", "value": "d330ee709f31096757b8ea98046033ccbf5a6b178d5183728d0ab0ae150e2648", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660144, "uuid": "87583531-3025-41ef-b96d-284137b42e01", "comment": "Malware payload", "value": "84d9a7bbe12f630f46d00a01d5ad47f77516b62c", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660144, "uuid": "12d6a9bb-e9a9-49fc-98fa-b99d93486fa3", "comment": "Malware payload", "value": "95ce26e1351bf482a2f7ab454bce384b68f86d2decadfd2d62e464c8ef3e894325fc84c6c1552503b69b715032a87825", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660144, "uuid": "f4867106-a02e-4377-9e15-dd1acc72a677", "value": "T1C0814421AE01121691F323BADA9A415CFA97817F914C1344B0BED6803F7962D4BB2FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660144, "uuid": "18cae66f-30cb-42e1-9b13-1a065dd4dc9c", "value": "48:B7sBRHB5Zs2XCvJ5rBhpQjDPCX0JpppT0DKoJzgDEIOkSpDgaWDlgw1wPNx7:eXEnFhpQvP42p3T2bJGEQSZDslgyQx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660144, "uuid": "4720e186-6f7c-4f33-a19c-226dea3a7108", "value": 3929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660144, "uuid": "80871d1e-316c-4824-b800-162e26766d4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660144, "uuid": "353f41ea-b15a-4688-b7f9-7c08e0c35052", "value": "grab.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5b1d51-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656548, "uuid": "1d0428a1-0206-4aa3-98e0-d78385faae85", "comment": "Malware payload (Rhadamanthys)", "value": "7cee1d6f563d90a4e8a62a52abc95f92", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656548, "uuid": "46951d3c-e1e5-40cb-ad29-57d019c28118", "comment": "Malware payload (Rhadamanthys)", "value": "d351bc97f0d961309b35a42fbae71693f45269b01f1b79a83bfeec87e012ce9f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656548, "uuid": "99237aaa-d606-4a4e-aef0-471d19a35f36", "comment": "Malware payload (Rhadamanthys)", "value": "b666e51dc4414aaaf0106fa3cf6288f600b17814", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656548, "uuid": "32d55b4d-a7f8-470d-b3e8-31b8a5bc653a", "comment": "Malware payload (Rhadamanthys)", "value": "fac5a85761d29b714fe3decd5087d1898d08d5b23ae0afb273913a4911fbd38036cffaeba8cd15f0d4b09732b6927f63", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656548, "uuid": "d68117ce-87f9-4ab9-b206-6044496f1bba", "value": "T1E9A33C014F34ECA5989170A8FED5A4F0DF0780EE2A9D9458B72CF752215F94CEDA1BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656548, "uuid": "deb20239-2a28-43f1-94d6-54da85befacb", "value": "1536:GDB7eKg20I46r0r64vH0VcbXVAXqFQXq6BkQWJ+aY:GDB7b0I4IaLvUVcbXkqFQXq6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656548, "uuid": "aa76110e-411c-413c-bf71-4453bd28b013", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656548, "uuid": "302fce14-2d67-4009-a20b-186c62429591", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656548, "uuid": "96596c26-3cba-43a6-ab9c-245d90df7129", "value": "invoice-1637482117.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e12794-b457-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761695029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695029, "uuid": "9ff1fa74-82db-4227-bf69-42e29f2f9a57", "comment": "Malware payload (Mirai)", "value": "c0f4c9cfe94cf66e7ed00349331fb487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695029, "uuid": "2276eb93-50fb-493e-9043-3d0625e6dc56", "comment": "Malware payload (Mirai)", "value": "d3625723854534f0ea6724d8102104e5d0e4f294639235047668b73f65376c7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695029, "uuid": "9fea712a-6789-48e7-a430-7ea6c0da6acb", "comment": "Malware payload (Mirai)", "value": "94f069b1fff7701aed8401fe60b6756d2a06a772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761695029, "uuid": "a01f5941-bd15-4e94-88f8-c56afde83aac", "comment": "Malware payload (Mirai)", "value": "663b875430f8dab135dd2de74713e6feecae1f52657318e1f4ef44ca763d23e55b0a456f5488f8cd56d35c534fbe16e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695029, "uuid": "b62b23aa-bff6-4d76-aa4e-0efdc619b9d3", "value": "T1BAE31945F8918F27C6D112B7FB5E428D772A17A8D2EE72039C256F24378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695029, "uuid": "7ea33d55-fe48-451f-ad66-b5a4d9b503bf", "value": "3072:guFVhZ5nrm19haA0V/6M431zOENuGWnZfWJP:gklKMA0VyM43ZOENxcZfWJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761695029, "uuid": "84fab936-d5b6-49c5-947f-019d89e79966", "value": 150564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761695029, "uuid": "6de44512-8164-44f5-b163-da8d4364d06d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761695029, "uuid": "79754919-0065-489c-8cfe-aae1e978dabc", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0a46f7-b3eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761648632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648632, "uuid": "4a79a513-9c79-4ee9-bbc1-27fde806c5bd", "comment": "Malware payload (Formbook)", "value": "4cd290cac6d9c4e1de99add6781965ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648632, "uuid": "229fe277-fd5e-4a8e-b0ee-c8507323370a", "comment": "Malware payload (Formbook)", "value": "d374091cdaf72ea9673f8e9d63eebaefc9315a3511f0194dda15252ebb517c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648632, "uuid": "0dc72c8b-464d-4208-ad73-0a10e19962e2", "comment": "Malware payload (Formbook)", "value": "f08934d3d87fa954a648da60425ac98965146e81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761648632, "uuid": "058020a6-2976-4f33-9c5e-d301bb92b74c", "comment": "Malware payload (Formbook)", "value": "6a8c7fd979c2fbc772f760eca933940988ada94cf6b6d4e6a9b97c62351409a4245b969e9dbe57c3b555dd32606d2ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648632, "uuid": "5cd95063-9829-4943-9ff6-4246f9614cd6", "value": "T10DF4126463A4E503DDA99B3049F0F27817BA7DC9EA30C3475AD9ADDFB9A4E609C40313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648632, "uuid": "3824c1f7-9bc6-425c-9fed-7f8de97f9b4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648632, "uuid": "974032f5-6f48-4dba-a5b8-c54ac5e53ac3", "value": "12288:Kq2mqA5s3GO67L5GU8oJ3/NfU/YLfp3qwTXQllCC/W2YQZikR:K3mB5s3Gj9FZVfUwLVaOC+N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761648632, "uuid": "17e2cc24-d735-46af-bd18-34ae06bd8f20", "value": 780808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761648632, "uuid": "64ad6e20-0cf2-43b7-9047-22775f4b46db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761648632, "uuid": "431c0fe4-c054-4ced-9e4a-e6232cce88d1", "value": "Doc Proposed Checklist.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bfbe9d-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656517, "uuid": "dde13d52-76d9-43e7-91fe-e31968b0697c", "comment": "Malware payload (Rhadamanthys)", "value": "687858830d8fc22dc102d717b6d42818", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656517, "uuid": "f2df00d7-eef2-4afd-b49d-6319fcd7a159", "comment": "Malware payload (Rhadamanthys)", "value": "d3a2fc82e823a2af8d1cfa0bed7a41b139837feececf70dc91556a9d1e7effae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656517, "uuid": "ed5a438e-3fa0-47ac-af31-45a65deb09cc", "comment": "Malware payload (Rhadamanthys)", "value": "a4a04fc7d4b4333600c2ee86ba49e311a5970ff2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656517, "uuid": "d9e279d1-9f12-40f8-9edb-d6d47d50beed", "comment": "Malware payload (Rhadamanthys)", "value": "8e6aecd1e3693e250371649f75338b36f7f9d791e85314e2d83b6096ec27006b5b3bd513c88a3572254923c69ecad9e9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656517, "uuid": "58de3a42-f7db-4ee5-80c8-2b76cf1e3912", "value": "T1E4A3F9650E26EC52B500B5DF2FE68909C41FF7260319D645950E7F27BFBAB2A21E048F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656517, "uuid": "d6b55d12-f4e8-41ae-a4a8-5fa411039fb4", "value": "1536:GDB7eKg20eMwSibTpO75Ox9/N6/OypjSaxu7xuqsXnWZ/WRtEerbTaXnkDv8gWrR:GDB7b0Uv7W0Il6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656517, "uuid": "fe191c7e-ed96-4fb0-85d1-fe7fdf1ad8ef", "value": 105478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656517, "uuid": "ba1f43ce-3911-4ace-9cb1-8ee9ba76e73b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656517, "uuid": "212fce0d-71da-4ee5-83fc-3432963c94c0", "value": "invoice-1637482117.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7ce263-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761646430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646430, "uuid": "a6641b5e-5c99-43bc-9c59-9853504a5d70", "comment": "Malware payload (SnakeKeylogger)", "value": "3730f147bfec3593c7ab12b364ca1128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646430, "uuid": "26c5b9fe-d4ff-4072-bf85-48f464076954", "comment": "Malware payload (SnakeKeylogger)", "value": "d3b0f33a7f9d5d56ff7c99ef2436b89116312f18dc0763bc353a95421848dfd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646430, "uuid": "87542b74-a237-4c32-9385-bfb6311132e4", "comment": "Malware payload (SnakeKeylogger)", "value": "6bfe6d92a89989b70ec2d9875d18a52fadd167ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646430, "uuid": "bd9d8eb3-d2c1-4a96-b868-ba5322a0a499", "comment": "Malware payload (SnakeKeylogger)", "value": "e4d43c26c73b6fa06bcc21cf7585a65412746f4d9ea1895a0c8d10040e04b3c6e620d78126e35ece386065e64889ee75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646430, "uuid": "9d73a1dd-8b6e-4e99-889a-9d4ddd6c0126", "value": "T12CF412587B0ECD02D4811FB00AA1E3B576309E9DE811E2134FFEBEEBB475A56786C190", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646430, "uuid": "732e7d48-fbb8-4777-8ee4-1b9d5c3320f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646430, "uuid": "1794c7ac-1ad6-42de-9a77-b8e283c2187e", "value": "12288:dOCF77zV2eqBQ0SCUfh5Y4Pb6nuucGu8H1C/VREo+Dc1s+mBzGOQ5RHL/RzzkOC:dHF7XV2vBIfh5Y4Pb2VcgwRERca6/9zI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646430, "uuid": "0c78d28e-d34b-4770-80c8-8c49ad4f8d28", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646430, "uuid": "6c86e657-f1ce-4f78-94f0-e3359ef7c437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646430, "uuid": "b4981e4c-fb73-4d99-920e-b2ec5500df83", "value": "TEKNOTES DWG-00141842-001 24102025 8325.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac26dea3-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761636497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636497, "uuid": "8f94a1d3-5087-4224-8795-97d869dfdf04", "comment": "Malware payload (Formbook)", "value": "75713490025e93046de3ebe28df40b91", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636497, "uuid": "8864d9f5-3853-40e7-b745-662d44cb6875", "comment": "Malware payload (Formbook)", "value": "d3f7db372b8abbc2d631b14be224e7d6a0ed95ee9d52f35c913d3119d53f59ae", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636497, "uuid": "853b88d8-b09d-4e32-9bd4-bfbd2be4b01a", "comment": "Malware payload (Formbook)", "value": "cf336be392cf7b2c04bc57dbd22084b7f0107760", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636497, "uuid": "d9cfd93c-9336-464f-81c4-60bbba0c5c06", "comment": "Malware payload (Formbook)", "value": "a869796a52eed738bc1ba4a5bbd6ea64438482277273c0b2534f931681a5d5b970216e965dc4147988b0fcf4f7cfafb6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636497, "uuid": "bf6ee5c5-3da3-4356-b57f-007354eb7ff9", "value": "T15345CF027391C062FFAB95334B5AF61157BC79260123A62F13A81DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636497, "uuid": "704c7c59-5d76-4e38-9478-604e369bc72b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636497, "uuid": "88360c51-5a14-4e85-a02b-52c606a4acd5", "value": "24576:55EmXFtKaL4/oFe5T9yyXYfP1ijXdakrjt94C9dpBtHMK:5PVt/LZeJbInQRak19BpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636497, "uuid": "928e1500-0b53-4360-9706-7ade074c1c09", "value": 1256448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636497, "uuid": "c65d5284-c961-43f5-bdc5-def0a3874a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636497, "uuid": "2dde6098-50a3-4728-8d5a-76645d28a8d1", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a126703-b40d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761662961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662961, "uuid": "bb2bd7fe-90db-48a1-9275-526ea8845117", "comment": "Malware payload (Mirai)", "value": "a7dbfb29a0d2d3af82073aedd1bbd861", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662961, "uuid": "9a903c7d-6c2d-493c-bb6e-a89ca71fe8b6", "comment": "Malware payload (Mirai)", "value": "d40a54c4092732e1f1ccaa621fe48c4c2630ee8416903378554f19f17764af17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662961, "uuid": "af98704a-ef77-45fb-b290-269a8332f96d", "comment": "Malware payload (Mirai)", "value": "a0d6725c19d759c43741bd681862fd26c376b654", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662961, "uuid": "0d39e6ee-efd9-481a-9647-3154e45f1f59", "comment": "Malware payload (Mirai)", "value": "dfca1b30444bb5f3fec3b31e20a44031c2b3868a8ebb3bf081a9b3e84d6397bbf2bb7dabf7d28b233899620bfdd449a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662961, "uuid": "58c59ad2-902f-4095-89e5-c8404e32b63b", "value": "T15EE329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662961, "uuid": "9a2d5f4d-fe5f-4d0a-a49d-6b41751c2fee", "value": "3072:RwmzTDH86Jk78lKBlpjABq2idSEQ9yWVvjbiBLMdKyAk89v:Rw2TDH86JafjABqHdG9y/LpyAz9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761662961, "uuid": "90952883-2b7e-4b10-acdb-97f7a07095b6", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761662961, "uuid": "1d801b65-f59a-4f90-b01e-f1da1c1eae6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662961, "uuid": "a228ec97-04b2-454b-9d17-5e2022cf11c7", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11607d32-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761635808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635808, "uuid": "db147136-33ae-43d5-83e7-2f7dbc0e82a4", "comment": "Malware payload (Rhadamanthys)", "value": "4d6e371ebd319f9b6baff63b1f1a70d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635808, "uuid": "2e484b2e-9a77-43bb-8024-734fd3e37b01", "comment": "Malware payload (Rhadamanthys)", "value": "d4fd2911d675e038e9a9c2e50ac09c8bfd45943dc47764895725f6af75fc3cda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635808, "uuid": "f0f3c1b3-6453-439f-9fa3-0d5c34fa981e", "comment": "Malware payload (Rhadamanthys)", "value": "e7fa2af1d632cfaf049bd92ccfa3448892bb049e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635808, "uuid": "379ab094-4504-4553-8880-8770ba110aa3", "comment": "Malware payload (Rhadamanthys)", "value": "e2fbfa2b2f0fcb0b96411354e6f8a4bd54cb0cb5b60c5f49ca7a61cf2ed5a54114d68334a6a456f7a9726800177f8010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635808, "uuid": "e80d188d-d344-47b9-8b0a-48c491749c57", "value": "T1F7D34A9BB3F530F8D177853985920A05F772B87657616BEF03A4426A1F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635808, "uuid": "c6d30caf-7249-4e32-b476-76a9df416cdb", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635808, "uuid": "a77b851d-27b9-4aea-97c7-d736be05ecbc", "value": "3072:1v+zxFifIup9RzJ3oZBysYCbpPCVTGbbZDGqWDA:PwQRzJFdCbpws6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635808, "uuid": "55e12d39-01d6-47c8-ac5a-f92173e0ef02", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635808, "uuid": "3ad656c5-2ea9-4519-9eeb-3551de9cdff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635808, "uuid": "a44e8ee2-73db-461e-8b46-03983eeb491b", "value": "SecuriteInfo.com.Trojan.Siggen31.64782.12199.11888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757ca523-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761620944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620944, "uuid": "38994e30-47ed-4671-a055-087672aa6d33", "comment": "Malware payload (Mirai)", "value": "8d7551a247dd34ba91708caa926149fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620944, "uuid": "f9851a34-d526-4cb0-80f2-007b7f8926d4", "comment": "Malware payload (Mirai)", "value": "d50aecb0f7eb8eb141a719817b886b1853c1804d3f5dec89f18431f3295f80d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620944, "uuid": "3ebcf4b1-c7ca-47ad-8823-3df11d0b4f25", "comment": "Malware payload (Mirai)", "value": "c3303a81bc9778830552da1d2d7ecd2eefea95b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620944, "uuid": "9ca07853-a606-4d6c-95f2-d461178c50a3", "comment": "Malware payload (Mirai)", "value": "1e3825a7aac5d7b9a9415ab9c4cbbb8151dabaccf87c243a86caf31357761918d0cff376c494f7e502962614118da95a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620944, "uuid": "0fa35d78-20b1-4c5a-8c12-3be2aaa05298", "value": "T159A338D7B401CDBDF84ADB7B4453590AB130E3620A831F36639BB967EC761981923F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620944, "uuid": "1d8aa3b7-32e2-4f76-8748-d959a3265744", "value": "1536:MhzQ1QMfF4B+IOpnhNWB/vrT4ncBDx6q8n36HrQzCJ3GONN6KXL2NQkru/pe+q3:M+4UIenhNA/H+cBDx6CR3GQNZwru/8N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620944, "uuid": "b8090375-94f9-41b6-98cd-750e00543d17", "value": 99848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620944, "uuid": "895a6cd1-ae5b-4c85-aa84-adfb6d68dedb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620944, "uuid": "519fd38d-a6de-4537-bdc9-63b901fe8bd5", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6912aed6-b3b5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761625218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625218, "uuid": "be7e653c-e1c7-45fc-950d-dca0c24f16dc", "comment": "Malware payload", "value": "8fd856c3103b0ecd5ac2b6f0741692da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625218, "uuid": "574fb40c-afb4-46e5-b56d-59e309f4b209", "comment": "Malware payload", "value": "d5fd1a6c0d459ade21c416fc648751d1b2dd6f10801feadfe9df8867ef3ba4e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625218, "uuid": "ddf30fa9-e186-4c29-a7a5-d5d39158f32a", "comment": "Malware payload", "value": "ce1e0ddc38868ca3fd925c0541857cca1f13fe73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761625218, "uuid": "4a07ce7a-4d83-441d-a322-7361110d5efa", "comment": "Malware payload", "value": "221cd1876bec8bc01555c62e4547a07ed02344aeff92e5cc65cb18a1c32b3685eda40a1936ce751bfdf3997cab89fd2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625218, "uuid": "5b515e15-8fb4-47b4-9848-1d6979dc7c9b", "value": "T1FD530279E0EAF0BFDC1921B53C0B19463243E56743AA747C75C2A5F8A3F08127B46DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625218, "uuid": "a0202ace-b372-4994-b3d3-832471cb58ad", "value": "1536:PXVII3HrmUJt/caWs7VgmVKt/ffmy4vaXjlQ/kEbVf:fVt3rmQt/caWsi7oSTllEbVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761625218, "uuid": "68204965-6c09-4ed3-8daf-36e81e0ed6f6", "value": 61148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761625218, "uuid": "bfd3c61a-1ec5-45b4-af41-6694b77db2bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761625218, "uuid": "1c628b3e-3c20-42f2-b6c4-d0d76be09caf", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74674fde-b426-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761673770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673770, "uuid": "f970deeb-325d-4fae-bbd1-41de78bd8f5a", "comment": "Malware payload", "value": "5b98be919fc9068cdf9fa30644eab9f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673770, "uuid": "3d1d108e-731c-4eff-a715-c5fac183ebaf", "comment": "Malware payload", "value": "d677a9fa8a4da3cf5ae0fa047bc5c0b06aad47807ee03d850ab45a1141110a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673770, "uuid": "f9fabea7-e8db-47a1-a899-93788b7f9c1a", "comment": "Malware payload", "value": "e16d48a83b5828af915ddad3d203a6134aee14ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673770, "uuid": "d298bc6c-000b-4d27-b434-20658b2a1986", "comment": "Malware payload", "value": "092eb73129c1f019a16c8742ff704e3a3bdfd2e8b7afc7d30caefab58d4ed82183df4d1e8ecd525e876beb8bf2c88b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673770, "uuid": "d499c8c3-4c9f-4b33-b3fc-a1c6693f967a", "value": "T126E55906ADE0CCA7C4599331CCB6926E7A31B8581B3623CB2B6272392FF77D45939705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673770, "uuid": "1f0407a6-17bd-4823-87f8-3399acfddbf2", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673770, "uuid": "c6d1f0e1-eb2e-4a6c-9bdd-915696568be6", "value": "49152:JqCGX0sdo9+mvWIByzhMQTkTaOk/gD+es:JsS+DWixes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761673770, "uuid": "a0d19b61-cb2c-4ae3-99cb-6e9ce1dc90a3", "value": 3229175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761673770, "uuid": "568bdcd7-764c-4b24-9a0d-0336e34e1837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673770, "uuid": "5d6bb377-b628-4685-8791-93995d2671e3", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b79f4a9-b40d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761662964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662964, "uuid": "de99d9aa-a933-403b-9d63-a909474e74ed", "comment": "Malware payload (Mirai)", "value": "42e519dabfa8380fe14e01977ed9ab70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662964, "uuid": "4b1a60d8-4308-4e90-8e1b-26a522643529", "comment": "Malware payload (Mirai)", "value": "d7d08e9af05914b7d079d909bf44367361b5f41bae96b86a41c98ce24686b735", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662964, "uuid": "193386cc-1275-486d-bb0a-e7ea33ac4682", "comment": "Malware payload (Mirai)", "value": "2b567943cfed0ced51915736b4839f783a8e6f35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761662964, "uuid": "f55ce6f4-730c-4e88-abd0-1978a4f11bd5", "comment": "Malware payload (Mirai)", "value": "20148dc8bea796a018d2d5338c80c9d30eb671a6fa2b5e24a3381dd01c891b3c9984de77fb16d832b6365703100fd9a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662964, "uuid": "b60d832f-f73f-4250-8648-955156b7e43c", "value": "T1A4E30B46F8814B12D5D111BAFE1E128E37131BB8E2DE73029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662964, "uuid": "0ba2af1a-0cab-404e-8cee-9b0aca6d9b5b", "value": "3072:DHea4CH1UjnwJIXMb6Azz1az/AWdYV8P4KL0:zePCH1Q6IXufzhakr8P4KL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761662964, "uuid": "9505f42c-b0e6-49df-a446-40b44a4e0e55", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761662964, "uuid": "0d99975f-4834-478b-87af-5524e9e9feae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761662964, "uuid": "d67b170b-2f4d-4eff-ad0b-9d3b2a23ebc2", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679f067f-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656569, "uuid": "6b410432-e057-4a89-a3bc-07ed36531316", "comment": "Malware payload (Rhadamanthys)", "value": "fc2e70d6a406e3a372e524712aaa41a9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656569, "uuid": "c43f3520-23b1-4ca6-8edc-0fce8f789a4d", "comment": "Malware payload (Rhadamanthys)", "value": "d7d717e7106499d1f982cf1a94ad18d0b1c31ff6902778ab1a6687c5aeb2c413", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656569, "uuid": "d3ff6c97-dae8-469d-86ea-1a4a77ed27ef", "comment": "Malware payload (Rhadamanthys)", "value": "e0026d5ea4d67dbc34f65db625eeb69dde0f6398", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656569, "uuid": "7d22cf1c-dd38-4c70-914e-e32283195848", "comment": "Malware payload (Rhadamanthys)", "value": "b5e777be91461c8a82fe6c7e035807983a7519bd0b1df37cbf76d5f6a0dd89c9be1fab5b9edd838ded2ffd555754409a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656569, "uuid": "43188195-c3b9-4bce-b975-c711feb2a963", "value": "T142A30BE07B191AE5A1EC67B5D8F22DFA9BB48379164B6AD0100E7FB4416ED70D0347C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656569, "uuid": "01351b1e-c1a2-4799-aeca-332e7915fa16", "value": "768:GDhd0i7J4sYKgY/CMNfWdcb+bQSb6zbzzb0bCbqb5bnbNzbrbebobrblbXb9b+z1:GDB7eKg20PrjrD3w8aAF8K6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656569, "uuid": "01f63155-ed42-45c7-8ac9-b9035696ecad", "value": 105966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656569, "uuid": "03fd3509-755f-4da3-af1e-5cf87da1e84e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656569, "uuid": "edf66d45-06d1-4aab-9255-ba6ce0aedc2c", "value": "invoice-1637482117.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f8ed48-b44f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761691432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761691432, "uuid": "3706bfec-c41f-4932-b69e-495e8347c5fe", "comment": "Malware payload", "value": "4237e752a7862229ecbbd180356c71f8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761691432, "uuid": "10282c78-fe6a-4829-816a-39959fbe9abe", "comment": "Malware payload", "value": "d8059b173e3b7c61948bfbc4e6db66514b6f6130ef76748364bc008bfe42b3ad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761691432, "uuid": "75cfb59c-f610-4b02-873b-b5bfcca5dc07", "comment": "Malware payload", "value": "a9b517a91f9fce2c29e584284a452d700d1186fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761691432, "uuid": "970a91dc-3211-488c-9a6d-eb9daf539d2b", "comment": "Malware payload", "value": "86fdefed65130640b8e41cd78df02bfbaddc73dfbf3141761dfead32441a496b3483009474ec74513047a326097e988d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761691432, "uuid": "b2feefa2-f892-40bb-a153-52e98a47cd61", "value": "T17B0100AE44239F30B4D8D7C5B87248555409DE9160910F91EACF9EB3E489B98B07A78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761691432, "uuid": "2bf8ed71-a546-4177-8f49-aafe733a333f", "value": "12:784HFCdEcp4H1dEcp4HqdEcp4HQdEcp4HXjdEcp4HYdEcp4H7bxdEcp4H7kxdEQ:oSFLCSICSzCSBCSmCSJCSvcCS4cQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761691432, "uuid": "ee6f8c60-ba5c-470a-bb7a-0c89fcf67da4", "value": 808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761691432, "uuid": "724ba883-3d57-4227-b5a0-b93d25b30b99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761691432, "uuid": "5dc32176-1425-453d-92eb-a781dcba686a", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b517376-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761653944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653944, "uuid": "8731d411-88a1-4dc4-880d-c22d83ac8cfb", "comment": "Malware payload", "value": "b1c530ebd2511e94603997c23f48364d", "object_relation": "md5", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653944, "uuid": "b1faf4bb-a79f-447e-ba1a-7e520af3187b", "comment": "Malware payload", "value": "d821f4b92e7f9ea38d6bda07c04fdca1a8767e822c68caf1496f83c1476191a6", "object_relation": "sha256", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653944, "uuid": "17768dee-60ac-4e84-884b-d1c037604c97", "comment": "Malware payload", "value": "9a46e041805de7df9171801822b06fe21483f521", "object_relation": "sha1", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653944, "uuid": "05901cc8-6cef-450d-8e26-b4bc91a64e94", "comment": "Malware payload", "value": "3e81e918fbfb2dacd5102fa1c34b30b1e99aef907e09fc06c89408a7de490325b0e9d0a3bd279da4d82fe763d7dc964a", "object_relation": "sha3-384", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653944, "uuid": "788aa2cd-cf70-40e4-9e69-d085399f3839", "value": "T164E0C018EC81CCC8093B32655D97D50CD31240530102EF547B4CDA032FF25020EC75CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653944, "uuid": "924049d8-28bf-4799-887f-09df92e27c05", "value": "6:q43taYOXHmgEqrhaj+XLFbWP736g5DFiwMch0MWXfGb:Twt9Eqr8j+bFeL9MwMCL8Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761653944, "uuid": "27adc8b7-e257-4f2b-828d-b85e50f72245", "value": 358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761653944, "uuid": "9d7664ed-7bd0-4ce8-bf29-06e941e55d3a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653944, "uuid": "1f2db097-7a0f-4fc7-ba4b-cf6c4177bb22", "value": "d821f4b92e7f9ea38d6bda07c04fdca1a8767e822c68caf1496f83c1476191a6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a7eba4-b41a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761668621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668621, "uuid": "72186239-701a-413a-b2ce-d72cebdee0d8", "comment": "Malware payload", "value": "e1c851ddf1bb93f7412180c15314ad29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668621, "uuid": "08db66bb-31e2-4e43-881f-da7a16bf0eb1", "comment": "Malware payload", "value": "d9ba8a50c0af7831b72fe6b1af4d37092752a2cca5861d7b721a8526171cb52b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668621, "uuid": "5ef86409-b8b0-41bd-9022-2c920b4f64a5", "comment": "Malware payload", "value": "67f99dcf3f3bab52eb2767c1a4ac1989b9a57fa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668621, "uuid": "d10e8c1e-bc69-48d8-b424-ff16059ff1c6", "comment": "Malware payload", "value": "731e54d4c87825bd968591693d032473eb0d004b824e6890082664d36b71d6f6206e508e62d04008897cd6647da60fd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668621, "uuid": "48f9ec7d-973c-4e2a-98bc-3cd6e9964d47", "value": "T107735BC2DB43E5FCED6525700077AB5A8E7AD43A413CEA85D7B46931EC22B01DA1B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668621, "uuid": "1d72e70c-c133-4e35-bfaa-b26860905c86", "value": "1536:4VCGA1LLL/z+yd8+yonyFjwSAlVM7TC1rjsC3:4kGA1L//juj3AlOXCtV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761668621, "uuid": "93ddef1f-3d88-4805-a9b1-4b4c01119343", "value": 79116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761668621, "uuid": "5a548490-1d30-4d14-ab11-87839e6b50d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668621, "uuid": "5e100416-c343-4579-854f-94a0e503ac1c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0340de1-b42e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761677333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677333, "uuid": "ee614c9b-dbdf-4b96-9965-41159e15ca31", "comment": "Malware payload", "value": "015278bd1ce679b260d8bd434c1fd074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.Generic", "colour": "#209922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677333, "uuid": "55761c1b-4ae2-4bf5-a864-e88436a1c601", "comment": "Malware payload", "value": "dac4368ba1fcf6c5aa1028d5a4d07d32a562ca24e372b6a5b8f8becf605aacec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.Generic", "colour": "#209922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677333, "uuid": "84b99465-6c91-4b0e-b417-7425a6f8afc0", "comment": "Malware payload", "value": "d648d694fa235adcf0f9908d108736c803c172e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.Generic", "colour": "#209922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677333, "uuid": "1f2cdaa9-476d-48b5-b836-f505631b2758", "comment": "Malware payload", "value": "7d2e4b4ac91d3a3e3c544c4a2e2879efb0a515b9fd172ee8c310aeeacc25da412f05d6fb42a79d1dde8080c437620be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan.agent", "colour": "#8F89E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.Generic", "colour": "#209922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677333, "uuid": "4596874b-5967-413d-a62d-6aa76fc8b5e9", "value": "T1A4F63385FBE409ADE95B9138C1B1962AC5E1743243A8C5AF1FF98C2269537F4EFB4700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677333, "uuid": "d3fe9942-f90f-4f77-aa00-5ef6926d5b2f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677333, "uuid": "ee953a39-ccc8-4cbd-bb9d-6e7c51deb3a3", "value": "393216:P8tdmh6ROBQCP1PC6XZqoVVB+bxb6LInEroU14S2DDqc6qcsfxG22D:PqmhlyaxsojB+b56UErk6NsJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761677333, "uuid": "e7237e96-092c-4f0b-b885-14ce9ca7ffbc", "value": 16546369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761677333, "uuid": "c311b62f-96fa-4fe6-bf63-0c58668d4b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677333, "uuid": "adf3689d-bd43-4e49-a67f-1e208927a2e3", "value": "Akinator_Stranger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361ac060-b3b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761626850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626850, "uuid": "ab59886c-b016-4f67-87f9-cd70d4827f77", "comment": "Malware payload (Mirai)", "value": "5932d8adcbb4c6f6cf7a9097b7f7eabe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626850, "uuid": "baaa2ed7-c0bf-44f0-9c21-025efd2a7865", "comment": "Malware payload (Mirai)", "value": "dae6bf3bd0f3c3d79660d75ca611430d1f8b2c0857be97b5ed27372db2a2bfd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626850, "uuid": "eb6a7210-407a-4470-96a8-467bc3600a09", "comment": "Malware payload (Mirai)", "value": "20a6fc7eeedbe1173426136f0cbee5104fbb1753", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761626850, "uuid": "a7e13708-254d-41ce-a7e7-c87ac6785661", "comment": "Malware payload (Mirai)", "value": "b74f03ccd2d6068bf5556626da63cc9c50a83d19520cd6e885c87dc8520321d4f0d690ceb240bc00207eb09db8300fd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626850, "uuid": "ab555e29-7d6e-4117-829f-bfc0d6180bc1", "value": "T1FE530239B3122D23CF90D972EC3CC51824647978EEBF2178E9D9D5A45112E13E27E6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626850, "uuid": "5b948e01-9808-481f-8f83-cd40b374823c", "value": "1536:3Wzrgs95is0YbNuZvaIbBDFT39smAGZpnf4EpTulQhIzC:8pjisrqvzNsm5pptIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761626850, "uuid": "649581de-11db-47d8-88ce-2a6165becd1b", "value": 64892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761626850, "uuid": "8ee90cb8-1ffa-4bbc-9e00-fee81e9ff7f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761626850, "uuid": "14be88ee-eb61-4c31-b856-308df5996765", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5bcb36-b3fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761655991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655991, "uuid": "927f6cdb-a635-4f65-b41f-ed8bc75203dc", "comment": "Malware payload (a310Logger)", "value": "57800ce3d4772cd852ac3bf86b3eb7f5", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655991, "uuid": "8270ad31-f03c-46ba-9bd5-54ce7ad0bfb8", "comment": "Malware payload (a310Logger)", "value": "dbb7425f1b37b75f8e8dac238ae84cd6c7d3dda28f370fed9c1a17da51d2f38e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655991, "uuid": "84ad378d-ca39-4186-8592-35d5c3af82c8", "comment": "Malware payload (a310Logger)", "value": "c4bfd310b5d9ce3800a15c80a4184eafe6c7f193", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761655991, "uuid": "c55fa1fb-51f9-4071-b9a3-e27cfc338768", "comment": "Malware payload (a310Logger)", "value": "1bc3dc2659b84d9197d81db81cfc05ad9e6c04a99d4d4b009edf909dc85ec90eb68be61f312a265da24cd9b4d82e3e0d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655991, "uuid": "f62ef9b8-021d-44a0-8f7d-8c59d1429109", "value": "T101E4111037A6CA06D9B613B569B2E27417BE7E9DE820D20A4EC93EDF7971F014C14B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655991, "uuid": "f52ec114-08d7-4201-a957-241e443ad2ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655991, "uuid": "18f24c4c-26f4-47dc-8ca8-a7157448aa0f", "value": "12288:Z3mq+faFLlZnyA2i0NwP08K9JskvbmwcH5sVE4XRmffei8DnHRXKUSTL9GKGwW:1mlynZnSAnWJskSZH5sq4mfsodGKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761655991, "uuid": "91dd0f7f-fe4b-478d-baa3-219d74ce9bb7", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761655991, "uuid": "08c77f5e-f70d-4cd8-8d61-d34dfb812708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761655991, "uuid": "411240f7-643a-42fe-a805-67c6e6faf007", "value": "Sip. 07356201 Fiyat ve Teslimat Bilgisi Talebi - urun Listesi.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4377354c-b400-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761657367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657367, "uuid": "7831bc37-9c08-4f9b-971d-e627f98ce543", "comment": "Malware payload (NetSupport)", "value": "a46ed235b685b28b61ff3f78b325f9df", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657367, "uuid": "08f5410e-efa2-4a53-a276-be8c746d2a9c", "comment": "Malware payload (NetSupport)", "value": "dc7f153da04b2c8d727c7f57c962ba45ea0dd3a6f15ffb86795c232c1915defc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657367, "uuid": "cc051e0b-ff23-44f2-bebc-acbfc6995800", "comment": "Malware payload (NetSupport)", "value": "9f4ea4ea2f1d5a78d001784139e17211b3589f6d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657367, "uuid": "cc75bc05-c4e1-458e-be0a-43f64af96c9f", "comment": "Malware payload (NetSupport)", "value": "ff082209877e8486cbd1b588d5baccf1b0c1b7031711de6a105a0187b69f930ef09175963de64c30f9801157de228665", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657367, "uuid": "40e57f64-acd7-4b81-ae90-991628790a3c", "value": "T12E06F022BA8FC526D61E0272E42DFE8E643DBE73476140D3B7E478995C318C257B9A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657367, "uuid": "cc8c580f-0884-4dc8-b5dc-b7256c4d593e", "value": "98304:fDz3IGvjINMogPsz/HEzhUFOu0v4O8HixLXIq:7z33jzNEz82FLn2LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761657367, "uuid": "e3071c47-f7f7-43c8-ac7c-0011eb4651ef", "value": 3966976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761657367, "uuid": "0fb4bc6f-4fc6-41a8-88ca-8f46cceab634", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657367, "uuid": "ed02e0a0-9745-4de5-86c9-1193d461024c", "value": "dc7f153da04b2c8d727c7f57c962ba45ea0dd3a6f15ffb86795c232c1915defc.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc62ed3c-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656711, "uuid": "bcf778e8-00ec-48bc-ae1a-5d3accb3681b", "comment": "Malware payload (Rhadamanthys)", "value": "73906fcb47c34ed30b3ef0b8f7eb1db4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656711, "uuid": "578330bd-1a43-41ee-8ac3-e42199bd307a", "comment": "Malware payload (Rhadamanthys)", "value": "dcdea683a87d65934a6e5b400537a66d6664cb4c68dac66bc59dda2ead67b84e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656711, "uuid": "80c58640-fdac-4af9-a92a-5346933ebf5d", "comment": "Malware payload (Rhadamanthys)", "value": "2d96248607ae8f88d1812e9dbfd6d8c7f92086f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656711, "uuid": "85f850e0-d5d6-4be8-a548-379edc31728a", "comment": "Malware payload (Rhadamanthys)", "value": "2d2114e0eca3558ca266dde0a9b7cb3547b18d0bb811084b6fe006266bc07e832844102902856a5009456e088b5e8f85", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656711, "uuid": "5481438d-dd1e-4c05-a71c-b376278f9b38", "value": "T191A3F9A178947EEBB496FBAD2FC524B2C19FC14AF485E21D601FB315C4AC90E9284DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656711, "uuid": "49b5435a-fdc5-46d2-a688-2a7b1749ff03", "value": "1536:GDB7eKg20IXsrvr+4TM0hNqseArtYSgX6BkQWJ+aY:GDB7b0ZjPBjgX6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656711, "uuid": "be69b203-6dce-43fa-a405-100faa435039", "value": 102030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656711, "uuid": "3b7a667e-3719-4248-b428-665189107eeb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656711, "uuid": "4b4daf56-12cf-4715-bbeb-2e8d226f70d7", "value": "invoice-1637482117.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70df5b9d-b401-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761657873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657873, "uuid": "0d862ad2-b297-45fc-a312-ebca8bf9c4ab", "comment": "Malware payload", "value": "2067b249bba0fbbc296edd8b2cafd3b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657873, "uuid": "b78e5771-fca4-471f-97b8-ad9a351601dc", "comment": "Malware payload", "value": "ddb4ea7ed9f22981bc309e5f878b43d5f3bf9b299e1d09506a55d8fe8621d832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657873, "uuid": "c3377132-1d14-4d78-a709-41327b5cebfb", "comment": "Malware payload", "value": "ff7e144317870b638f06fdfb710584ffd6cadec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657873, "uuid": "3e35b24a-8f0a-4a14-b0a5-fc2848ad036d", "comment": "Malware payload", "value": "7b38acb4d5d0356afff4ae5b20dc6c9b97e2b9abc7eec4716fab5e9d4d24f436223cccc2fd5270684dd22c9e626cb6c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657873, "uuid": "8e41ab05-d1ce-42dd-a6f5-2668ed398f73", "value": "T1952833FA1501A8A8C672FE7EB490C7F06B315F710484A9936EE9DF8736E910FC91D285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657873, "uuid": "c272531f-be53-486e-83fd-b3c2d765d602", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657873, "uuid": "7d7f09ac-aead-4fbf-9d72-a61b8aab45c7", "value": "1572864:iRoAi+TbzZcPZA1DPqn8PCeG3I9bg+bXQMEf5PLuqjL8NFzrowcjIYtsRx9htvhs:iVi+TbVcB+PqUCeGKDExSi4zjuSRxLtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761657873, "uuid": "97efdf6e-76f9-49d6-b771-b1a17f2a0a1d", "value": 94777326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761657873, "uuid": "40fb27fa-5de4-4cc7-8ee3-f12caf7404f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657873, "uuid": "4e493052-b049-4132-b27f-14d537c306a5", "value": "VRCPlugin Setup 1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193ad317-b3fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761656007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656007, "uuid": "3a273133-96a1-4128-91e7-e1d11a913482", "comment": "Malware payload (SnakeKeylogger)", "value": "7ad51f2b5e229101fb1393cd9ba489b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656007, "uuid": "5701fb98-9d93-4807-be32-44318828f0d2", "comment": "Malware payload (SnakeKeylogger)", "value": "e04812a41b547180ad6a5d317c837285ffbcc947bcd2828bb0f7889a5605dd56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656007, "uuid": "a42c614b-4dce-42d6-8863-d1e52262c940", "comment": "Malware payload (SnakeKeylogger)", "value": "315de51161fd770d42b75b741b5662ae301b0a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656007, "uuid": "5d120d9a-029e-4296-b9a3-c2812e155c44", "comment": "Malware payload (SnakeKeylogger)", "value": "7f6a9472b6820952d9539063f5b3c12f04513ffe16d957476b55602892adde4c47fc00c32eb325e0a162dc1018b8da43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656007, "uuid": "9697207d-bfcb-4e57-8f7a-8720591bd6f7", "value": "T172F412962364E007D9A61B3119F1F2795BBA7DDAF530C31B9AE86DDBB8F4A442C40343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656007, "uuid": "9e7850f3-9b5c-4d2e-bb35-fbb5b0ec7cd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656007, "uuid": "0841ab42-7302-4627-8eb4-4be377840c25", "value": "12288:q21mqPUPItcTWrm6l0uNiEZQsdS8wxWNHSYPcFi8jsVky776K4LMkR:qemOUPICY1uuIEZQLtqBPciws77Z4L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656007, "uuid": "897a4980-3bea-44fa-a5e4-6f4a23c9f637", "value": 761352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656007, "uuid": "144e870c-f857-4074-a95a-978fbf0dbccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656007, "uuid": "c3c7567d-4ff9-49ac-b93f-d0bb4f5395dc", "value": "Purchase order 0010025025_0.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916af25f-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660075, "uuid": "5e95369d-ffcb-4eef-bd27-a459ba079575", "comment": "Malware payload", "value": "43c5fd7dfca50c4e2e702cf96722897d", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660075, "uuid": "fe9b3f51-2ab8-4c2b-870b-a7d404905448", "comment": "Malware payload", "value": "e0da148f59f32fb97fe4f4160d57c0e9305e12950d282202acf2da8c3f662f7f", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660075, "uuid": "b211c40e-e035-47ff-9bee-d933838e2cc3", "comment": "Malware payload", "value": "49a2710135bc8f5b55d8ac40c997546813f3e973", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660075, "uuid": "41416d44-e14e-4ea3-aabb-62335d9e56b6", "comment": "Malware payload", "value": "b59d444637d752faa0101d9019ef78aedd7021b99e1d5a7006c62452516fc125386f0b83210826d1d7a94ce97290b056", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660075, "uuid": "540ed5b4-9854-4b77-8d04-f7d79eb02ad1", "value": "T132B2AF97866BACE168D11739980707332AEC3D1744C264AE35BF7D006F6489AFF061E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660075, "uuid": "9fd2b5ba-b2ca-40ed-822e-e31c86438a46", "value": "768:uhVl/Zl/JJi/jl/QgF0gFVhZR7TrhLgFs/e:uhDnfAbVhQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660075, "uuid": "08c21d88-1163-47d0-8569-b30f67ed78e1", "value": 25461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660075, "uuid": "505b45aa-bfca-4aa5-a690-d6e15e9445eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660075, "uuid": "c9e019da-9b36-4f82-a8a1-26ec83596388", "value": "custom.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d0ae13-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656617, "uuid": "93cb233b-da93-4847-990f-037febade9cb", "comment": "Malware payload (Rhadamanthys)", "value": "b21ac62020f58dc4062deeeca838256c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656617, "uuid": "20e9ad15-70c9-4ea0-ac7d-393ab1ae8627", "comment": "Malware payload (Rhadamanthys)", "value": "e147f9dbba8f04b0c436acdf19603ab09dea46fc8096fe9af3269b7b1ad43784", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656617, "uuid": "aac8488e-b57f-4e52-a6a5-38c0a918aafd", "comment": "Malware payload (Rhadamanthys)", "value": "a88461fe0987b0d023b0dbdebd73076e2b9c8497", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656617, "uuid": "ac2ff813-abc1-4cfc-a35a-d12d7530b521", "comment": "Malware payload (Rhadamanthys)", "value": "850440f1651d0a32fec90f0806f37655d6fe0d1c04338a81f6d669cd1b646ca3343d5ff8fc0ba356424cd622ab791679", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656617, "uuid": "3a3b42f2-34ca-4b8f-9eca-416aad61dbcf", "value": "T1B8A30BC563714BFD0829A421EFC58EF0BE99850C4AEFC0A49558B3E07644F1678BA76F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656617, "uuid": "e9cc56d6-2b80-4c29-8461-566edf1b5817", "value": "768:GDhd0i7J4sYKgY/CMNfWdNoarXGlrn4VYHt+MVhAEuxQSLAuAAroQW+FF+Ec+0FY:GDB7eKg20Jrkrn4V8RAE0Q6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656617, "uuid": "b0bd2e9d-6f5a-462f-9f0c-d897cc5f304a", "value": 101454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656617, "uuid": "88a8d7ae-0915-4bdc-8951-b1b94b76421b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656617, "uuid": "d468abe3-bfb3-46c6-b884-eb479eeb730b", "value": "invoice-1637482117.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578d3c50-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761639791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639791, "uuid": "ee33af17-7af7-4800-991b-24f037c7c94f", "comment": "Malware payload", "value": "8648d292f8d55ca79540986f51202e4c", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639791, "uuid": "5a9aea32-af62-4ad6-800f-e99777437e0f", "comment": "Malware payload", "value": "e1f53e458a691c7ec7bd803cc0249914b8541a3be65eacaf8e81f54ea6906fb5", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639791, "uuid": "92ed35f1-9c32-4227-b52c-d32b40e010f6", "comment": "Malware payload", "value": "165963ab415c3e3895c1faae2f6135a923dc4d8e", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639791, "uuid": "b7508ca2-c48f-4a33-9ba6-4ebed5988769", "comment": "Malware payload", "value": "fa1f18cd6109c316c077e097824a793a099a11be8141031bbdf494a1d0eacb1b4e0a91fe37bb8d37f06e5fd1baa60145", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639791, "uuid": "1670694c-a60c-45ac-85c8-17d691d8920e", "value": "T13424D605B645CA2BC7841B354DDBCBFA6775FC50AE46821773817B2F2E7AAA0CB06344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639791, "uuid": "46fa169a-536f-4081-9358-5527b0ad853d", "value": "3072:wXNDzD+khXhIDTM63ceSOmJgDm/0cfx9HCW65xljpenwUyLorvXMi:kZhKTM6lS0+UW655enwUyLorvXMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639791, "uuid": "91e4c102-3e60-49e2-b2ff-89eb50c1a9d4", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639791, "uuid": "73cbca3b-f631-480f-a6db-3d9f0e5eaca6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639791, "uuid": "466f7ab1-cc2e-4b9f-b4d1-23afa8462424", "value": "Ufunctions.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d884f04f-b392-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761610372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610372, "uuid": "6753d978-a656-4435-818c-0e916f6bbf38", "comment": "Malware payload (Mirai)", "value": "4a6785091723050d4e03deeae369257d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610372, "uuid": "1e0b25b4-e703-41f3-9e6a-6289b20fb735", "comment": "Malware payload (Mirai)", "value": "e33182d50dd32a56471ada1d8dd0632fecc0b3635d5a024a61ae7b187cd51244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610372, "uuid": "c83fb11e-7b7e-4bae-b2c5-05e7c4ab2c33", "comment": "Malware payload (Mirai)", "value": "e5b63ef4888379a484c702495ae11ab801345ce6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610372, "uuid": "3e7facd1-07f0-4bc6-8f5c-d2538ca51e55", "comment": "Malware payload (Mirai)", "value": "583572f9478fb5293110485a40fec1f429fc3ec0abe4c5b45d32dde9625110a0f5ec846727243ddb00474b0f3d6b97e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610372, "uuid": "9ea59b36-b289-4257-a6af-0ac2e58cec0a", "value": "T1BD146C2BB3C3ACDAD15063305C306366772FDB051918EAFFDA073794A997B2256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610372, "uuid": "d0591f53-5f25-4b39-aec9-b51325e9d929", "value": "6144:U5dOm515CTrumegYrg93LEQNQB7IKTtd:fTrOzrsIBB7Ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761610372, "uuid": "421b48a9-531b-4ee4-a6f0-884080263926", "value": 197592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761610372, "uuid": "c98ffcdf-3118-4a22-877f-6131548fb6cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610372, "uuid": "bc20328a-e952-42a7-8f8a-cf2bf4de7b99", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db7d1dd-b42f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761677517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677517, "uuid": "b1dea93e-91d6-4772-bfe1-7fa26cdc0cb4", "comment": "Malware payload (Mirai)", "value": "fc3927655f308f4693d3d1f02bf36149", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677517, "uuid": "2370b9d2-4698-4945-9ee6-e240f807e84a", "comment": "Malware payload (Mirai)", "value": "e5055137d53d0ce5ef43bef9f9b090e582b6400b898de1d30cf05c44dc33386e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677517, "uuid": "de52d7a8-27f6-47a6-8c7e-9da4153f546c", "comment": "Malware payload (Mirai)", "value": "a8448433993558d1ce93b1ce26794dc8e63aefdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761677517, "uuid": "e06ea283-6fc9-4f6f-b461-ea3d14aef20a", "comment": "Malware payload (Mirai)", "value": "e380d78d7ebab82612ad440f9360ae4c1b621dda33c226f84733eed141c5914d5a531e77a3bcf5b06d539916415dba0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677517, "uuid": "dda80ab9-d214-4328-9ac1-2ed25cc08cc5", "value": "T1F9D3BFDB724F5466C82506F01BD38B8D2A6322118F0BD9E72E0DBA3E29791CB555E7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677517, "uuid": "36a72ce2-ce2d-497c-89cb-590c1e97ff6e", "value": "3072:BJwYgz4q6VJuSRiP6O98XCQEqNRkVgs96tlGgqPnuRq:MYgz45VJ4PKhRkRyxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761677517, "uuid": "544c338a-cd8c-4574-b913-df0a1a2bc727", "value": 132476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761677517, "uuid": "2a03d8be-25bf-4f6f-9080-2dd71c1c36c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761677517, "uuid": "9dd2e705-2887-453e-b623-c5f0f1159b62", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9047638-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761639955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639955, "uuid": "16a678c1-aeb6-4e2c-8e78-7e5809940345", "comment": "Malware payload (XWorm)", "value": "d42638af3a33d6c5f8d5ddf17aa1bcb0", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639955, "uuid": "144c0909-de12-476f-8d43-629979a0f152", "comment": "Malware payload (XWorm)", "value": "e5605feb7159b82e472478341ccd9a0580d83d73eb73c3ad756397c1733d011a", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639955, "uuid": "65ab5fcb-ddfd-4882-b32a-c4059265860d", "comment": "Malware payload (XWorm)", "value": "e05f676bbb7f2625e2f3c54a7838071d4de3174e", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639955, "uuid": "0223223a-0a46-45df-88ee-2d9edef260ac", "comment": "Malware payload (XWorm)", "value": "efea3b8e694f2643b0f01e387b93d5a5cea10b9f3bb013a83d57bb4140926c6987a894919a2e220847672daa8cecc215", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639955, "uuid": "5aa8ad33-1828-4d5f-970d-999229594a56", "value": "T1BF25489D9061ADC2A010FEB0F541EF97CCDB5789162347121FE1A4A96213C83FFAB7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639955, "uuid": "7f77174f-4533-4446-8e43-5996a4847558", "value": "6144:OCGI7c2Zl5yFI0qzuBlux7DTTpt4uyRY9zX67:sv2ZlsFIZaqxBURqzXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639955, "uuid": "9633b05f-b9c3-44b8-afaa-29dc18a88b13", "value": 1015984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639955, "uuid": "4b741717-a11a-4a09-8ed2-5ca2bd7f4589", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639955, "uuid": "cccb0c96-239a-4b6a-89d7-6e80ec7a754c", "value": "PO- Purchase Order_376863489793.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25752058-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761635842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635842, "uuid": "f838987b-9d29-405d-9faf-b2a4301c24ba", "comment": "Malware payload", "value": "db379928974afbaa16805c4386c9ddc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635842, "uuid": "32d56c8c-1561-4f48-aec3-7ecd92443498", "comment": "Malware payload", "value": "e68d8271f7b77f71aab8325110ff07f86652aedd855b8c405dc8fb2d274f2903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635842, "uuid": "f269759a-b8e3-455b-a738-0b9b4d3de67a", "comment": "Malware payload", "value": "5dc879ab42a085a4182ed8053c96dd56ae8dbde5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635842, "uuid": "f872f46c-9e3d-4681-b6e1-e53b0f9a5b92", "comment": "Malware payload", "value": "6bdc11a683e5803528233815e4752aeea382e1957e22eb3e3e24451dae01364a8ce71adb76e340dc549effe11ff85d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635842, "uuid": "13780cb5-682e-433b-9dee-10f804d99fe6", "value": "T1D1E57D17BCA109AAC0AAA33189A252937B75BC450F3263D73E50B77C2FB37D09979750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635842, "uuid": "d330efa0-1f8d-4e85-96f0-9697af9c9037", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635842, "uuid": "a5bfd51f-4c5c-4b7c-aec4-3d9b0775fcc5", "value": "49152:PCAElgSXgy9+ES9I/6g4P9D0/56DdoDFoc6sscqst1Lf:P+sE4g4PtM56AFd6ssNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635842, "uuid": "a7d09f24-5f69-4327-9712-8b8d318bf569", "value": 3218432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635842, "uuid": "79684e71-21f5-4e65-944c-7e3b93addf23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635842, "uuid": "292fb29c-3e0f-4c07-aca6-8401df9ea849", "value": "db379928974afbaa16805c4386c9ddc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05314d29-b453-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761692911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761692911, "uuid": "9968f522-6754-4d8c-8745-a2ce1361dd70", "comment": "Malware payload", "value": "975207d0edf19b2932b74626da05996f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761692911, "uuid": "9ae47c07-df2b-436a-9f3e-06fdcf248939", "comment": "Malware payload", "value": "e6a55fffa2b5e87a3aa6ec6286f7f070f2bb58abdc10d47ad7a1517cd6268b2f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761692911, "uuid": "bd7b5b50-8cab-4f00-aab1-404f31a3c796", "comment": "Malware payload", "value": "275d0b31d25fc5a7d5e8604c3626b14254965d50", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761692911, "uuid": "7af5123d-e328-4433-9475-f3ad180ad50c", "comment": "Malware payload", "value": "d61504b3cc580073fa270ef5c5ae88775eb5ffe36e85e54840fdd5f7f4693975817c4e620ba469509f5c54fce74fcb72", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761692911, "uuid": "a24f7a3c-d47e-441e-8f5e-3520e0331de5", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761692911, "uuid": "87d120b3-7744-418c-9ddf-ffd67e0fa6cd", "value": "3:4cVopKuHmEfHNsNKn:4NHzfHNsYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761692911, "uuid": "b8b5f116-2409-4b01-bd2d-4dafa5e7fcd2", "value": 156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761692911, "uuid": "9a5619f9-2a97-4e5f-8d7d-089e353dcaa3", "value": "application/json", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761692911, "uuid": "9127bddb-ede4-4e4a-84c3-0db6d2d58303", "value": "testfile.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb65f15-b438-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761681491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761681491, "uuid": "38982126-8410-4819-bc73-490d2ad3de8f", "comment": "Malware payload", "value": "5e0345f1e4781806ee67697eb9e9efdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761681491, "uuid": "60df5a47-d927-4658-817e-83f1a5f56099", "comment": "Malware payload", "value": "e7a35e8c2b9ac8308bb4f6579ffd626c1a702c5569ecb586e0455a8b16f92953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761681491, "uuid": "2b8d6a8d-4f37-455c-b8ec-4de26ef8c810", "comment": "Malware payload", "value": "a3ce62e56a9cf7af1180854cc69a0affac236db7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761681491, "uuid": "d8cdb095-eb62-42eb-9594-35e5ad57b56c", "comment": "Malware payload", "value": "f43ef596dd3fcf83d2effbcb031894cc0384a8fb46525206650a1f43397e05680c0917d37a7a392cad7ec5e83a2d5a4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761681491, "uuid": "a8d58def-542a-4cf1-984a-4303d0cb9f8b", "value": "T1C1961817ECAA55D8C1AEE6358532A222FEB07C841B3173C73A60F6156F75BD09EB9700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761681491, "uuid": "968d2b38-3f7e-4dc9-acdd-3ca377a051f9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761681491, "uuid": "f745e5fe-4645-4b62-b1d2-d2ec13388c50", "value": "49152:Pny75NTvJPrJb+4goeA12J59EZchu+Ct3Q8v42lzep2GlPehdhWiJfU6+Vd7mj14:PyLZoXzu+cQ8QiUmhKixHs5Ab6DLE+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761681491, "uuid": "2401376d-94e0-4c17-a946-13d86d42a729", "value": 9232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761681491, "uuid": "fb450d61-2249-4d4e-975f-143152a4d22e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761681491, "uuid": "189cb766-4752-4d11-bec0-82e1a0bc6e33", "value": "utilpkg5671.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24914a5-b406-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761660103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660103, "uuid": "09ae896b-02cf-4e9b-89a1-61e2010f6c87", "comment": "Malware payload", "value": "0a108eaa7a0f5014a0033e6ca3199127", "object_relation": "md5", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660103, "uuid": "4d56eef8-849c-4e20-9ff3-6ac69ef96d74", "comment": "Malware payload", "value": "e7d2c3bd7fdfc7e3d56f85e8fa526e527838164e3c6591184668bad1280b8f1e", "object_relation": "sha256", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660103, "uuid": "1381c2d6-0456-460c-ac5d-cc9e123f5b9d", "comment": "Malware payload", "value": "0cb66be68d67ef3ca4c52fded9564dfaeb60915c", "object_relation": "sha1", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660103, "uuid": "37d68ef5-ebd6-4348-bafb-3fe2a8668a0f", "comment": "Malware payload", "value": "08a9d5500a5ea4ef1905ccdda9f71b474cff5d207809727570623cbfb00e53e88e0c9844bd0226d922e492a0fc834101", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--k53xupn43", "colour": "#B57459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660103, "uuid": "b6d4cd0c-a990-4ec8-b3a7-6da745c66307", "value": "T12331585B9C98614C5494D506F4E8048FEF5E146EB86A065738FA814F2AF037D43AD18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660103, "uuid": "eb389e53-e20a-4ebc-bb3e-1993e319f6a6", "value": "48:gk8jxGoiBm+J4BhfGGYzuBSkfipNSNXKiOo2TER0F:4xGNuhuv6AncygRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660103, "uuid": "a248164a-9e0e-464c-8cd6-5f313a555bea", "value": 1659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660103, "uuid": "a4f89716-4cf1-4474-b8fa-309cb5faa30c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660103, "uuid": "737fb764-6c3a-424a-b4e9-b351477895f3", "value": "exten.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccb2545-b425-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761673247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673247, "uuid": "8bd4850e-174a-4a6b-b57c-3237bb33ff84", "comment": "Malware payload (Mirai)", "value": "db71f0d7b1b08b6c0cb2cb9a9f28e085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673247, "uuid": "f07191b2-833c-45c1-9990-005b28823d41", "comment": "Malware payload (Mirai)", "value": "e85834a8e87d2620066d2fd6f58263ff4d69339827cca9feb2d78749a40d8d84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673247, "uuid": "e69dad7b-7db8-41f4-9dbd-30576b1e73ae", "comment": "Malware payload (Mirai)", "value": "84e82b606124d8b4083395663145076e2a741839", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673247, "uuid": "5608fdbb-a610-472e-ba99-f618dc36a501", "comment": "Malware payload (Mirai)", "value": "1ce0de917ddea08f2b05524c8b7eff35b82c316bb0109839d4608592373f60dd8def19fadb1154c0185e5168b43a30f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673247, "uuid": "2b3b358f-8740-44a6-b6bc-1ed9bf248d0e", "value": "T16D04B588FD54977AC7E272FBFB1C02CD763E0798F3EA721689310A6137C9A65593A011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673247, "uuid": "05a1561d-b1ed-4e2e-9fec-b3e74f44fac5", "value": "3072:RNMmMT7eU99Dvx+qkoL7v1HX3C4Nk5ALMvsakDMwqNd:/8U0nC4N8ALMjfwqNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761673247, "uuid": "db131154-3c3a-4e91-abb6-2092eadcefc8", "value": 186020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761673247, "uuid": "0c12d7ac-5150-43eb-bc7b-c9dcb0f96029", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673247, "uuid": "ce0be580-f9e8-4d5e-98aa-1e7b85594b61", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350b5c73-b442-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761685689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685689, "uuid": "50621c9f-9924-4873-ae99-f2e32a7566c8", "comment": "Malware payload", "value": "16dc28dc7b09da6e2ee9cd69b9799871", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685689, "uuid": "7f1ffb27-bed1-46b2-9d5b-6f649c6b137d", "comment": "Malware payload", "value": "e90d0979de8a540632c743c1f25c207814c2700fb0631efcf50679f28903df5b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685689, "uuid": "23246595-404d-4602-b9c9-fe47b968015a", "comment": "Malware payload", "value": "7cd9a3b46352f102d11e93fa2efda1c1cdce1761", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761685689, "uuid": "95925511-e111-46c5-9acd-3618e08d738e", "comment": "Malware payload", "value": "755565d1f007b5975262e8143a513641fdfdc699dfbefab26f2d79a836696e95434d03d381e0581adfd3ec8e075a44a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685689, "uuid": "71959fd0-7f3b-4a1e-af3d-37ec557373c7", "value": "T1AC01965B09309328B585D70CF8900B696E1CE3D1E3911B9DEACB4D6DC19AF287135B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685689, "uuid": "ad8ff4a1-0e00-438f-98e8-f24f85f086d3", "value": "24:oSt9ESI9ESf9ES59ES69ESR9ESv89ES489O:dtTITfT5T6TRTkTjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761685689, "uuid": "d0bdb42d-7f43-4c36-927d-68616a7dc69f", "value": 784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761685689, "uuid": "9b34e51d-fdec-4431-8e04-fee19face3d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761685689, "uuid": "90122d34-dadf-4aa9-be81-0a9ca8bd2184", "value": "dvr.jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22f77f7-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656667, "uuid": "057db795-cd95-41a3-a39b-499a20bf4949", "comment": "Malware payload (Rhadamanthys)", "value": "ea173ec4ad410d3866d077803cc44ba8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656667, "uuid": "8e064cc9-8337-4685-85d9-3f1d82617c20", "comment": "Malware payload (Rhadamanthys)", "value": "e960663cd7a825c89edf3adf85e1c3b11f69e0d3935eafcd002b8f18f64933e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656667, "uuid": "31782a4f-f16e-4251-b4e3-f2f5b9cf83c7", "comment": "Malware payload (Rhadamanthys)", "value": "2aa45e2f0db254de05634409e87b05d2c20240d5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656667, "uuid": "249db1f4-250d-4087-b66b-eecadb755d05", "comment": "Malware payload (Rhadamanthys)", "value": "a026af7ba3d5f4e93a9e8e51559a48ea178b2aa3213216a88969a30395c7c9955c5d93b60799ce0c18782f5b44b9c030", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656667, "uuid": "3d820cbf-6474-4dfa-aca8-62b708aecf90", "value": "T105A3D7051D67BE7835AB848017B248F4E952AF8F8DB4604054097AE243DCF2E6DA76EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656667, "uuid": "5f378f34-5521-4b19-99bf-e229068213a9", "value": "768:GDhd0i7J4sYKgY/CMNfWdGvD7TEOK3KbvMhG5jmsDjNnS9/1+cPPSfASmVyx2UhO:GDB7eKg20kr3r8yK7tAryY6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656667, "uuid": "5c643d15-bbab-47a2-99ef-5cacd2cc68cc", "value": 106707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656667, "uuid": "8b82f3bc-a237-4c94-ba45-f81092b772ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656667, "uuid": "1678cd7d-0ef4-4e01-a0b5-02d919063be9", "value": "invoice-1637482117.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a9ab69-b431-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761678629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678629, "uuid": "0879aca4-5ca4-4187-910e-226256525039", "comment": "Malware payload (Rhadamanthys)", "value": "61e2d0e2101564db1fbc0c5a00a2f661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678629, "uuid": "83dd2061-bf6a-41ea-a66e-49a7cc0ec9ee", "comment": "Malware payload (Rhadamanthys)", "value": "e9e6f3ebb97641d15bca12732442c8fab4f6bb3be8b7bb9a9969d247747e2ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678629, "uuid": "b21918cb-2362-4dac-9799-b620397a15f7", "comment": "Malware payload (Rhadamanthys)", "value": "baae18e5b3580d04a8200d8ccd999a0b6c8fbbfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761678629, "uuid": "c1f7e7ff-e97e-4791-a9d6-ef05fc8c9378", "comment": "Malware payload (Rhadamanthys)", "value": "9667cabbe07a710e9f4f01109eb7bc80800512dc9d5dedf556bc72f0877a9a022c9c6f1f4c9c0fa10ca31afb8b287691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678629, "uuid": "3e42f899-a3fd-42ba-83c3-2e6fb3a4e19d", "value": "T10F15F15AA7A818F9ECAB813CCD450506E6B37C560B60D7CF03E5075A2F236E16E3D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678629, "uuid": "561b5108-a35c-4d49-9793-9d9666707f5c", "value": "003d18331b0acb80b5ef29a4c546ef95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678629, "uuid": "bfc3398a-0d3f-4dcd-9222-2a15cd2bc668", "value": "24576:395JyTaSsVR5tH0kqE5cUJIWBuRslgKg+By:395gOSsH550kmUJI9CgKg4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761678629, "uuid": "30f37df9-084f-41c9-a69a-213d2cd76b4b", "value": 919141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761678629, "uuid": "eeb21787-d3eb-46dc-8958-b7d9625febdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761678629, "uuid": "c206e7c9-b1d0-4635-b4a5-a95f398bbd1b", "value": "Launch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4de1ab6-b411-11f0-91c6-42010a9c0006", "comment": "Malware payload (ResolverRAT)", "timestamp": 1761664966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664966, "uuid": "3fd978ef-4b84-464f-84f7-f2eacca2d6d5", "comment": "Malware payload (ResolverRAT)", "value": "87998815437249ba5ceaea1cb8afc8ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664966, "uuid": "00d1a900-a54f-4319-90b5-43fcf2b1337b", "comment": "Malware payload (ResolverRAT)", "value": "eadd1970194b0a419b47e5bacd5036637244664e5dbcb1fb39555f16d7845d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664966, "uuid": "02e0411c-6a36-4302-9538-7a31e49bdb07", "comment": "Malware payload (ResolverRAT)", "value": "d93fec07db3b3c2e799514abc6a21cda1fa80d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761664966, "uuid": "82962e1f-028b-4598-b1fa-479f6d349b83", "comment": "Malware payload (ResolverRAT)", "value": "2e5266c2d2fb0609b08814e3c079033bbaf4d61594451f1b11286da5faf9d5e02f8eb52f22c220d1fe99b6d67843e53e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664966, "uuid": "9d3c1eaa-30a4-4830-a6da-07603e0c7618", "value": "T14FF4E618EED80F93E539837689E38564B2B38C84FB87E71B969470A108717D45B4B1EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664966, "uuid": "da727df3-f524-47a1-8038-4cf9d96db647", "value": "12288:ZKqXHJSrEmycXlQcPhCxxE8hLlEtenOFl1Ael1TRhKv1:FXHJRcXlQcPWDhLutmEECrIv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761664966, "uuid": "f682179a-7cd6-4d05-a313-6e008a6035a8", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761664966, "uuid": "a14c8bbf-b298-409c-bba5-34bafdcfb846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761664966, "uuid": "8caa1550-7b46-4be0-b688-44b8bf4850ff", "value": "RFQ - T038 PROCUMENT ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31312f4-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761636079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636079, "uuid": "a8154704-33d3-4f10-93be-441a32a824a1", "comment": "Malware payload", "value": "d6c7ca786c5989ff6e25fed8559acb21", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636079, "uuid": "36237f8b-076b-428d-ae91-2b369e9c4227", "comment": "Malware payload", "value": "eb02177dac80b61ec5d56d507c725c5a3e232c9a110956da7f9eb8b12bb35bfe", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636079, "uuid": "8a073df3-4fa3-4e5a-b6a1-d8f3b92b62b6", "comment": "Malware payload", "value": "5daf1803e8f4b235fdf5063e2552ff209f2e6ad0", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636079, "uuid": "2481c3d6-9b63-40d7-a7dd-a633649a78f0", "comment": "Malware payload", "value": "154e95c26589448ed4af7fe36d1011db07535136b215fb5dc010e639a9772808cb893963696fff5038babd1534e3d928", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636079, "uuid": "95f3bf78-fec2-4285-89a7-40c5b8aca552", "value": "T1481523627575D353D7029A7108D2D65E532EFC436B868A5B33CABB0C393AAB4D9C3038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636079, "uuid": "97f736bd-d7f7-43f6-aa8a-3503c513a210", "value": "12288:r2whp/b78SqfDrQ4/8dfM+7uqDGNu/QJLGRxN8Lyav3AOe+2yqZc0zf0OngP2pVA:ywz/bVqfDr+P7uqeIla2yT0Hgup0CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636079, "uuid": "7b26eaa0-8d37-4534-9d43-a8758e90647a", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636079, "uuid": "664841d0-3321-4cec-ad14-58bdbcb6f819", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636079, "uuid": "601fca98-f81f-4521-bd00-c505b1e8082d", "value": "PO2144R SITCVN.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba904318-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761639957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639957, "uuid": "859a9762-0ad6-4f3f-9171-5b535639da8d", "comment": "Malware payload (Formbook)", "value": "bd95ca686b05d785e18787c30c73b484", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639957, "uuid": "aa41b313-1790-443e-b764-409d61291dee", "comment": "Malware payload (Formbook)", "value": "eb4c64f160030cfee24f7fe0a49479bb538e746b2c73e9574f8fc80e36d3cae0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639957, "uuid": "e71d4bff-c5a9-4ff3-883a-000edef08144", "comment": "Malware payload (Formbook)", "value": "5f5a15d04fd5099a95748a22b0ae668cfce3da76", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639957, "uuid": "b6668067-6ce2-458f-a52b-277ed79f83ec", "comment": "Malware payload (Formbook)", "value": "3156845acd4bc0bb6d241568f7a692f56190de6c511303cf84be7c161373f1f10482d7dd058ab453488362f8532d8645", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639957, "uuid": "acc3fab0-2187-4c18-95b8-8ecf95dae77b", "value": "T13F53B7A425F456FBA29F2FF8C0EDA1C275603F0A1657A71F51B1AAB0D12B1C54D33A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639957, "uuid": "b733f2a2-a19f-49b2-afd9-d4007379e2b3", "value": "96:qikOfwux6SHxCQSjAodLU6R7VuY0IU1LxmQocVSjCD8RocgSSjAuSG6NnJVuYoUQ:xez8OithCe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639957, "uuid": "2f8aada8-ea26-4ac5-a4c3-d9b28428e1ee", "value": 62343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639957, "uuid": "e633fd7c-6d66-42d5-8017-edec2935b33c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639957, "uuid": "48763132-6308-49b2-a402-dc0fe7eddd8b", "value": "Request For Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e2606a-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656696, "uuid": "9a66e9da-e235-4918-828d-de2382ff5472", "comment": "Malware payload (Rhadamanthys)", "value": "99636bced8133becd7c0e27339a77780", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656696, "uuid": "f194f8f5-f4d3-40f5-8f46-b14b0eefb98e", "comment": "Malware payload (Rhadamanthys)", "value": "eb97ea28008ab7c36747d6966f971a6ae368b2ac8dc9785640cb453a9782bf30", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656696, "uuid": "9d6a3a45-1855-4d66-8030-90de9ca19ba3", "comment": "Malware payload (Rhadamanthys)", "value": "923e75ffe456bd8aaaa0ff9c379044ae3465b26e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656696, "uuid": "4f56fb70-cab4-4bf4-99fa-5c80936fd90c", "comment": "Malware payload (Rhadamanthys)", "value": "7b5ffa5a918e19c8c11b8e8e8a75871be202ba721eba19627af564ce126fdb455435ce4aea6d8a9d1e7b4c2f7f7a16cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656696, "uuid": "bffff61b-73f0-4d66-8160-da2bf07f2f61", "value": "T1E8A3E9417E2EF9D1C29F3B7EAE9911F48D8F207A930408C6791AB5610EE47ED31749CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656696, "uuid": "18d52a22-de25-4943-a920-6330d676ef75", "value": "3072:GDB7b0jqPlNidZPgPif3/qPYBLxJbzZh9vW51ASsPBG3dd88O9uuztui71/g8n+e:08qPlNidZPgPif3/qPYBLxJbzZh9vW5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656696, "uuid": "35991c8d-bb55-43c4-a6f5-614e8ed29d2b", "value": 103390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656696, "uuid": "f4ee65c3-7f65-45ee-a254-e37fa228346a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656696, "uuid": "4b159310-a3f8-4d9b-937e-41f87dbccce6", "value": "invoice-1637482117.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed73f1f-b426-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761673734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673734, "uuid": "aa7464a9-f5ef-4be1-913c-4ec795442af0", "comment": "Malware payload (Rhadamanthys)", "value": "6c7953259636866a3f6eeb47c60d1c7c", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673734, "uuid": "a554c0ad-0b52-4d8f-9850-134f306f4254", "comment": "Malware payload (Rhadamanthys)", "value": "eba1a522cd1ef530fec08f30c5c94e52aca2d815baf0827e1050c0a99a56240d", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673734, "uuid": "e2ce3364-e583-47ea-b7e7-04210dde953f", "comment": "Malware payload (Rhadamanthys)", "value": "70f41d89ae284f50f209a52acce5d7befd3776d0", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761673734, "uuid": "b43fd4f7-7f07-4e0e-980a-4a5417440aa6", "comment": "Malware payload (Rhadamanthys)", "value": "dd4facad5f265f9a6b8cd67345de342e6c05ea6472a008a143322ff90be39b05ac34162e7baa4e9d3cf54fb4b4192520", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673734, "uuid": "25d1d793-d513-4a89-b4b8-26d6c6414e4a", "value": "T130F35C5B73A520F8E177C13989920A42E77278354B619BDF07B0477A1F276E09D3EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673734, "uuid": "9ecb556c-640a-454e-98b1-918e822f2ea3", "value": "23aa6ede111f6ac860a5e9008f9b9673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673734, "uuid": "d355bdf5-b5ca-4d19-93df-94e918276a21", "value": "3072:5Zo6yMcAMn7tm4myJwSkN5QdrLD5NtEr/lYRSCakbhj+8DmKe01jN:5Zo6yMpM7tmpixkOdrnnMOkCPDzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761673734, "uuid": "516d20a9-21dd-4658-90b1-37ae066c35f8", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761673734, "uuid": "6fc7f85c-fd7c-49de-b9e2-046e14e2bc33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761673734, "uuid": "8514e8b4-6536-47ad-9dbb-3e0e289ff5b3", "value": "killa loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7bd7fa-b3a3-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761617415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617415, "uuid": "eec46c3a-9cf5-4fb3-95b6-330ace2da173", "comment": "Malware payload (ValleyRAT)", "value": "dd9d2444e4923e80025ef3224611d6d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617415, "uuid": "3e1a0a99-9a1b-43f2-886c-68d58344f473", "comment": "Malware payload (ValleyRAT)", "value": "ebc01c36d9377d699159823708e03c9fd17b36f507d752fc193b3233ffd16ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617415, "uuid": "9118970e-c598-4053-a00b-03374b2ddb8c", "comment": "Malware payload (ValleyRAT)", "value": "6e1253d3b0368c8e02a778b0406b8b252a727567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761617415, "uuid": "1a341766-8359-4880-836c-0b97b09a1fa9", "comment": "Malware payload (ValleyRAT)", "value": "10b53cbac348fef69002da9d7e82e9ed6c667a87acc096d96b14fd3d54980fccd5c111c2c60e3cece86a1b8e0ad1ad8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617415, "uuid": "e92591fb-3a16-46f5-9711-c1ee44feb6fd", "value": "T14424A125D830D2C1DF61ACB362C79521CD25EF14E935BA6113B3A98B4EADEA00C4DD6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617415, "uuid": "17b76ab9-4a03-408e-a6cb-ab097b59045a", "value": "71bc27ecfe22083f6c0d032311b8d4f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617415, "uuid": "26a02906-7227-4f06-adef-cd95d9fe03e8", "value": "6144:uDiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiib:uDiiiiiiiiiiiiiiiiiiiiiiiiiiiiib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761617415, "uuid": "f997182c-97b7-462b-b81f-b3dc5cef8e1d", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761617415, "uuid": "3d38183f-5c50-47fe-9d4a-a6dd67f4bf71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761617415, "uuid": "04eedbb2-e821-48f6-8ed6-67ff6be73b01", "value": "DD9D2444E4923E80025EF3224611D6D7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459f653d-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761653934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653934, "uuid": "edda8502-6a04-4580-9165-a7222b2e5937", "comment": "Malware payload", "value": "83d085b73f9d06e34923513b52b5a50b", "object_relation": "md5", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653934, "uuid": "c7a7da99-05dd-45b7-96bd-a630d921129f", "comment": "Malware payload", "value": "ebf7e9202efce67e26e83f29f57645526ac92b898858a02859f1812772028110", "object_relation": "sha256", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653934, "uuid": "54c4bf73-78ff-43b1-a70f-53aff71317ff", "comment": "Malware payload", "value": "3995ecd3aeac7e732451bceafe61a6616c3f760f", "object_relation": "sha1", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653934, "uuid": "98a6cce3-44bb-460c-8a02-76ffd39dd15b", "comment": "Malware payload", "value": "8e831bcc3077f2dd6aa5dc4363a8af4309e0539b0168d5b58b607eb7134d72da5e974a5fb43567c426d3c611a19d3999", "object_relation": "sha3-384", "Tag": [ { "name": "206-245-132-15", "colour": "#3B8ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653934, "uuid": "7573eb39-07c8-43cb-8774-485cfb18c77c", "value": "T146E02694ACB9DDD848797265AEA7AA0CD25650672002DF143A4CD6236F724024ECBADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653934, "uuid": "644453b4-d250-44c1-a10c-70a16662e72e", "value": "6:q43taYOXHmgEqrhaKBjFxHBNgqwR6kItDFiwMch0MWXfGb:Twt9Eqr8GdWRetMwMCL8Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761653934, "uuid": "e24043e0-5f6a-473f-baa5-3cd3ccf158f0", "value": 340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761653934, "uuid": "ddf361a2-0441-4a4e-84a1-643e53be87f7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653934, "uuid": "38c9a517-c91d-445a-ad73-953780fdc642", "value": "ebf7e9202efce67e26e83f29f57645526ac92b898858a02859f1812772028110.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5744984-b435-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761680321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680321, "uuid": "1deaeb96-1e4a-4652-b7fb-8dbb8e83823e", "comment": "Malware payload (SalatStealer)", "value": "541584f9867551a3f0c3dae9c49df858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680321, "uuid": "5fa5d595-70c3-437d-ad80-0f05d97b44ae", "comment": "Malware payload (SalatStealer)", "value": "ec9fb1a8e740369681422c6181b918b6207292b2ffb734d1fa63e7d8f75c4f6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680321, "uuid": "720eee19-6a4b-41ba-bcbb-332b274e2a7e", "comment": "Malware payload (SalatStealer)", "value": "cb2df98aa766721205ec68382e316ad44ac9b980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680321, "uuid": "4514e5e9-5d20-494e-b6f9-ed7434fadf62", "comment": "Malware payload (SalatStealer)", "value": "6d432f66e7bab8930d0b738603784d61b7e96a6b672e926d9ce1b4b7d84ecf1f9d914c4004abea259be2635faf729102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680321, "uuid": "e7a36c73-499f-4993-ad6d-2b5d3d4d5b2d", "value": "T1E3F533BD938A76989B41E5BBF1F351A340924F3A29478CFE8B042F50DD770AC697C660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680321, "uuid": "9d271ce5-d12a-4da1-b035-a8642ea3cc72", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680321, "uuid": "22adfcff-0dd3-4f85-bbd2-b88a796ec38a", "value": "49152:htVap4rLmb7107LTMrhlCAVnbjUh+aQkxHbL+d3aQoO5uP7hFEhseS/:hLap4rPLMVRVbjUh+NkxW55uP7zENe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761680321, "uuid": "8ff461a1-22cd-4d30-a2dd-c4f8dcc6bebe", "value": 3559424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761680321, "uuid": "b2e12ce6-e706-416d-9f9d-1cafbd931205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680321, "uuid": "4f3c45aa-b207-4540-9b95-037fd2033484", "value": "StandoffChet.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cfbd26-b393-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761610849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610849, "uuid": "cca0450a-7188-4238-9815-369c96da6ade", "comment": "Malware payload (Mirai)", "value": "9ef32ca26faa6801e1cce12aefbadc46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610849, "uuid": "e93d4b1b-1d46-42cb-aa9b-0073ba32a484", "comment": "Malware payload (Mirai)", "value": "eceffc77bf0e54b3944294e6cdb8b5e19d6fa0630dd03b6431701583b203627f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610849, "uuid": "5bedc8ba-485d-48a1-813c-c89cca26db0f", "comment": "Malware payload (Mirai)", "value": "ac034050f61a77f2f32feb610b754740c6dbcf41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610849, "uuid": "ac44e42f-5854-4e4d-bce5-0653a84b0cad", "comment": "Malware payload (Mirai)", "value": "02d008830c92b4ac7ab6f75ad05225cb3c753df56a35f27459032e5600f61f893ac447c46fbe5a3ca5ac6e930fab0a95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610849, "uuid": "72e38e4e-0820-42f2-9823-8ce15cd0bcb5", "value": "T15CC3E094F7776992C1A341FEA4804AC3D3902A718BA327081299F738387DCFA0F65ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610849, "uuid": "4083e37d-cb9b-4e79-a881-6c7d4fde1f83", "value": "3072:LBeb4DcbnKQTdc8zV2dB1SPC3UfciZaCMMTnV9KjG:2NT28OB1O/PZfxTnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761610849, "uuid": "4c1da4b4-7d20-45f3-818d-46119be4a899", "value": 123868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761610849, "uuid": "46cc1456-f701-417b-a7a6-2b328c327c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610849, "uuid": "7e5ee407-a59c-43a6-8207-5adae3429737", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b798f560-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761639952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639952, "uuid": "8e9ad9b8-3b61-4749-bddb-6098182d82fa", "comment": "Malware payload (XWorm)", "value": "0a24f06e9eed6a53e696704d1260235d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639952, "uuid": "b9f4a14d-f7ed-4391-98dc-3d944b20c9b6", "comment": "Malware payload (XWorm)", "value": "ed1cd5532f3b5b0ab5a329424dfac19f5e72d22f4368d1911563e6d5186a8893", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639952, "uuid": "b1fa3484-8c75-4b4b-9f67-08ea4cc1afd0", "comment": "Malware payload (XWorm)", "value": "0bea582c339f3bf073c62324881abbf8d45cb745", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639952, "uuid": "575f9e32-fb12-485b-bcdd-4f7a543fca72", "comment": "Malware payload (XWorm)", "value": "56e1ade9ec6eb38d4eba0c70bf34c47778ad1a593bf528428adda9ea173d76c8b31b98c96f14d20e32b27013279c272c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639952, "uuid": "915a4bbe-641f-455c-8ad4-c7d10ed858fe", "value": "T198D4E0F98482F8A11F6E1300609C3FB71DF95ACF49A07228648C2CD9B5957F6BE2D5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639952, "uuid": "3f5b2460-4e46-408b-bdfb-22f2c1bd32f4", "value": "12288:bfvcWTrV1AJfqc+PCj+pKiRTtJ1gUNqcwovvRxCTmBRzDY:L93MBx+KjKd31g0dnROmBRHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639952, "uuid": "32292767-e143-49f1-ac7c-ec417e6c2d78", "value": 627739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639952, "uuid": "3abd6238-0e52-495e-b3ab-0730dd330357", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639952, "uuid": "e0284f7c-2243-401c-a642-b3f68bc2a5ae", "value": "DELIVERY SCHEDULE - NOV 2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa27d32-b3ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761620800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620800, "uuid": "cf3aaa8f-fe6c-4eef-b804-3c2cc59887a5", "comment": "Malware payload (CoinMiner)", "value": "36b0db82049d947b7a6cdc8ecf3ed5ff", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Miner", "colour": "#525907", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620800, "uuid": "54d63d0b-0dd9-4895-9bcc-cd6ec3925d96", "comment": "Malware payload (CoinMiner)", "value": "ed8fa7b7b1fbd7fa1100d52617db6c07c9a23b39f834b497f28b2633766d8a4c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Miner", "colour": "#525907", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620800, "uuid": "f15dfc25-7a0d-4425-b1ac-3413a42e7b31", "comment": "Malware payload (CoinMiner)", "value": "1e94999cf70dbb58066d3a23b20fffb6650209f9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Miner", "colour": "#525907", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761620800, "uuid": "43a2cd57-3c64-4ed6-ac34-3441746eba1d", "comment": "Malware payload (CoinMiner)", "value": "8691b7f4a434030952c778b92e39ce9f21c0098c8f4a35c1570de023ef4d044b18f53438dcc12e5f3d06df63a6b9339b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Miner", "colour": "#525907", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620800, "uuid": "5273facb-f366-48c9-b869-e801263b176e", "value": "T1EF86D0A351E1AA59C22DDAF9C102F87FEA4BF8B3CB57BBE75150659EA317C807404B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620800, "uuid": "afa4470f-4a08-419a-842e-c201d7c18292", "value": "d400a6a867a8623e410a8599e61fe849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620800, "uuid": "50a01db6-df0e-479a-8ace-7b9e2a206bb5", "value": "98304:NYRcviJQMl5Sqh+2BsmQmXqj/Uo2jgGJ8Z0fhgWknI0/lS+quxIT89C:N1FKn+2vW7UowJ8Z0fhgW8ICxxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761620800, "uuid": "f315e7c0-ecbf-4285-92af-a387cd7c084f", "value": 7976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761620800, "uuid": "026f7bd1-9db7-4135-b014-a022b3e3d594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761620800, "uuid": "ba4c4c4c-a0f8-417f-b5d4-14a3e09eed09", "value": "1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492fc92a-b3f9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761654370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654370, "uuid": "d2ab4d79-e31e-4a0e-af37-a68baf500e67", "comment": "Malware payload", "value": "6975075449ce6ae5c28c63e7c6879412", "object_relation": "md5", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654370, "uuid": "6344be79-f519-4bc2-b0ff-dcfcd5856b11", "comment": "Malware payload", "value": "eda9aeda00d82b5d6a4b04669670389b9a0fc628633e74dd3aaddb18d9f19b4c", "object_relation": "sha256", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654370, "uuid": "76b04c96-61ec-4083-a725-adf62c913c86", "comment": "Malware payload", "value": "7f0b11995c292f3ed98a9947129bd7116fa74435", "object_relation": "sha1", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761654370, "uuid": "e986ff33-156a-4152-8f04-882317dea0cb", "comment": "Malware payload", "value": "e9112615b715d0a132e4ae02a003dbe4752aa34913ad82abec345baa3763eab8ca4567d644664155dfbd4c6b09c4aa57", "object_relation": "sha3-384", "Tag": [ { "name": "185-198-234-30", "colour": "#B28910", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654370, "uuid": "a8a088d3-a4a0-47f1-9441-9ede8c24cc7f", "value": "T15B573B05E742E9B6CC8312F03553E3AB56307E3085358DD7F6889F78AAB3AD6561A703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654370, "uuid": "c41d4810-1eb6-42ae-8ad4-6d9b3281679e", "value": "d2328921ed63dfbb3ffd0676b7759e9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654370, "uuid": "64d7b3c3-e8eb-49f4-a9e4-249440d80b6d", "value": "786432:i3CKj6nd442qG4p3ZCwRRzqfyMfsQ4C7Ga/:iih2/4bCwRRzSH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761654370, "uuid": "3dbb7b9d-6649-489a-8239-982005d1c8a9", "value": 27586679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761654370, "uuid": "076a4733-ee12-4d26-858c-647210379de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761654370, "uuid": "b8e9e5e1-6b05-4fbe-b7f9-d5adddaacbbe", "value": "eda9aeda00d82b5d6a4b04669670389b9a0fc628633e74dd3aaddb18d9f19b4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5788919-b393-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761610850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610850, "uuid": "3d206f92-76d1-4e01-b117-dccaccd31daf", "comment": "Malware payload", "value": "848c4d1fd24cdaa1530f2f142b71f470", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610850, "uuid": "91e759fd-bab7-4739-a276-9bee69e3b290", "comment": "Malware payload", "value": "edb7b5c9d15bf3826dc3d0a6c0eb0479331ce05142151d282c96f7dbb5e84f38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610850, "uuid": "37bcc0cf-384e-4ca4-a080-90cc68001b8b", "comment": "Malware payload", "value": "87fd6825462d82b3e45b4cb6e1899a6b14f52ab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761610850, "uuid": "4130d68b-a05d-40c0-ae23-243cf4f30864", "comment": "Malware payload", "value": "c6a942fcea273fcbe095505fc9ed5bd482cb7efd29d2a63aa0747cafccb0bfa066c0adc98e58822894f75fe4dbb0be39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610850, "uuid": "cc0999bf-5ec0-499d-8630-8e8d5b28c1ff", "value": "T16D630221F2F9884CE1BCDFB86C70C598D4B3B82350F54611ABBC25E3F89949629299F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610850, "uuid": "996a071f-33e2-498c-a93b-354ea3cd150e", "value": "1536:As7LDMjC7Zmo0ZQscdbZw/0hFLRtAWhdNgN/voE3em6i5qrPk:Fx7Zji/MDtLhngNR3emF5qrPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761610850, "uuid": "da4b1fd9-91b2-4e9c-8734-5b29ef38e046", "value": 68848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761610850, "uuid": "497b10aa-9a66-4092-bb03-91ee17459607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761610850, "uuid": "62a740a1-7077-4b9c-a89a-c036c0547da3", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ac9d2c-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761635812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635812, "uuid": "3a499826-c804-4356-a4e9-efdae4c233de", "comment": "Malware payload (Rhadamanthys)", "value": "d8efb2b2a6d56582a9b00e36d5b6c346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635812, "uuid": "8d18f2ab-339b-47f2-9250-d08eaf01b976", "comment": "Malware payload (Rhadamanthys)", "value": "eddb0b8d70f1477cf64314e587e1240c69b506a2d66a0f05aec2ea0febfcc460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635812, "uuid": "2a8213af-0e2d-4dd1-9f89-1f226c4c198a", "comment": "Malware payload (Rhadamanthys)", "value": "a3278d21458939bf636943a77178fa67c79758b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635812, "uuid": "e2985322-e25c-4b8e-971a-2735645003af", "comment": "Malware payload (Rhadamanthys)", "value": "8acabc6be517b6d75f9c7e958a7a7a50cea0594949f101fc27daffceadd87c863dae12368822675dd100034207490305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635812, "uuid": "a5b05e77-0f11-4c57-98d1-225ae131890d", "value": "T155D3499BB3F530F8D177853985920A05F772B87657616BEF03A4426A1F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635812, "uuid": "033ae9c6-2e69-4fe8-a82e-b6ef492b8e99", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635812, "uuid": "8ddb5a6a-a78b-4496-b703-0fe25476c31f", "value": "3072:jv+zxFifIup9RzJ3oZBysYCbpPkVTGbbZRGqWDA:5wQRzJFdCbpmssA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635812, "uuid": "25a055e1-2288-4e95-93fb-6140b08b2761", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635812, "uuid": "6b0b7f0a-8eea-4db4-a6d0-264155aff3c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635812, "uuid": "933724fa-9cd9-421c-b7eb-631fc264abfe", "value": "SecuriteInfo.com.Trojan.Siggen31.64782.12028.17226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f27ffc-b419-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761668410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668410, "uuid": "bc2618a9-9478-40a0-bf1b-923706a65bbd", "comment": "Malware payload (Mirai)", "value": "4c990752431322ca45c52a60a1d22ddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668410, "uuid": "4305db1c-876d-478c-bd6a-60ae1d6fc7c0", "comment": "Malware payload (Mirai)", "value": "ef04b551653cd437cf3b11a12c465734b897af4cdd1fbfda87ce355a63992a7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668410, "uuid": "8ae15065-c8ee-4ec0-89a4-f868815cab57", "comment": "Malware payload (Mirai)", "value": "2682a3483f868ab285440b9822abe4cbfad761ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761668410, "uuid": "419cd68e-446f-4cb1-b3ab-6af16a14f4d3", "comment": "Malware payload (Mirai)", "value": "b6c0a43fd7f80c5e1e651a8b098bfe5224bbfb03b2bb4c6c027451730593148fe15c9718b2de673cc51d51a9056bae6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668410, "uuid": "df462c43-c623-454f-a887-a074b359bf69", "value": "T12073C548BC415B1199E932FAFA5F018D33975BACE3FEB101AA111F2533CAA5B0F72516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668410, "uuid": "585e146e-bd5e-4432-9a38-5bb998e24e46", "value": "1536:fjnbp0zeSvLBBzgsvMJb6Y8QtO9tefK8v2eEQakGzORuYu3+lWcbk:OzeSvtfk84oALv2eEQakGzORuGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761668410, "uuid": "640d6dee-c282-4a4e-a11b-2204b47e0ae1", "value": 77917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761668410, "uuid": "7279b7fd-7d93-4f58-9244-fb81c4eef490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761668410, "uuid": "ceb4ba3e-dac3-497b-baac-fa9f652e2326", "value": "SecuriteInfo.com.Trojan.Linux.Generic.412679.5852.3656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af61539-b427-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761674210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674210, "uuid": "4e01506a-8487-45e7-aea5-212a0be8a211", "comment": "Malware payload (Mirai)", "value": "26c6e9072224c6b1b27053dd5b7ba332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674210, "uuid": "f48f2b7a-e4d2-49fb-b5cb-146ff1e43957", "comment": "Malware payload (Mirai)", "value": "ef398d9cbb74e511ce0c54eebbdaf3fb9e8326dfa49cc88905940813e4e498be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674210, "uuid": "a743027e-8ae9-4f1b-b666-edfb215f0739", "comment": "Malware payload (Mirai)", "value": "80198798f5f0f18ef79ab19504271ae6ad414b68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674210, "uuid": "db6fdc13-e2a1-47fc-aee1-1ff7d081cf26", "comment": "Malware payload (Mirai)", "value": "b983c3d16a3ac7ebaddeb3c028f2b8b6bf27675a4abcfc0a0682fd189d9264e600d4571e00f2fbea2be64c6aa13a4b23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674210, "uuid": "70f57cb7-eac6-4f6f-8b58-236ed2f2136b", "value": "T1F8B3F85AF8C1DB66C6C656BBFB1F42CD332753ACD3DA32039E146F24368755A0A7A042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674210, "uuid": "3fbe4cfa-384d-4f38-a28c-70e39d7d8b15", "value": "3072:+sedihuhAILDtKq4/cdrGZqhCAWFxQDWdIfPqveuJFBkv+Ov8BqgU4qcn1K:dedis/LD8q4kdrGZqhC/rSWdTPt8tv4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761674210, "uuid": "9977f65b-7020-4c30-adde-0faed4febade", "value": 115892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761674210, "uuid": "75cf8d91-d75a-46b1-ba27-c1e24e239362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674210, "uuid": "b6ecf512-0e1e-439c-8abb-a47f1f102687", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8590196b-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761640298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640298, "uuid": "7a42a528-cd9c-4cbf-8924-ca9a6b5a8a6c", "comment": "Malware payload (RemcosRAT)", "value": "b3a2f2c66d3c27ecedcffbbb564726ed", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640298, "uuid": "c21edaf4-9c6c-4c57-bcdf-d3123084a9ad", "comment": "Malware payload (RemcosRAT)", "value": "f036ff3139364684ba76356e16dd9643a1ab827c8e912c77ab97be6ee07f740b", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640298, "uuid": "6bc6aa6f-ba2b-44f2-86c5-6fa76ebc19ad", "comment": "Malware payload (RemcosRAT)", "value": "6aacc53f1f7a6f55ca770badf7786e254459ebd9", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640298, "uuid": "acccdb82-0057-4fbd-9063-06fa6b0fdfa5", "comment": "Malware payload (RemcosRAT)", "value": "dd2b67f5423b3566bf65f119f28705898680ee12a48dfddfce62378df4a438dfe65aab4fbf35d67ecc2aea8d638baeb7", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640298, "uuid": "ddb18ecf-dac6-4b1f-808f-b086b3810615", "value": "T1788231BE29D8A1544C1C552DAB808026A6C42A2D2FDB18607DFBEE533759DFDCFF4608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640298, "uuid": "425f046e-7186-47a8-bf76-9b1378a3018b", "value": "384:QcOD3ZXmKBSdld1q31Bufb1pDOKflrPSbKwlSY4jl+LCvVbI5aamXo0wfAIM3urm:iS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640298, "uuid": "d867b06a-5718-4590-9fb4-b31af9c88bd8", "value": 17709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640298, "uuid": "4dafea32-7123-43ac-a540-6bb29de5c945", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640298, "uuid": "dcb55f92-1c86-48be-9f19-f6876d987cf3", "value": "New_Ref_202510281_order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0b2b09-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656740, "uuid": "7626984a-1908-4ca5-9788-611abe5d341d", "comment": "Malware payload (Rhadamanthys)", "value": "ed35f2c3cb31c52d0bb227cba3d728d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656740, "uuid": "ec4c502a-f9aa-4aef-b5a8-67c673de9a83", "comment": "Malware payload (Rhadamanthys)", "value": "f10410422351324271700375f4df973e93e6bbf2aae67814e2bef18534aac191", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656740, "uuid": "d412061e-de65-4184-80fd-5c1d02b6879b", "comment": "Malware payload (Rhadamanthys)", "value": "083dd5cf8c6fb5eff7fcb2b35abe698cdeaa4df6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656740, "uuid": "f3bcc9f1-bc61-416f-8cf0-7fec0da1aea8", "comment": "Malware payload (Rhadamanthys)", "value": "9180cd0f97eb502cf376dccbf683ebbe40625394a5d4f6f1baa5ec19c43337546ffa1dca037c3bf2badb6871cafad070", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656740, "uuid": "03aa6ecd-c90b-43ee-9999-81ae8d0409be", "value": "T1CCA3D7DC1600BC6B119896EC14E475DAEC0FD44E0AD6D5E9F85DB2B288BE0DD2B11ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656740, "uuid": "aeb85bc1-5afd-4f90-bcd7-d5a7812d5498", "value": "768:GDhd0i7J4sYKgY/CMNfWda8UANpT3zQkq/PtTo8U7EBAwHQbMgS4ZDEeaiwfgb1U:GDB7eKg20Iarxr26yp/ADqC6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656740, "uuid": "50bffe24-f7e0-4dc9-a53e-4172e81beffc", "value": 106636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656740, "uuid": "125077c9-97ec-4a30-89e7-f563721a4b97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656740, "uuid": "d76f9891-02d8-44bb-8179-54db7be5c1f0", "value": "invoice-1637482117.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70aa40b5-b41c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761669469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669469, "uuid": "928281eb-d296-428a-ac8c-c198bb032897", "comment": "Malware payload", "value": "ed628a5e6ebcb4cbfb9a0141932e87de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669469, "uuid": "6c845604-e32d-4d69-88bb-7c1413b4779a", "comment": "Malware payload", "value": "f1147627902f8191875f9bcada71d8355caf5300c48b5d7160157e6f80bf1076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669469, "uuid": "0742df94-b75b-4602-a226-fd01a077c166", "comment": "Malware payload", "value": "ede1d9bdb2c586720e9f796fbde91ab5eeefba4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669469, "uuid": "436b0574-d8f0-4067-a910-479353f4c8a9", "comment": "Malware payload", "value": "42fdb8bb38d55b111f4024b89a71cd4f186f19d4d0c1ae17a07afdc35cf15eeb3600b6c93ce4a564aa0bda0e4ff13dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669469, "uuid": "3f19a0cf-3b06-4d37-ba9c-6309ba2f2f30", "value": "T13BB31756BC828B16C6C552BAFE1E118E331327BCE3DE7213DD246F21378B51B0A7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669469, "uuid": "0906dca0-7d6c-494a-8bb0-2b9c96d7a8ab", "value": "3072:299STK+yLtUhTCUrnr968TxLoPa54LytrgSlDn:2997+yLtUhTCUrnp68NLGa4wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761669469, "uuid": "8661811e-5ffd-4ee4-b407-03ae1214d2a4", "value": 108004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761669469, "uuid": "41c406a7-833d-4836-85ae-752b42a21d9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669469, "uuid": "2fef729a-5af9-4221-bdaa-74948db7ad03", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce171a82-b3d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1761639990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639990, "uuid": "37ffcb43-ca26-40f7-a452-792e20c2586b", "comment": "Malware payload (MassLogger)", "value": "1e8ba2a57af7e38ab8b6e34f4a4b463d", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639990, "uuid": "09e21ec1-edb5-4088-80dd-5954010318c9", "comment": "Malware payload (MassLogger)", "value": "f22663055f42b22470d694df88f5627858ea662eca3ad334b3b23867e20d7265", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639990, "uuid": "98fa1294-533f-4a76-ac7a-9925deaef5e7", "comment": "Malware payload (MassLogger)", "value": "55da1bf336e3d19db0ec424f7a0063ce161aaafb", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639990, "uuid": "0af3b45b-58a0-4c9a-9397-f49fe0a364eb", "comment": "Malware payload (MassLogger)", "value": "71a96426154299ee181eb39953c669dc088074e5c6eaf3800085fed5e61b13c6f268fe84557461328c44da0e9909b3ec", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639990, "uuid": "835cdcb1-5abf-4a0c-ae9a-b9f306837bf6", "value": "T136B4F11589886F74CFAC9A2880BE161ED3B0568B1556784AFB3FBD86BFF760441072CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639990, "uuid": "95f2eea8-12b4-4999-86f8-9e44dd2560d3", "value": "12288:tPDLQf81Mx56cw7Xk5G28ZKY4f0oLwTsuYSdIm3iU:J6aMr6JUJvNf0xTcgByU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639990, "uuid": "e3fc8725-856e-4203-a2fa-8ae922585e1d", "value": 534966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639990, "uuid": "f6d8fe61-5460-44b1-a573-16c6f56b3145", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639990, "uuid": "b80f15b2-640e-4caa-8dfd-2129dd5a35f1", "value": "rck88934.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a638acf-b400-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761657405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657405, "uuid": "4412c459-e46b-45ae-b853-20714fc9f3ed", "comment": "Malware payload (NetSupport)", "value": "31219c985bb7b24b20b02b479e46eb25", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657405, "uuid": "781f1b75-d377-4e48-8b25-a9aed96e28cc", "comment": "Malware payload (NetSupport)", "value": "f2d315cf142f31dfa01d4653f1f1518f040e340e92abfd60ee17278955eba7e0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657405, "uuid": "532d55f7-a18b-4645-bebf-c489767f18f2", "comment": "Malware payload (NetSupport)", "value": "d10c942147ebfd18d8317b2507cb5b0d858da4a6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657405, "uuid": "5410bc50-7f59-4515-ba40-8bea25a9c0d1", "comment": "Malware payload (NetSupport)", "value": "e01884acf58ab9a4818ef11ed9c8d1a8c5271baffa93b070a1b9d3a5ca0342784e9435814ff798b8d449e1f253a9d684", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657405, "uuid": "863b04ae-169e-4614-b438-d2e8491a655c", "value": "T10806F126BA8FC527D61D0272E42DFE8E6439BE77076140D377E4789A5C318C263B9A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657405, "uuid": "c0d8d43e-08cd-4a04-b7ee-061d30ca323f", "value": "98304:aDz3IGvjINMxGSl/ZC+1BZI9hUXe0DaqevQQ:mz33jzdC/aza5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761657405, "uuid": "bef5af75-d857-453f-8e5a-c0b05a41f972", "value": 3968000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761657405, "uuid": "77196996-6b7a-493c-8713-bfd9d20584ab", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657405, "uuid": "19c93e3d-77c3-4148-b632-5f2ae4bedcec", "value": "f2d315cf142f31dfa01d4653f1f1518f040e340e92abfd60ee17278955eba7e0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a2874a-b3bd-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761628836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761628836, "uuid": "c3375eae-09fa-40f8-b484-481b3ff3ec46", "comment": "Malware payload", "value": "260ced3048738f40a6ff2eecf9befa96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ollama", "colour": "#B8AB48", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761628836, "uuid": "dc642b9e-e649-4ea4-af78-d61a95d8d9bf", "comment": "Malware payload", "value": "f57cdd4806657478e1ead64234c2f6d038893d9be4c513f4d3624963b8a9e24c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ollama", "colour": "#B8AB48", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761628836, "uuid": "e0bc0a6d-484b-405f-b97d-01a502cf8c7c", "comment": "Malware payload", "value": "4d6b8bb960ed59fac7589daa4de1cc38d95505d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ollama", "colour": "#B8AB48", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761628836, "uuid": "19042f61-ab0b-4923-b6db-870a45d4c59f", "comment": "Malware payload", "value": "554a1720742b03d131b2bd2ee3d2cfa6862c680f03ec155fb79427f8a2a1c7f05702ce7663fc478cd68a6f4c1ce693f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ollama", "colour": "#B8AB48", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761628836, "uuid": "16857450-3bef-458f-b1bf-3b34b1b913dc", "value": "T16C136CA71D2468D2EF4AAF70D1D8C66BBDB272D22F815887602885C56F437E13F3815E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761628836, "uuid": "c7a88b20-604c-4e1c-92c7-01ed015a5bf5", "value": "b28b9b353aa8985c6c7b7db3091e7346", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761628836, "uuid": "24266eab-4f82-4034-830a-1a39f5e05364", "value": "768:ZRLoNnbL+hJTp703NEuLSoQuudBoNnbL+hJTp7:3EnWTe3pL70EnWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761628836, "uuid": "74f2bc13-919d-4c98-b6e2-e3657834f617", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761628836, "uuid": "445515f9-60ee-4995-93c0-e46ee9e71044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761628836, "uuid": "37bfae9c-5146-4b8b-91db-9ab2752b2ec9", "value": "f57cdd4806657478e1ead64234c2f6d038893d9be4c513f4d3624963b8a9e24c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab60d2e-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761636280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636280, "uuid": "0e53d32a-c3a2-49fb-a699-9e74069218cc", "comment": "Malware payload (Rhadamanthys)", "value": "23be3de048e3e64828f1be499d48c17c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636280, "uuid": "05c4c6b4-8ebb-4fbb-86c6-39698f803823", "comment": "Malware payload (Rhadamanthys)", "value": "f5876ffa60076c87bfc776e3f97a37b63fc59a987fb3f5f786e290e4818595a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636280, "uuid": "5e9ac90a-c3a3-4dc8-ac16-f45289a2bea5", "comment": "Malware payload (Rhadamanthys)", "value": "132afa37de1a3b5b2c8908fe976c6480298232bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636280, "uuid": "58962700-0d3d-4bc2-a1dd-38b5a0e11736", "comment": "Malware payload (Rhadamanthys)", "value": "cab266d0759dab5bc0a850b3df7a53c4a7c4a8281164428ea2018f929e89403c7a7aa480ee9ce8804a734ec6b2b7f0c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636280, "uuid": "4bbbe549-b9bd-4bc3-bddf-28cb18b43412", "value": "T1A0953363087F696DEA5E83720CEE0DC539B47D6840DAF8D67D0D89B879BE3820972C54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636280, "uuid": "5c121a1b-50b1-4638-bc10-d6bf26d18f92", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636280, "uuid": "7e923f10-0be9-4471-8564-e975117161c8", "value": "49152:lha6kSIFMmSiXrWM1hwsKg8E77aQxzclk1J1/lOKqpv:LaP3FMeW7s57theENhq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636280, "uuid": "25007d42-bdcf-4203-b229-b230f15a4fed", "value": 1982464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636280, "uuid": "9050f633-b5f6-4bb3-894f-dce489e286f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636280, "uuid": "6e199541-0827-4247-a31c-a8df89732315", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37212e7-b41c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761669581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669581, "uuid": "4a9ac0e5-532f-4276-9aeb-0b85faf16bf0", "comment": "Malware payload", "value": "36dada56c2ce62fe5111a38cc8030fb1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669581, "uuid": "84246b08-e444-44bd-b92d-d260c12be628", "comment": "Malware payload", "value": "f60ef986ddcfcd19f22cffdaea794d08dcde1f408e63ac4a880d6646966a9e90", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669581, "uuid": "0988ca12-35d5-4645-8c20-2bdd10295f9e", "comment": "Malware payload", "value": "cb855532f79d964dbd8f59b5afbf2eb7aea4e4f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761669581, "uuid": "0dc5c747-ac20-4826-b0cd-45a74289a20c", "comment": "Malware payload", "value": "b367a72babe07e8e15ea47e5c9781e484bac0e0deea7f148eecdb9aa2a3a6a25600b6330a6d16ea6c949ec3d3543d0b9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669581, "uuid": "8095220f-d951-4f04-9074-3b9c1843750a", "value": "T1F0C012AB19541A0044C4FDCD35760A1E505AC2A929920B9EFAFC2075C188502F042B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669581, "uuid": "5eaff40f-cd2d-46d7-9311-83f1433f9ccc", "value": "3:zBMXBgHecoZ0kL4UdQCaeFGBzSEyLTUWn5d3L4UdQCLJe8BzSE8eUsJ05dI:tfj00rEANIvLsElJNd6LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761669581, "uuid": "2116955e-9d8b-41f4-a6ee-e857754f6145", "value": 190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761669581, "uuid": "2c66bdf3-ae3b-4382-9c47-ded53e539f36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761669581, "uuid": "9e21bf66-b765-467a-be7c-169b58433b74", "value": "sm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0559f66f-b3f8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761653827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653827, "uuid": "d588f7f8-c98c-448a-92cb-71481e5e6864", "comment": "Malware payload (AgentTesla)", "value": "4ef1912f6e0075ee7ae8a7b34ffbd38f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653827, "uuid": "fcbda087-19de-45e6-9064-5ab586acfe96", "comment": "Malware payload (AgentTesla)", "value": "f68dd93f76d86e2b85a22849db219a2aa13cfc9549d55da0fa64bd037ca79f0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653827, "uuid": "826902a3-790e-4528-8efc-98c2e2d0015b", "comment": "Malware payload (AgentTesla)", "value": "fdf3db6734b007f5fe654ad5d8ad5379cd9f4e11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761653827, "uuid": "b5456568-f000-451e-96d7-c2d6b3666852", "comment": "Malware payload (AgentTesla)", "value": "bb01c63ef4ac45006d28def742946e23daed8a9b11188c0f12ff88fee209eaa9eab3fa38c34f7fc765cf441d0e192ec6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653827, "uuid": "a7e1842f-4172-45a6-a934-e3f95651d837", "value": "T1DD82D3C8BFC5B2A0123360737D1BB45EA36A6C80F24C5558E335B564FD60B1CEAE6978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653827, "uuid": "f55de6a0-d5c1-4067-b540-e7b5b2512d81", "value": "384:7TD4sI2tYixY9apWMMSYqOa5CnGkIkbxxxs:zX3xkDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761653827, "uuid": "24c05dcd-a9d9-4565-99cf-aae32d29a6b8", "value": 18959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761653827, "uuid": "9b9e1d32-267b-4528-bc5e-f0f3965c85d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761653827, "uuid": "5682193f-43c7-414c-bb91-d391b11cada1", "value": "payment receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c19b8b-b3cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761636265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636265, "uuid": "e3fef518-6269-4acf-aa53-69dc9f328c85", "comment": "Malware payload (Rhadamanthys)", "value": "d989baacd931f43a7a60f8cc34ee61e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636265, "uuid": "1a7e5447-eadf-4465-8dcc-8acd37a35d11", "comment": "Malware payload (Rhadamanthys)", "value": "f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636265, "uuid": "8ca7978e-f5e0-4c92-a510-cc912656e2d7", "comment": "Malware payload (Rhadamanthys)", "value": "3e0341a259d7151807d754cfbcc6ac4ea91e48e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761636265, "uuid": "15d16f0a-9fc5-4055-a081-79ed5f162bb8", "comment": "Malware payload (Rhadamanthys)", "value": "31a30e68d932b5aef724fda6e2781f88f30c7d7da9b4bbdd7d3ad37bcbe78422d2cbc17b14f8745ca24889156bdcccd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636265, "uuid": "3c98d145-9be8-4fcf-a428-61ddc624d835", "value": "T137953323D97553BFC7DE31707E925EC8E702B91E024F69C5624A179E8F2EE612B72060", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636265, "uuid": "189bb147-293c-469d-8461-7ad0314634cb", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636265, "uuid": "04cb2394-b5ec-4bd5-8baf-60ac8b33fa82", "value": "24576:g2BY+F7V0kjByaqZUkf3U3cqkXU83Arn9ic3Bq26J/9wDbfU26QCzwIze11+o:gha6kjaykf3ws3Arn9iaEdUDUARb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761636265, "uuid": "fa1ef4d5-98f0-4c61-bb10-ddc77adc0111", "value": 1992192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761636265, "uuid": "35ab7c0d-f148-4bab-b24a-4a5613cff249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761636265, "uuid": "0d97d569-3515-45a1-94fb-c3efb3485f3b", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896ba4df-b436-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761680677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680677, "uuid": "5777d878-34d0-4f97-8cdd-d1fdff6c636b", "comment": "Malware payload", "value": "1a981069bc7116c68dff730a0f35feb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680677, "uuid": "f2ebdf7b-f607-41ef-97b3-ae0a36700fc6", "comment": "Malware payload", "value": "f6e5b7494a3de248f15384fd8bb18e44fdea052e302781cfab613facf2a8a5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680677, "uuid": "bb04de68-7768-43cb-b8a3-dd4a9c6ab6db", "comment": "Malware payload", "value": "78a271dce4423cc226d4fc91a09c98a374f23136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761680677, "uuid": "9a5c2402-1db6-4964-b9e7-4f7e036a700d", "comment": "Malware payload", "value": "66714c1adeb2287c38106a1211ff6ab61458029bb87878ee8feb8c6f73335fa16d08463a6b44e13c3d16879468b0c264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680677, "uuid": "c01892df-5854-46d3-8ea4-157f5bd1dedb", "value": "T1FC058DEDF69A13C6F460A72DFC1080A4E1AF0AFE2BD0156845AD7C2DF42CE5E59E3905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680677, "uuid": "d646578b-61c3-4f2b-9b9f-18ecad8439d2", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680677, "uuid": "b0a69048-154a-4179-8ee2-e850dbc82c4d", "value": "24576:rEC4AcC03aDbJ8KMLoh5UuPnQinQyTgWZqkLUkhaNZwPfTsoU0c/:YfAcC03eMLoh5UuPnQinQyTgWZTLjhFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761680677, "uuid": "6781b6db-d73f-4fe4-b8ba-407ac4986ab2", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761680677, "uuid": "482ebad6-8d5d-4781-a104-32bdd322aadf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761680677, "uuid": "f4a97e9c-3935-42c3-8b7e-6c312a20d8f0", "value": "l4d2loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57de2e5c-b400-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761657401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657401, "uuid": "3742683d-7a90-472e-900e-7a1e590dd12f", "comment": "Malware payload (NetSupport)", "value": "286ecb0602f5ab7444746b33451d4db0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657401, "uuid": "66b534ad-2d79-4acc-bf22-9bd57cf8a6a4", "comment": "Malware payload (NetSupport)", "value": "f6eaec522a9c75045140afe46155cc281dd4cc594c8ee1a498c7529ffd7652a7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657401, "uuid": "4abf39c5-e815-4f3e-99ba-7c97e5f27437", "comment": "Malware payload (NetSupport)", "value": "301a09425ceb59763a4c6c4cd9d3a332115e33ba", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761657401, "uuid": "60b3dd52-4365-4d69-866c-086daed8f222", "comment": "Malware payload (NetSupport)", "value": "3b53babb2eb94d1c0e3604675f03484696dbc5804b3bc4171dd86c6900aaf142185d179f75720266d99c637b3b74daaf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657401, "uuid": "a2b27d33-e18c-424d-816a-9db258a2d88f", "value": "T1A806F126BA8FC527D61D0272E42DFE8E6439BE77076140D377E4789A5C318C263B9A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657401, "uuid": "7ee391a7-2f23-4096-98c1-7e6f4e7d0448", "value": "98304:2Dz3IGvjINMFGSl/ZC+1BZI9hUXe0DaqevQQ:Cz33jzJC/aza5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761657401, "uuid": "ee9436fc-5df0-4bb5-9aae-442a744eab22", "value": 3968000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761657401, "uuid": "44d0fc8e-c6cf-4ea3-8d2d-3b2f0e36247c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761657401, "uuid": "278a7839-b185-4969-97ff-8985eff19a22", "value": "f6eaec522a9c75045140afe46155cc281dd4cc594c8ee1a498c7529ffd7652a7.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bce567-b403-11f0-91c6-42010a9c0006", "comment": "Malware payload (HijackLoader)", "timestamp": 1761658678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658678, "uuid": "eea22c5b-d184-4c8c-94a3-2a58a31ee28d", "comment": "Malware payload (HijackLoader)", "value": "32b054758d81d9aa400e4edf14e0a145", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658678, "uuid": "529c6784-7bfb-4b99-bc11-de9ab4c5bd33", "comment": "Malware payload (HijackLoader)", "value": "f7abb1a1a22b2ac76eedac8d92435e1adddf895c93bcc9a3484c0f0a629a97cd", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658678, "uuid": "4d40cdcf-f788-49ac-a7c6-3fc046d9b98e", "comment": "Malware payload (HijackLoader)", "value": "f0607465178372d745248a684d83fe00e2a4f0d4", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761658678, "uuid": "22b710e3-846a-4518-bfc3-a88beacde259", "comment": "Malware payload (HijackLoader)", "value": "521feee4a31781147443b9cb5153c6b4abf033116081d10744bada78fc478b52050409fcdd522ef2d8d5edb462253380", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658678, "uuid": "4dc27974-2ada-4f3a-a23a-b58960c96727", "value": "T13C77AE97B3AA51A0C177C13CCA9B422BF5B2780587228BCB56959B191F337E15B3FB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658678, "uuid": "fbcecb58-2570-4d97-9c63-76e3af092c04", "value": "393216:uLCYhEzQ4AowYgIQ4AowFoyJsv6tWKFdu9CzPr7HfiFJ4JoN340APTHKk0MaAmEq:uEsJSvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761658678, "uuid": "05531710-6920-4294-b09a-06f0f4951077", "value": 32909356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761658678, "uuid": "1e748963-463d-4172-aedc-bdeb260f97bf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761658678, "uuid": "eca47f6b-73d8-4ae7-93a8-8f4d580e2f55", "value": "SecuriteInfo.com.Other.Malware-gen.71537516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4679a4-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656662, "uuid": "fad021f2-860b-4944-8add-ae4091bdcf4d", "comment": "Malware payload (Rhadamanthys)", "value": "cc593a75b73863c9fa734c30a94fe59c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656662, "uuid": "3d161872-f016-4bea-9039-8f77f07c411f", "comment": "Malware payload (Rhadamanthys)", "value": "f9a2c238c13cbcf1c5a5a144a618c7dd962d4c61d0eade7495a36eabdc0fea9a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656662, "uuid": "1daeed97-a5d2-4417-b4d5-4ad5139ef91f", "comment": "Malware payload (Rhadamanthys)", "value": "ce8b5f556d2ea45a46d5aae582a0d93ce91179f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656662, "uuid": "dcc9e916-b109-453a-9798-4f0a7eaaa13e", "comment": "Malware payload (Rhadamanthys)", "value": "4b868a68a0375506b66d0670440107566d9a5cd58f0f1a063612808e8aae78b5aa6931e7dc74480c52410a08cc9d185c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656662, "uuid": "a327a07c-82e1-42d8-8864-91ad462dbb9c", "value": "T1D5A30AAA0D3BDAB4A0E7F92DDD6071F8CC2D8B81914785355447AEABC04FBD01BA95C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656662, "uuid": "30ffe463-e0b0-421a-b8b9-6be93b36fbfd", "value": "1536:GDB7eKg20fCYrjr24ut88AZS86BkQWJ+aY:GDB7b0fCqfHYKS86BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656662, "uuid": "994bab1b-ecca-4bd8-8e10-85d2b059bf71", "value": 103494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656662, "uuid": "82cf87d1-f4b3-4838-ba5c-d0da86dc9804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656662, "uuid": "5ff91655-3997-4d7c-988d-5f8428bfd7b9", "value": "invoice-1637482117.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf09a4c3-b396-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761612048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761612048, "uuid": "2fa00553-7c54-4f03-9de3-48f2f4a950d6", "comment": "Malware payload (Mirai)", "value": "7e61f1d2e44dc7bf8f2feda011a55ed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761612048, "uuid": "c304a344-73d0-403f-a59f-1cda2f9fd381", "comment": "Malware payload (Mirai)", "value": "fa7f78dd8861943b1758714fa313b030d030f57b8676755c2d98aea00ec32ed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761612048, "uuid": "1d112fc7-bc82-46f2-a997-41f7346f0dc0", "comment": "Malware payload (Mirai)", "value": "905c3902b40ec72586ada28b8ab6422ce1bc25df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761612048, "uuid": "ca34b9f5-7160-4053-8efa-c53f4df45662", "comment": "Malware payload (Mirai)", "value": "128081f8adbbf0c3830bbd190d55cc40a18057a2912d87d35cadfdb1901635667393762ac59b1826b28d4a0e8d81ebc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761612048, "uuid": "a890a1b4-2b8b-4f75-a38f-65d68cea1df5", "value": "T14F04D816AB550FBBDCAFCD3706E90B0239CCA54722A53B3A3674D524F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761612048, "uuid": "007dc174-803c-48fd-8d29-04a587e16583", "value": "3072:Ubepd5IQnDS+ILZkVnz8KNLRRrlABv2bme:UCpPIuD/IOVYKNRRu46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761612048, "uuid": "954669bd-f27c-4f9b-8205-658a2950b1fd", "value": 182008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761612048, "uuid": "e9cce71e-98de-42c8-8275-da94fa004b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761612048, "uuid": "cf8e57e9-c3a9-4926-bf05-2264621ff25d", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bfcc9e-b3d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (WSHRAT)", "timestamp": 1761640384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640384, "uuid": "b4ea55fd-71d9-420a-be3d-6c45aac5c575", "comment": "Malware payload (WSHRAT)", "value": "49341d8671f6e740d1d6e3e5bf92434e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640384, "uuid": "dee9d80c-7c59-4244-90d1-b6cd16bd4bb3", "comment": "Malware payload (WSHRAT)", "value": "fab39c1980f3020c322a1b0541ef988f088cbeb57a5f97cdc73057042e298c2b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640384, "uuid": "7d550dce-68cc-4425-a71f-335baa3af58c", "comment": "Malware payload (WSHRAT)", "value": "5f416affebf027e95271f86f253f7e9690b708bb", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761640384, "uuid": "e262cdfb-f60e-4ae3-87b8-6033ee1bf309", "comment": "Malware payload (WSHRAT)", "value": "fd9ff142a1d1e4c66bd065cf9adca4a5cf34e60046d1290d5fcda17540d09d2eda1825be4c15748009f07f91353b7161", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640384, "uuid": "d1c12847-d5cc-4131-9bd8-63f90084fb2d", "value": "T14B36F20CB7C6815EF63CD9C7A84DA89BF0F50706DA9527DB36CB3023A8DED68860159D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640384, "uuid": "235069ba-996b-481c-8d3d-53dc59b948fc", "value": "6144:U7i4MyvyEi3oxbxklQhvjq2b7sPQdZ+gAWcIpO:j4iYtxklQbb4PQdghWc0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761640384, "uuid": "5772b0a0-55d3-4ad9-8c77-cbb14d5028c0", "value": 5252747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761640384, "uuid": "a7515139-e2b8-4827-bc0e-2bc748f43b4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761640384, "uuid": "6c59f4ca-8bcc-42e8-8e6a-429c8441bb06", "value": "wp.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51ddc68-b407-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761660537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660537, "uuid": "daffa72b-896d-4d08-91db-8bf860185311", "comment": "Malware payload (NetSupport)", "value": "5e8fba20d7402327ab073eff9a6a03b4", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660537, "uuid": "da15bf57-af28-43d0-a8db-1321b24f10f4", "comment": "Malware payload (NetSupport)", "value": "fb74ccdc52a79e5550f489dc1db06e692049e336056be12a3830661cc749d57f", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660537, "uuid": "5766e2d7-f485-4b2d-b2fe-385564fcc290", "comment": "Malware payload (NetSupport)", "value": "4b24deb14070c64180682c0efa35464b04e9cec2", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761660537, "uuid": "d3fddc78-c4e1-4ec2-adbd-3334fe78c5c5", "comment": "Malware payload (NetSupport)", "value": "85f5fe6402e188b13a345de27eed5ee467c240e349882a58187c9df9b55b8b8cdee88a90483e3cd0ab7bd663bce63363", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660537, "uuid": "73f1df50-6c4a-4ec9-bf0a-2ef59f874f03", "value": "T1120633B6BF835BE2E76B9171D2967F325838D206F2BD30671D907061A88BB704703B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660537, "uuid": "854f6238-2b84-43d4-9ea1-a9c71ed3667d", "value": "98304:uP+Ux89i7JDmWZk9Y/TMwDIAUk/8vJKSotetAtnuqs7cl:Ax8oDmWZkW/QwDDyBKSW0OuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761660537, "uuid": "d3a13197-a594-45ab-b343-e89949a8c5da", "value": 3886677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761660537, "uuid": "2c51a448-390f-4489-90e5-5f6d4c313736", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761660537, "uuid": "69aee121-1f25-4e9e-8eba-980d6a84c1dd", "value": "dsfcnotufy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d68f7e-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761646385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646385, "uuid": "142d6bc7-75f7-43f3-bdf2-75382ebae89d", "comment": "Malware payload", "value": "7f825115e915ba6d76721c8d91024e74", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646385, "uuid": "6e6495ab-1d3f-42c5-83f5-7feb6bfd91f0", "comment": "Malware payload", "value": "fc49572c7496bee085537bf79d47171f6777345fa9e0f1904d3cdf08eee0371f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646385, "uuid": "21b337f4-c17f-4713-bdac-f7f1d6bd3199", "comment": "Malware payload", "value": "a230a314cf960a087199a3865642f39ed093f5d1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646385, "uuid": "ce011bfd-174c-419e-a3ad-567cdeae1da1", "comment": "Malware payload", "value": "4110de3dafebb63864421effa557a071ede44e49368e24dcc7e39c36be3629000dcc11643119366f91237e696d18e376", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646385, "uuid": "7e5889fc-1277-4c4a-a5c5-48995f09de56", "value": "T14E762347FB6AAA5EC4F3D3331AB142352036DD26C743D3475A1937B824BBAE40B0A6D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646385, "uuid": "f015ee91-df6b-453c-8d22-31cd75c0c59f", "value": "196608:VNuPku/lLTAOzl0giSKyx1WUvfIMM52IN8//rx05d:VNuPD/lQqiSKy5j+2IN2d05d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646385, "uuid": "724adf66-8807-45f5-9feb-ca7dae16bd57", "value": 7506459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646385, "uuid": "8819ab08-692a-4e8e-88e0-c187786cf3f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646385, "uuid": "b08c3497-a3ae-4616-99e8-e8dc4f04a8dd", "value": "V6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98c2422-b3d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1761639633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639633, "uuid": "e7a37929-ce60-4962-b542-6ad4ca088f76", "comment": "Malware payload (DBatLoader)", "value": "c6fc4cde316e2963092624b866de5464", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639633, "uuid": "d3e5a5e6-8b70-4987-89c2-246553edf431", "comment": "Malware payload (DBatLoader)", "value": "fcb84d0e13b23eb6d3a069c9f602037cf44a1436925b08db885c4151331269a9", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639633, "uuid": "10be7684-473a-41bd-b1fc-4409e98cba8e", "comment": "Malware payload (DBatLoader)", "value": "c0222370cd79dc2bc654e9e43925bdf533467a6e", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761639633, "uuid": "60a68509-4386-412b-a70a-84c4f5c33d70", "comment": "Malware payload (DBatLoader)", "value": "70754b9b17b2750f0dfec44b135211da33cc96a412a23443e76d6eacbde409e1ecd3b43c20be4d739e810141e9b52dd8", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639633, "uuid": "99743878-779e-4e79-b129-51f47078255b", "value": "T12AB5BE728D77ADC92F7865CAC5DD3AC02F2C57438528A2A46E4EB27F11991017EDC8EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639633, "uuid": "106cb41f-3d08-4df2-89b0-88481d5b4f07", "value": "49152:cM+Q6N1ypLFsZ/yvrTTsTrQf8poqqxYaW:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761639633, "uuid": "e04c399e-af63-41f2-bc72-f7ea240fbd66", "value": 2421775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761639633, "uuid": "05f10920-e395-4b38-9338-000d89c700fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761639633, "uuid": "b00c0a43-6dfd-4284-8120-7a65dce40dae", "value": "RFQ SW11-SH-58 -SW11Z59.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd20e32e-b3cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761634834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634834, "uuid": "5c8ed0d4-4b65-4225-9707-c4a752a91d83", "comment": "Malware payload (RemcosRAT)", "value": "fbf04d92d4c4f3eb2a1febc7c45f1070", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634834, "uuid": "f2ae6707-87e5-48c1-8b98-afdc32b5effd", "comment": "Malware payload (RemcosRAT)", "value": "fd126c74f617d21f78f6a14148c46456b8043c8902d7b2d16cf370677872b32a", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634834, "uuid": "bd7860fc-3f3e-40c8-8bc1-c75c8cc7c8fa", "comment": "Malware payload (RemcosRAT)", "value": "29ca5e60aa790f3bf1c389fefc83d141814d4edc", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761634834, "uuid": "7328790d-7cf1-42a3-b0be-3da3258af420", "comment": "Malware payload (RemcosRAT)", "value": "68b98a24c68f136a65d9c32170550bfba48b5b943d4c65105b8c1eb0e911accf4b7fa584df54f2fc98d77ff6c68732e4", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634834, "uuid": "7d3df6ee-a352-470a-bbfe-d8ae058c2bc5", "value": "T1C4358C17691064FEDADC9386A2FE9D14113D6A82E932543E273563C4D902BD0BB633FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634834, "uuid": "4c9b6a6e-8e9e-4010-9a6e-0dc27846a720", "value": "24576:r8jhtFk3qIIA+yERBm/vBd+zfDek7j0J7b4DraNZbxooAsc6Vi1ilfMY:w8dez7q9rVE40Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761634834, "uuid": "358a257b-1b62-4b06-aad5-67bd5457f4ad", "value": 1077446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761634834, "uuid": "13f0f695-466d-4e98-98b7-d2d62e70b04f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761634834, "uuid": "8f0134bf-b364-4cd0-9e43-872df139ab6f", "value": "COTIZACION EC10-68.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393f7da7-b41f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761670664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670664, "uuid": "c6fbebf0-b796-4993-8bcd-608b24eb960a", "comment": "Malware payload", "value": "e9749d9e5a122ee9fbc77544d7da2475", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670664, "uuid": "fbedac12-1d2f-497f-999f-d3db95906948", "comment": "Malware payload", "value": "fd7aca12fe02f4b258e332428f8dedcae73f8a10ead511ffc73c44785f02ea67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670664, "uuid": "cc3d8d1e-8b1f-407d-9882-41e7f9a1c343", "comment": "Malware payload", "value": "42a9e382e77fd8018463eb6eb0f4fb58eed0e7af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761670664, "uuid": "024c2d9a-1375-4b44-bc25-575025a93cdd", "comment": "Malware payload", "value": "d59f49d5fed88c7d1bb9e6a31313e1c38b297bd665d4583457df23a000924f1a5e4f1d985fac253b3dec9549e2c20e89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670664, "uuid": "73e18d4e-b838-4d51-9312-721f8a61f24a", "value": "T10583025695B1CE248F4316795B382A7EE00FF3868C960E54D1D66DAA71B3ECFA24FD00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670664, "uuid": "01dd3503-7adf-4656-882c-95ea7fb772e9", "value": "1536:2pVdA2DN/oi0DRSyHJxj5j9NhUcIYtB4K46W37CYhmFXifQQP9k3PbpCXteP4m:2Tq2DSi4vb5XyctyOUmiFk3PbUmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761670664, "uuid": "e7d38df1-ee02-435a-bf9d-84145652f148", "value": 85744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761670664, "uuid": "a639c65d-411b-4741-949b-09ea22bfe3c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761670664, "uuid": "4d73be88-390c-4c73-8bda-2944c19f5f2e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34552a49-b3dd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761642309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642309, "uuid": "3460057c-785c-4917-98a6-bb95219e9dcd", "comment": "Malware payload (Mirai)", "value": "dad3fe8793986d5d2867b511aa4ebaa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642309, "uuid": "3021549c-49ca-4325-90d0-dfba173ce23d", "comment": "Malware payload (Mirai)", "value": "fdbd178bc2beb7ca3f9d3523cf15abbd6dbf3dd7386426badb958ed689e25b4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642309, "uuid": "6418c987-3224-46e7-a532-16fe2729bf1a", "comment": "Malware payload (Mirai)", "value": "2f130d2338fae6578b81fb3db0182377641e63bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761642309, "uuid": "1ee1a627-c4ea-4955-845d-4a00bc0ee56e", "comment": "Malware payload (Mirai)", "value": "09486bdba713f9f4818427e86c06fc6c7a4bdcfdf2c02ed26de5111d33b8bbf3b05bd6caca7ed329b2e59e5302efa765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642309, "uuid": "17f6a41d-80f4-46d7-a47b-ec1a218b40c1", "value": "T1B604C816AB510FBBDCAFCD3706E90B0139CCA44722A93B363674D524F54B54B9AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642309, "uuid": "609f2967-3636-4fb2-b540-7c03f64fefce", "value": "1536:UbN2d8l83R/A79MKpzZSZlGQUeveHnbtE/PbcaZkfcujUCI9Hid4DXZE7Q0Na/zt:UbN2d8l8B/k9xIpnoawXI9He4Nqabxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761642309, "uuid": "23d241f2-b382-4499-b534-74f64e1eee04", "value": 182012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761642309, "uuid": "f73b0ba9-bad3-4b24-b45a-5e1900661aa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761642309, "uuid": "a1f80b85-0d6d-4cb2-ba8f-0016a28946f1", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a263f5-b3ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761649077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649077, "uuid": "c931fb93-7ad7-4c11-85ea-db1e822ad741", "comment": "Malware payload (PhantomStealer)", "value": "4d61f37a792af1c6ba4cc621c1d611f5", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649077, "uuid": "6c77deb7-7eb8-4762-b7c6-de0eda5f27d2", "comment": "Malware payload (PhantomStealer)", "value": "fdf3771038819bb0b8e6afa46bad17b0784686b7f47b8eb7dfbd8ae300ae9908", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649077, "uuid": "52d0adcd-a639-4f5e-8996-17a6fc9f040a", "comment": "Malware payload (PhantomStealer)", "value": "56636e7928413ac5cf507036f79cc18601e8e22a", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761649077, "uuid": "88d0cc8e-2003-40ab-901b-472548e6c309", "comment": "Malware payload (PhantomStealer)", "value": "9e2e7854dd36fa30ccfb7a304bfa17c3a06c4bdfb50a9774f76d5a10878c10d95baef0a5f5c5c437123d5f527ba78674", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649077, "uuid": "226e3d79-03ce-4b93-85d6-e5db9a56355e", "value": "T1E1A2E1E8CA531BB44D25701F60D9918FA66FEC20E6D568DBC78C5FA091216C18B737F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649077, "uuid": "4048860f-947f-4e6f-bc65-b8c11613a0c1", "value": "384:hc4bwwMhqD7CklwBa1njPT0r4QQNeTYq1uy9jia4CyB0JcimTJq:G4bw9ZkaMRLT0r4Qd15RcCeiKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761649077, "uuid": "c6674213-7281-40ad-822b-33fffb25ebe8", "value": 23337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761649077, "uuid": "ac5f57bb-b692-445f-bf4a-c8fcf346ddaf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761649077, "uuid": "b3e0c676-3a34-4efe-81f0-e1aadf23dd62", "value": "Advance_Payment_Confirmation PO-0252615028.pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8788a7fa-b427-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761674231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674231, "uuid": "138a8edf-a899-4b2a-b2c0-c11fa42a8c0c", "comment": "Malware payload (Rhadamanthys)", "value": "ec0fa397e8646a90cb27c92cb6599c13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674231, "uuid": "eac459bf-b4b8-44cf-a4ea-c55f0dbb7e33", "comment": "Malware payload (Rhadamanthys)", "value": "fe25b82980f7a684dd6b56caee553e1e118d8755424d85b7cc47cd32a89adcb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674231, "uuid": "3c8a606d-571c-4dd1-bc03-8e497cbbc01c", "comment": "Malware payload (Rhadamanthys)", "value": "21443028291e1fbc7426164645a45ceb7accc6ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761674231, "uuid": "e2764065-824a-4474-b971-025b33d6a8fb", "comment": "Malware payload (Rhadamanthys)", "value": "30fb50119d05f27a81625e3dd3c3a400df892858055ab6229e48075bc1d698302121263e2372d01cd6ba720ee4088ea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674231, "uuid": "b6768ec9-af2c-4f90-b9fa-803180266f79", "value": "T16BC4AD4E11790C27C1F916FB88B65346856F60A05182457FE7DDDCABCE0E2A36BE072E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674231, "uuid": "72dc89c9-04ae-4eb0-83b0-53d1c9ce1315", "value": "c84f18c64457a2f585ead47ad12eb0c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674231, "uuid": "428e4700-65c0-4d51-b8b6-2b5e54b25be5", "value": "12288:100laqWR+JP4N7m4sC+vfCIEwSA9Pzi+cofn6pLp2:HQN7xsC+nvDSA9Pfxfno2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761674231, "uuid": "01bc2de9-27b2-4ebf-a6d9-89938debe5b8", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761674231, "uuid": "ed58610f-c8e9-4e33-9a66-7bdd0973452d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761674231, "uuid": "66eabdd4-21bc-4441-a41b-b301dab4374f", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.41909.25995.27844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb506641-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761646428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646428, "uuid": "803d55af-0f40-482f-a7b5-73e92ca444ea", "comment": "Malware payload (Formbook)", "value": "5bd33579634d9b42379677521b45aa06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646428, "uuid": "8bc983d1-70c2-4805-8f3d-0bab74d296b3", "comment": "Malware payload (Formbook)", "value": "fe59fb74042d330798a5b0971cd71791d2f0b0e0bbe0d2c07c1d8b23f500c888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646428, "uuid": "7c8d1537-81cd-4458-ab42-28f29dfad784", "comment": "Malware payload (Formbook)", "value": "dc8d044fa199c20d297ed626896747d682dff777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646428, "uuid": "735eda16-310d-4b1d-b700-3b1604583b39", "comment": "Malware payload (Formbook)", "value": "57faa380c959da9f2ba609b3efe08e670ea0fb432f1bdc81a1a481835cb9e4d7b2b91186cab2a2185445d6a90ec60582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646428, "uuid": "3cdfda15-610d-4f5d-8b4f-ade6dc604cf6", "value": "T17D45BF0273D1C062FFAB92334B56F6115BBC7A260123A62F13981DB9BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646428, "uuid": "77e9f780-467c-44fe-b587-758c834a1558", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646428, "uuid": "f1c6b9af-06e3-4de8-8aaa-1edbf3894f76", "value": "24576:f5EmXFtKaL4/oFe5T9yyXYfP1ijXdamMJ/K9cq8LA5sA3GOy8ZEp:fPVt/LZeJbInQRamR5GAV3GOy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646428, "uuid": "8040d06f-27b9-4647-a397-6a7b9386fc74", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646428, "uuid": "fc2e91e6-e346-4851-bf3b-a860e642cab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646428, "uuid": "94f2104e-6f43-4458-8637-47c46659fc63", "value": "RFQ REF-JTC-AJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2ebdce-b3e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761646407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646407, "uuid": "2a46f773-1e26-4031-b1dd-3bbe9533a2d5", "comment": "Malware payload (a310Logger)", "value": "07893e27407e0c4f6458ab8a03fb3677", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646407, "uuid": "a09e9603-60f6-4dfa-bc90-cc19df397017", "comment": "Malware payload (a310Logger)", "value": "fe80c043492a71a38e1705f7ef620c20b2029baac7702361f96a7b0242d459fc", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646407, "uuid": "1753324c-a062-426b-a9f9-c50209ccee24", "comment": "Malware payload (a310Logger)", "value": "f9fe8cd9e6ecfd89cf002b8c886e5a1b6afa2a6e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761646407, "uuid": "7356ad74-6d29-4cb6-b972-223566ec1525", "comment": "Malware payload (a310Logger)", "value": "15709a8dbbaddf31a1835442cb88b3004327e6571564f68c0bf7d9e3f18ccc985ac651dbe6c62638e9dc7fd51a8fdb02", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646407, "uuid": "4fbd1639-6d1c-4ec0-8d21-bdbab3ea6e71", "value": "T1122512A54F1DCC13E5851BB40620E3B16630DE8CE916D2126FFEFEAF756A9063C6D290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646407, "uuid": "70dd86bf-2534-4472-81c1-11a8e4d802ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646407, "uuid": "6051d9cc-a42b-46df-b921-a9fb603f8c39", "value": "24576:IHF7XV2vB8uN8ni4hqpBEDi00/4emrtdXmWsirwv70o7FBmqG1UH:IlkvB8ughwBED/Nemtd2AUDvFBmqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761646407, "uuid": "38fe720e-a43d-49c0-b17c-1119f17a960e", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761646407, "uuid": "d259bc36-1087-4728-ad3d-ee460d0a09f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761646407, "uuid": "221340ca-5ae1-422e-832f-7b00726df817", "value": "IB9876545678000DLK.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c41a3e-b3c8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761633507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761633507, "uuid": "16d23c6e-f918-463f-877c-3021c77f31ac", "comment": "Malware payload (Rhadamanthys)", "value": "3167b35f79c82438490a0813cd600f8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761633507, "uuid": "37e82f22-76b7-4f76-b320-f4eb10cc696e", "comment": "Malware payload (Rhadamanthys)", "value": "fefc9b560e8a1a5f3edfad638ccd4825e3eb2a839fd33b49395caf2552b4d017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761633507, "uuid": "a288776f-9bc7-41fe-890e-a84b6ef0dc19", "comment": "Malware payload (Rhadamanthys)", "value": "d4be90f30bf7bcaeeea1011359a37a6a9e2ffea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761633507, "uuid": "69d1747a-e4b5-4d2f-a02d-167e7908d6d9", "comment": "Malware payload (Rhadamanthys)", "value": "539e98b16a3727be8e054dd7eb85ad28650870bff240cf61ee1456324bf6ee71e378d05c22ac6aa0d3ef9f512731236e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761633507, "uuid": "bbe7a8f9-561a-4257-9bb6-bc45122df153", "value": "T19AD34A9BB3F530F8D177853985920A05F772B87657616BEF03A4426A1F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761633507, "uuid": "66efa842-763b-4534-9c96-5c7d57374a68", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761633507, "uuid": "493cdd53-a09c-4b01-b451-1b45cad5db43", "value": "3072:Sv+zxFifIup9RzJ3oZBysYCbpP9VTGbbZIGqWDA:WwQRzJFdCbpHsDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761633507, "uuid": "286cefc5-435c-4c35-84f3-3e73827bb4fb", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761633507, "uuid": "39542e7d-335d-4dbe-ac24-fdca6fe46adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761633507, "uuid": "37047995-9541-4d16-ab60-6d9cb5072625", "value": "3167b35f79c82438490a0813cd600f8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1915bffa-b3ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761635821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635821, "uuid": "4919a7c6-f317-42ac-a8b9-2ac6e571d70d", "comment": "Malware payload (SalatStealer)", "value": "c8775b4db2ddf43a169f437b72aeef57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635821, "uuid": "942abbca-e43a-444a-9a1f-0f554dce4797", "comment": "Malware payload (SalatStealer)", "value": "ff2bee183d64b34db9c4c82d9dd35ea2faf6d0f8d4240adbb85f9fab68d77120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635821, "uuid": "d3365930-5262-47fe-a004-b1a377d2c5d8", "comment": "Malware payload (SalatStealer)", "value": "ec0081104853f522e28b01def3f7d832210b71c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761635821, "uuid": "fc3510fe-ad3f-45ce-9961-2aff767e6754", "comment": "Malware payload (SalatStealer)", "value": "d0b1b97c77b90dde03f84c1ddf04f1ed0b80cc369337910621c48778a38f7ba1d5d55a58d2cd22185faa968c4ba09154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635821, "uuid": "aec66bc5-1e80-47f0-9674-59529736511e", "value": "T173F5338731E5B758E399DCB91184EBAE2129592E94D2B2E33D5CC21391C82D3F5F2237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635821, "uuid": "74acf490-bc9e-46c1-8b68-0589c0368c7f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635821, "uuid": "bde94d73-06fe-4246-a290-c1bf2a326a92", "value": "98304:gO9GSkupMHoDOrwpm4CzjJqp1HKzZbatvI:gO4ip+xwpm4QJqpAzZbOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761635821, "uuid": "1c0b2a22-848e-40fa-9429-9a697fd2a4a4", "value": 3557888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761635821, "uuid": "2746ebc4-9586-41d2-85ba-3a4077adea92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761635821, "uuid": "6814fc36-1b6d-483c-a08b-59aa85b7f2e3", "value": "SecuriteInfo.com.FileRepMalware.21981172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00171364-b423-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761672286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672286, "uuid": "1b4d8717-b6e7-4403-8f69-d135a98c248a", "comment": "Malware payload", "value": "b8f7eae05263d922d4b0b040f4b0dfa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672286, "uuid": "c1e43171-edf8-4cb2-815f-be60eda088d6", "comment": "Malware payload", "value": "ff77971f7bcd30dfddf4def960e8f1f47eed72d91e68e722f4201d88f9d4a63e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672286, "uuid": "9ae609d1-4a40-4650-8967-4a5dd6b47cd8", "comment": "Malware payload", "value": "286213aeb9236a4bf00ae86cad5269aaf6892206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761672286, "uuid": "fe1ffd5c-a7b5-47d4-b325-1fbe107009a3", "comment": "Malware payload", "value": "0de277ad9dd13fbd29eaa110da0e37ba29e3ea16cb5cf57316e00abf8cd766c0ac9b4a0c65a25e1c9a139619afef9724", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672286, "uuid": "6b840a8e-84a1-43d9-8d5d-205ab2a470e0", "value": "T16AC3181AFC819B06D5D526BAFE1E118E331367BCE3EE7112DD205F2127CA91B0E7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672286, "uuid": "df28fd8d-f012-4149-9067-eea0fd4ed24f", "value": "3072:sQ/gNFlTztdgF8oRww9FJNbuULzaAArwDyFKwRgKJ6lDAh:sQ/QlTztdc8oRwwvJ1uIzaAArwDyteSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761672286, "uuid": "dfc3aacf-63f8-4d52-87b7-1268c43f00a5", "value": 121340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761672286, "uuid": "d74a8bc9-87f1-4b55-98a3-6f0960052fc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761672286, "uuid": "0f3594b2-5436-453d-8bb6-f43448fd2b7d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29c3cf4-b3fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761656775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656775, "uuid": "c888f930-b4a5-4877-b1b2-e7711561e540", "comment": "Malware payload (Rhadamanthys)", "value": "50ee66bb528a590e2edd14a9f7028933", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656775, "uuid": "6dafb92c-b0f3-4025-b3db-4549f682d4fa", "comment": "Malware payload (Rhadamanthys)", "value": "ffcb48628b81d7593a57fdd8457156e25c315d10260e6aa5e1d1e0f8d96f4331", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656775, "uuid": "bc532b85-ac21-4ee0-8458-52007c67d581", "comment": "Malware payload (Rhadamanthys)", "value": "8d6049131c06bc0abe43542c1b3cb1c15fe39c53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761656775, "uuid": "e28b1c43-0eb4-4e93-a256-21f7db48f52a", "comment": "Malware payload (Rhadamanthys)", "value": "d1fdf0e114412418e3c174a02e81700851a4080e527ad8caf0898d339685461b77bc0aa78f62c7fee0af8205c8878d00", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656775, "uuid": "8884c374-6570-4b0f-8ea0-2f8440a3fd91", "value": "T1A2A3E9A91E61FDFE261BB5CD8D83B990B82C7A26415529D0507DB2730C98F1B3EC58E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656775, "uuid": "6ef40948-79c8-44ea-b259-a68281e28eeb", "value": "1536:GDB7eKg20vX+jcfNsvKiLn7PDn/PPGK7H7mH7HXpdcIdqxdc0EKfppdK7xjrZOeT:GDB7b0xAnsror6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761656775, "uuid": "11dce745-ffed-42a3-9c71-ea71c81367d8", "value": 101507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761656775, "uuid": "1d021adf-5244-4199-aea5-8fd324cf2c32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761656775, "uuid": "e6475fc1-6963-4258-a5db-8c699a0e258d", "value": "invoice-1637482117.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }