{ "Event": { "published": true, "date": "2026-03-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-21", "timestamp": 1774137782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a6231687-5bf0-4121-8599-5533c14d3306", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802358ef-251b-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774093546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093546, "uuid": "28244b92-b81e-485a-98ed-e4fb4fb8814a", "comment": "Malware payload (SalatStealer)", "value": "aad0f0e92243e851672ebff9ec3dc5d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093546, "uuid": "f4122b4c-989c-4496-82ff-3a0081643f8b", "comment": "Malware payload (SalatStealer)", "value": "000056947961897b1ce18822fd4ba2b5ffcf9ec60e68c6b25e4490db553f4296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093546, "uuid": "9d3f26a2-7273-44f5-9fd1-60ff87e50072", "comment": "Malware payload (SalatStealer)", "value": "72f64dbba15b195f3414f1da5b174e9444d46273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093546, "uuid": "3a04cb32-7f7d-42f7-bb28-8a435f668c80", "comment": "Malware payload (SalatStealer)", "value": "96c9cffe28d7cb1cc089b513fa038a4a9a3c7a1c0e8116ec818332f7cfa0ef57855cbd24feda2c100b95388e4d88848d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093546, "uuid": "d69ca73e-bc47-4b7a-aed1-b068c8565ffc", "value": "T150F533C0395F6A48FB560F3A06D479712DFEC258A06DA3CDB8953120ADF5A87D73C922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093546, "uuid": "f2dc122a-04b1-4a25-9c4e-ddc5e2144bd8", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093546, "uuid": "43411a3d-be77-4b15-a150-f19af301b8a8", "value": "98304:U16D9u2pgGfI7QHduWv4DFoPqD3ds384S:U1C9uYA7kuWwFoPytss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774093546, "uuid": "ea4dd11f-0bf8-454a-a74a-1e2e99008c5f", "value": 3558400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774093546, "uuid": "df435659-4704-4814-9e03-40ba4a616cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093546, "uuid": "4dd1779f-c62b-479a-9b32-743cf56f0959", "value": "000056947961897b1ce18822fd4ba2b5ffcf9ec60e68c6b25e4490db553f4296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfb0656-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054027, "uuid": "740867a7-96bb-4c7d-b4e2-0542ad11b416", "comment": "Malware payload (PEASS-NG)", "value": "061c3f0b4e0bdf89afd99ca39ce3d869", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054027, "uuid": "bc8005c8-d677-464d-90cc-48afaae88375", "comment": "Malware payload (PEASS-NG)", "value": "00448202da207aa359b9187e7438f2fd7d642d9935a79b8812d5f72d4a3c7b17", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054027, "uuid": "b0bf19d6-58b0-48df-86a2-850ea29a0d9b", "comment": "Malware payload (PEASS-NG)", "value": "24e3ab35b322d26448986ed6953a48606a14b229", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054027, "uuid": "a5a8ef28-31bf-4f0d-905c-69f294ecda88", "comment": "Malware payload (PEASS-NG)", "value": "dcccaf049e2135ace8e7a3bd31b375381a0b7a2dd337388fdbef235fe0a96d136cd87d8f4ffb4f2c40f3e2784419ba8b", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054027, "uuid": "2dfeda77-e4e7-488c-8141-ea4efa6e6033", "value": "T101250A5CB80CEFB25025C97C1C951E7919A77F0F2962181874ECB70C77EC8AE60F66A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054027, "uuid": "a6e017cd-2a18-43ef-b937-7ebca0fffed8", "value": "6144:ucKGHFC3/C31C3PC3FJ3YCJaC3jC3KC3/C3nC3vC3DC3pCQUCJ3C3VOTosHps7t9:XNni2bI3a+DgVu9DDTYvDnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054027, "uuid": "451553a5-51ed-4959-916f-fa42a0efa3e7", "value": 975444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054027, "uuid": "a6e608fd-f399-43a6-b657-9aecc3d7c7c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054027, "uuid": "7e4363ff-8e5a-449b-90f4-f18a838ab29e", "value": "linpeas.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f463fcbe-2519-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774092882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092882, "uuid": "a7c699ae-2d28-4066-81bd-fb27a618c439", "comment": "Malware payload", "value": "c2a7754e12674b500d9a1a4130b4080a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092882, "uuid": "8e57a07a-282e-423b-a777-91ffc1c0a71a", "comment": "Malware payload", "value": "00980d7151cac5ae779e266fa8fd18e993910eb000780e1cb2c15b2ad0c14d69", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092882, "uuid": "3e017030-be51-409b-b0ff-95e589158502", "comment": "Malware payload", "value": "f2a68267e419ed41aa1e558d6b50b06d9678f878", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092882, "uuid": "0902d31c-3a37-480d-8c22-9d136688f5e6", "comment": "Malware payload", "value": "911f9138f69e41eedd0396d43abea65c17db1eedcbec11f9c620800612bbee4a1efe18d2789204ca524b5004d8f5819c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092882, "uuid": "7dd0d639-0fa9-4b94-b015-f37cb96f9beb", "value": "T10931A0111BF20328EAFB8F395CB673219675B90ADF519F9F029441985574520E878F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092882, "uuid": "5db1f9ce-7335-4e1a-ac5b-20e492841c19", "value": "24:8TTdmGjMDvSwjKUaWU3AcPWkp+/CWzlsCeUMkWx34z0KRnAH4I0WK6c/6Cab7Oaq:8tmeKpUQLl1eHJ3KTnIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092882, "uuid": "e57679a8-127a-48a1-b75f-c055187bd390", "value": 1545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092882, "uuid": "ce70fbf2-9426-4ea7-8604-df88588b2b85", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092882, "uuid": "4888b18c-f238-4c88-b784-37c1c73093b0", "value": "00980d7151cac5ae779e266fa8fd18e993910eb000780e1cb2c15b2ad0c14d69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7f82ff-2567-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774126100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126100, "uuid": "c7c13ca5-42cc-487f-a3a5-64c4e3728cb2", "comment": "Malware payload", "value": "289c48c2ab4f69ef796779e39bb6837e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126100, "uuid": "9935bd36-c5f7-4078-b0c8-62efa2bb7362", "comment": "Malware payload", "value": "010ca004c63f05c7669006aac355eeaa3684e23faa8f8abf7f739ea4eed92347", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126100, "uuid": "faaffb7f-4e2a-41c1-9581-4bfea606619c", "comment": "Malware payload", "value": "d9efa7e93f5ca74b548d73d09c8ebbedb9c7f7c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126100, "uuid": "7f962fc1-6301-4347-aa7b-909fd255aead", "comment": "Malware payload", "value": "b3928fd23ef937ad972f688f8d3412b2580f6f45da345c9d68b8126ea2fee121271119b9b99029bc03590d070ee91952", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126100, "uuid": "41321792-ff39-4281-b540-3e1fd55fee19", "value": "T11214A71E6E228F7EF66C873447B78A30976D23D627E0D644E1ACC1145F2029E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126100, "uuid": "5bbd1294-ba82-4891-beae-b21200f8a79e", "value": "3072:0WyEXeE5qnFKeIth/Jv0UtWCRKeQrEaGC:0WyceEEnepJtW55r5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774126100, "uuid": "35e7e524-8199-49ca-9718-a618c7e7a502", "value": 199368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774126100, "uuid": "5ad2a819-8ad9-4df5-b239-abf9124b8567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126100, "uuid": "6c8654fa-a3ea-4fad-9b47-2b09c019d96f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55279215-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057397, "uuid": "1e83a853-1484-4772-ac6b-37d59619f89c", "comment": "Malware payload (PEASS-NG)", "value": "329307785d42ff33b32e881b1e2629e1", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057397, "uuid": "be52455e-3e73-4404-9120-0373eae4adf6", "comment": "Malware payload (PEASS-NG)", "value": "010f51f6fc725a5648fc303aa9793e7399546bd6e47fe1618eafe7b6bfcaeea7", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057397, "uuid": "fcd5a5f1-434d-421a-bc82-0830e0ab5c2f", "comment": "Malware payload (PEASS-NG)", "value": "b5611a70a2f2b5edcf51d1d55c917ae1122a97f4", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057397, "uuid": "ba362acc-b3e6-474a-b48b-bc0a47de43b7", "comment": "Malware payload (PEASS-NG)", "value": "a1084c17430a01de8646a55f1890dc5b31170d3288eb7b7681c87fce9b27e66c1b879151233e13cd066654cb03614c63", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057397, "uuid": "67e3b2df-17a7-4854-97cc-a66370916b15", "value": "T1BDA6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057397, "uuid": "c7d47505-9c27-4c54-88b4-04e37297a14d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057397, "uuid": "57ea7478-10d5-4cd1-91a3-029dd0e85632", "value": "196608:JPxdtVBFUcwti7TQlyVN8iNISRTRmW5Q/:VZHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057397, "uuid": "7eeb0cd8-bdfc-40fc-94b4-2d92cb47e22b", "value": 10171904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057397, "uuid": "d3ec67c8-6c92-4bbe-9c0f-c691ba69fa4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057397, "uuid": "61d234f5-9c61-4c72-91e5-09ffde5ca67e", "value": "winPEASany.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213ceebd-2518-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774092099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092099, "uuid": "7280dc74-1c40-49e4-8821-b023786108ab", "comment": "Malware payload", "value": "206302408b9f22dd5badca9951ffc9ae", "object_relation": "md5", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092099, "uuid": "da5276fe-9028-4152-94f0-661704cacf03", "comment": "Malware payload", "value": "02ea3563b3d105d5eeeb7ea9698e26311e2271ff86080d68afb4aba1c444be1f", "object_relation": "sha256", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092099, "uuid": "9c0b4764-ba75-4038-8f3d-ba73d7cbe925", "comment": "Malware payload", "value": "6326e7608732bf4a0306096195cac4ead5f74ed7", "object_relation": "sha1", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092099, "uuid": "68fb5d08-e1ec-48d1-affc-4eafe5dcae20", "comment": "Malware payload", "value": "931ac6480f06bb3613dc6a50b8624ad948e91428b985914d91f91c729c7a78b1f4f612eae68eaa922f6e542dc2e1acbe", "object_relation": "sha3-384", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092099, "uuid": "7e99fc64-cfd2-4806-af7f-8ac900fac4ab", "value": "T17C72D0503AFF3D91DD8459BC82C78FEC89E39A09079027F8860928F969CD34516EB5B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092099, "uuid": "e0e6428c-8be0-450d-b51e-df9b4bef4eaa", "value": "192:9OXrd8f71tJ5n22BOg1LU3vmpuKDRV/DbnZgi2BmkOpI01L1+oxyNMWUHCofNaqY:9O5ah2oOg1CvmpuKTBz5hq091+NadTM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092099, "uuid": "33ddf698-74ec-4d6d-929a-540dee9890df", "value": 16333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092099, "uuid": "9c23bca5-d771-40ab-9fb6-e2965fc60d6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092099, "uuid": "9381d0ad-c6e9-439d-bd24-d8f8240eee87", "value": "photo-139476222.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cc34e2-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054042, "uuid": "ab21c6ab-5356-4cb4-91fd-df6ce46fff47", "comment": "Malware payload (PEASS-NG)", "value": "ee86d48b304a7c8b724352827cb5072a", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054042, "uuid": "2e83bafc-4edc-471b-9711-4b2ba5e49315", "comment": "Malware payload (PEASS-NG)", "value": "0393e898f4425195d780346634e619b80f283a8223b9724db56dee87afbba486", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054042, "uuid": "436c0c20-2a59-40c0-9d95-0938b946a11c", "comment": "Malware payload (PEASS-NG)", "value": "7457e0ec35200ba5cd0f8501366512aa9937e1b3", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054042, "uuid": "16746b52-3db0-4ee5-be34-3341c50baf9f", "comment": "Malware payload (PEASS-NG)", "value": "ab5c1d5f79f0c2991724c2095b9540faba0129733c67c212de1253e17e295a384309782dda26fc45342adb9c38d42191", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054042, "uuid": "c6d24a55-bfd8-44ba-a767-01e49ba4ec8f", "value": "T12D06BF9ABD6C3940D649273E5BE907C1173DFF4B2F1297173944B7AE1EF221A8A91230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054042, "uuid": "54cb465d-9303-4ed1-b38e-f6450cadf704", "value": "98304:jpBEHaKKNdXKPns1AyeOO/NyTK8G/bu75RsxEBk4N7hvdYelTjYfdmo4ijDVIx+X:m7/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054042, "uuid": "c3a76dbe-5260-4192-9be1-78848dad86bc", "value": 3811458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054042, "uuid": "bea259f7-0ab6-450b-92da-976ece0c7cfc", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054042, "uuid": "451529b0-a813-4b19-9a0b-31c25d02c108", "value": "linpeas_darwin_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5d8856-24fd-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774080625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080625, "uuid": "aaa58241-da25-4e97-bc4a-5329c5ebc55d", "comment": "Malware payload (ACRStealer)", "value": "7b46f6c27d00977d230433f328ebcae5", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080625, "uuid": "b31d9599-3d7c-431e-980f-bf73513bcbcd", "comment": "Malware payload (ACRStealer)", "value": "04a68582f89411908497308a591ec680ece61f60ae477eafcc20f4f03d8351bb", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080625, "uuid": "869a8f51-5fcb-4c0a-81da-75359d33fdd1", "comment": "Malware payload (ACRStealer)", "value": "e52d9e24ce11833f072349f5e8f2acf32bf5acde", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080625, "uuid": "3da32615-465e-4c8c-99a2-43faf7ee54b4", "comment": "Malware payload (ACRStealer)", "value": "99a50ec42384556abe919cf1b5170dc92b4496172c31fed5404440e2ca7f22903cf18eddeccf446e5449ffc249b86449", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080625, "uuid": "7b384a0b-5e7f-40d5-9ca8-d236a532c99a", "value": "T17A65284A5EC166B3D6E381735906B893FE394456266BDC1231ED81AD23BFDB893BF010", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080625, "uuid": "ba783908-1b66-4c0e-919c-feff849c1775", "value": "0e72219096637c11871e5a756f67717e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080625, "uuid": "d9fe6ecd-0c19-426b-81e0-add86f2d09a2", "value": "24576:ZR7qO19ITfbUIQstjoqjDV8RGQpTU2kJsLUO:77qADLUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774080625, "uuid": "4c075212-0c7a-40fc-918e-28d41631ef90", "value": 1421824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774080625, "uuid": "2d64a726-c4b7-420f-afb4-4614a85b6782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080625, "uuid": "b912a7ae-36e4-4064-a370-9d1248760c7c", "value": "04a68582f89411908497308a591ec680ece61f60ae477eafcc20f4f03d8351bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c5cdd8-2569-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774127238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127238, "uuid": "066150cd-88d7-43c6-9c22-e2717b01900a", "comment": "Malware payload (Mirai)", "value": "1db719d0b61a9f5537ce611f40e28033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127238, "uuid": "7886aa6e-57d6-43a3-8f4c-18f070c8ef0e", "comment": "Malware payload (Mirai)", "value": "05a358fc778759e813152f157c8cbd8b55c7542e69ade36460b42bc637959952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127238, "uuid": "a70e698b-dd87-4393-bc16-c310f5fc0d2e", "comment": "Malware payload (Mirai)", "value": "903b9a11ee91f634ec3988caacfd84954983e059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127238, "uuid": "1e58be61-9ae1-427c-847d-f9723c3d39a1", "comment": "Malware payload (Mirai)", "value": "5dd1e25cca2e424c8e01e2a12f68e4b5126e82fbd9c9009717d9a2ec5a566d3d4005dca906d4715736bad3dd5d6c5997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127238, "uuid": "ecfc0bad-6593-4f1b-9ca5-0dddad608b59", "value": "T19EE32B45FC509F26C6D226BBFB4E438D372A1758D3EE720399255F203B9A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127238, "uuid": "6bc89a60-3d45-4551-b6d3-c8fab9bb4003", "value": "3072:VyfLqaAd2fasjCArzGes5vBgAshgVbp1O:EfnCkCAries5pBshgJp1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774127238, "uuid": "cc0e18e3-0836-42c6-a49f-c964798090cd", "value": 146112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774127238, "uuid": "a67efb2f-6618-4bc6-8c1d-b5624b344c7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127238, "uuid": "99c97d06-424b-4bc0-a9df-389442b198ca", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abda20f9-2518-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774092331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092331, "uuid": "e085742c-84ce-471a-abea-e2c6ee538265", "comment": "Malware payload", "value": "f2dbd8ea8a9dbb7e8f4aae3d9329e558", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092331, "uuid": "6c917afc-eb5f-45a5-976b-7a8ddd4aa045", "comment": "Malware payload", "value": "05ef1b11b7930fd393b607b1aed620491041671f2ef668592966edc7d6a24f9d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092331, "uuid": "e8253404-d6c1-4168-a825-47e0a204ff5a", "comment": "Malware payload", "value": "ec82fb16fc5b1465d35b3054853c5153f199c576", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092331, "uuid": "272a187a-d8d2-4e3b-8296-1d3bde12c609", "comment": "Malware payload", "value": "91117e9c465460992cf5a53d265d02e57f142a115b41086f4e870dcaf7bd75cbbf4ace1f6647bc3d96f522ddf1971e7b", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092331, "uuid": "b1e6426f-0381-4961-8bb5-934d609e450d", "value": "T1FF64234062EEFE55CEF0862850EF0656939D5E1D05AC8E84339B8D13F79EE45E3078EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092331, "uuid": "493bee7c-c5d7-4cc8-bf0a-04741fb4e930", "value": "6144:JU544fLulylEU7xAuwStekYbi49p2TJCK+UJ00VSf6zRrA1hqyNAIc:JH4fylCnfwSteFi4H2TMI0QRsV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092331, "uuid": "ae7c2444-9b6b-4404-9629-39911ef88435", "value": 319781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092331, "uuid": "c594633e-424d-4f2a-8d58-afca7b3d7599", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092331, "uuid": "67ac7222-44d0-4280-8304-4102b20c1700", "value": "photbookguest.pro.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8268f3-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057360, "uuid": "ea889d37-7962-4d50-8e12-a3264f39574f", "comment": "Malware payload (PEASS-NG)", "value": "b9b106fe2fdd2b21c8eeb54da86802f1", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057360, "uuid": "492e3bd0-465a-4be4-9279-01e32327ef13", "comment": "Malware payload (PEASS-NG)", "value": "0616c34bd21726661f9ec40e50d75d7e2a921f600f3a8c9d322020d04c305e76", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057360, "uuid": "38432d21-2891-45eb-9776-e068d8f14ae5", "comment": "Malware payload (PEASS-NG)", "value": "bac99ac76da76b0872edf07664d221c60c42ab0d", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057360, "uuid": "ec83ed6b-878a-4fa7-b17f-90105d023ac9", "comment": "Malware payload (PEASS-NG)", "value": "3f58137dff6dc0f7fdc9c2654bc54eab449a58b413d0a4ba4c0da53d46fff8f12eae87cf09521235576d471a61da2aba", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057360, "uuid": "4df61cf0-4d40-4efd-b8b3-27c9997f421f", "value": "T1E206BF45EDC725B5D6031A3648EF56DB0B2CBF0B2F319F83B9443B6A657749B04B2228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057360, "uuid": "4a4b427c-8a96-4bed-940d-7253cb3edaab", "value": "24576:cPDH86UBLM2wB+StokUqk5z7rcOEVhEFgorGvwkpPg0s5tEnyVu3jyV+6WYbqBst:cmhiUhF0R+FVhc5mo/b1cpqRkzmE6Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057360, "uuid": "305f31c7-7930-45f0-a492-018d4c4d8e4c", "value": 3714212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057360, "uuid": "9f4f93df-67ae-40f0-9d64-babf5dbfbcad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057360, "uuid": "525a4d1c-d8a3-4723-b4d3-b2fbf483c322", "value": "linpeas_linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d4547e-2513-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774090065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090065, "uuid": "91c62555-64f2-4948-b61b-f27c662c0914", "comment": "Malware payload", "value": "c75dc84c096b11a2ab0d15b9faf65923", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090065, "uuid": "fbdfea7a-cd2a-4a02-bc03-56303a816573", "comment": "Malware payload", "value": "067d76406bcd95f84fdc8106ac1d110208d28883f9d1f09445cbcd357f1d9818", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090065, "uuid": "ca8915ea-6de8-4f1a-a9b4-4c3e4f855de7", "comment": "Malware payload", "value": "701ad957093e0dbfb80064477d2208d83df6f14d", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090065, "uuid": "7858b262-984c-41ad-9627-04f438195c55", "comment": "Malware payload", "value": "271dd411e1197a5f745ba976464bafbc2c52ff704907a7d92d5d9a9f4824ea1bf612699c5c5308c9484a3c833aa4b1be", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090065, "uuid": "5fffc32d-4bb5-4cd7-8006-727773ac9120", "value": "T1A423D03CD008B8A8C4938A7DD51906F7F20A4582F3826A9F1465F3DD8B559AB075BE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090065, "uuid": "70264927-936a-4df6-b0aa-909f3980379f", "value": "768:wKidL+tY79CyDr8mOzK5wHSgKZ3j2n/ICRHz0SEVCLAzn0pp3Lj+/t/0j0nwuC2:wKs9Jn81Hg2n/5RYSEVLznClLK/90Qwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774090065, "uuid": "765224af-aabe-45a2-9877-8378a7949eaf", "value": 49769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774090065, "uuid": "1e35e85f-5922-46ff-aa94-34b1d497fe04", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090065, "uuid": "b31dfff0-d2f1-40ab-8a21-edea1a606fc1", "value": "c75dc84c096b11a2ab0d15b9faf65923.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0f5a2c-2518-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774092062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092062, "uuid": "3e0b27ac-6d0e-436f-995e-511dd9173848", "comment": "Malware payload", "value": "0086c6861a813fee078304f28845bde8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092062, "uuid": "e2dfe313-e004-475e-9107-5de3f3750360", "comment": "Malware payload", "value": "068e34ef7cb67e5a8d34b4d6977cd69be00d52b12d119413fb00d9b68dbc63b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092062, "uuid": "3fd90231-9059-4977-b470-f2cadb82ed80", "comment": "Malware payload", "value": "251593eddce2ccb8aefd51ea02898f54a9882715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092062, "uuid": "7d070dc5-b9e7-4155-9d63-849273158436", "comment": "Malware payload", "value": "1e7b81f43aa200447244fc78a7b071e443513665169300f8958a803bbdd05021213b206d0393c027cf0a1c384deb467b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092062, "uuid": "86f0342c-dd9c-4f69-b5ba-f83474e9e80f", "value": "T13FF7338AF6FB6ACCE91115BF460DC329E636C3CF25AD32869D8D148F6544EF84C1C61A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092062, "uuid": "0c2ccfd8-a374-4af4-b301-07be3d0b3b74", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092062, "uuid": "09b338d5-bde8-4edd-ad90-2391dc0fb59d", "value": "786432:AKgLxcZ1uHT5sCMqmzOOXcuQVxQpUcl0YjuetDq42eTPNtMf0Pq0pl2Y5xvHHIoY:A5Lxa1k9sCMjzjMuA+P9t/PCg1nI9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092062, "uuid": "da3552f7-d400-4a4b-b302-12b573cdb86f", "value": 72377544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092062, "uuid": "c8148fa8-11ae-49ec-a238-972e6c416846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092062, "uuid": "1e0f64ca-ba96-4419-a959-44f924c7694c", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ac7146-2507-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774084917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084917, "uuid": "bd5ec772-1e3e-4ac6-be59-22299d7ea779", "comment": "Malware payload (RemcosRAT)", "value": "a1059b35c1470489ae80f74da5be01df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084917, "uuid": "80bb8a43-7f39-423b-af27-025a0907cdf9", "comment": "Malware payload (RemcosRAT)", "value": "06ebfc6b06f389830e352fb57f814b4b80fe12236c0451681b06e9fa4172091f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084917, "uuid": "7f5b867d-6e37-46d6-aa9f-3359a1aed4cf", "comment": "Malware payload (RemcosRAT)", "value": "4eb218e70a08a53db4081a7e04c2ec4f4a054dbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084917, "uuid": "21baa4b3-bc4e-490b-9a03-339508a3b796", "comment": "Malware payload (RemcosRAT)", "value": "583e5db35fc3432af5f82ac8068ebbcde8d5c840559936feb5d986815b81dedafe281e6125e6709e57f813254594da21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084917, "uuid": "148056ff-622b-4979-acd0-21e3448e3b41", "value": "T161667B0A62EA41E9D0B2D138CD5785AFD672BC554B3297CF0171BA0A6F3B2D08E39735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084917, "uuid": "e698cb7e-a01e-473f-a406-14377d900f2d", "value": "257670f56ff8877f9177ae6446e88b54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084917, "uuid": "690b898e-ae73-4258-9471-d7a3f8f2d0e8", "value": "98304:YaItDwIhUK+TDvs235anw9qLGNG/pNyzp0BMA:mxu3TDs235yqHspV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774084917, "uuid": "4b5003dc-bb9f-4db0-a6df-75aa0a4ebc1a", "value": 6873656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774084917, "uuid": "c093ae8e-546b-442b-b619-24837b09b854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084917, "uuid": "e3808b92-eab3-4c71-bc16-31f51b71592d", "value": "2026-03-19_a1059b35c1470489ae80f74da5be01df_glassworm_icedid_luca-stealer_njrat_stealc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90ee0bb-2539-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774106554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106554, "uuid": "c7385d03-ecae-4655-bc8d-70ad75af1b51", "comment": "Malware payload", "value": "c4c249ee87fbda08834e5883f8626db1", "object_relation": "md5", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106554, "uuid": "176fe0a9-84f3-4464-8361-199523dcf566", "comment": "Malware payload", "value": "070402c2c531aa3a87b9ccd080532a51d17b01d982b205fc4487246d58de8913", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106554, "uuid": "1a63d2c2-a43b-4d70-939b-5a5e2d59f3f4", "comment": "Malware payload", "value": "95bd38a6d71d4af22a05dbf1f4b316ab259ca717", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106554, "uuid": "ebd8e56e-ecc7-401f-90ad-9416d16c873c", "comment": "Malware payload", "value": "1621f3331f684b5398f679fb6bd17a107fb9f763a0ea554468c5c01bb7ed7ab27a2b51c1c7f0aa3d5d775e4bb88582bc", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106554, "uuid": "42bee1d7-14af-4499-b507-675fad786cbb", "value": "T1E8B162903290797023F4CA29879DC26AD54732636E70269070EF6E5D1F38976E37B73A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106554, "uuid": "cec5d2dc-e348-4661-a6ad-cb58e15ff6eb", "value": "96:moCBAUyj70j1F8AhKRKhIREvYDYzQ3QrC/vIys1kGiLzlysi7Z0v:m1BAUyjwgAhKRKhIREvYDYzQ3QrC/v1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774106554, "uuid": "3f60f7a0-9eb1-42b0-8253-2947f919db15", "value": 5112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774106554, "uuid": "1c227d4c-5831-4b56-9b07-9f51a1ed9118", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106554, "uuid": "181260da-bc96-429e-8f33-4fa6bc24f5ec", "value": "070402c2c531aa3a87b9ccd080532a51d17b01d982b205fc4487246d58de8913.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb08efa-250a-11f1-a769-42010a9c0008", "comment": "Malware payload (StealitStealer)", "timestamp": 1774086432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086432, "uuid": "efaaa7eb-9081-4b3a-802c-f5bfadaf1ab7", "comment": "Malware payload (StealitStealer)", "value": "c1b096840802528a58eca102511e90ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086432, "uuid": "c25887db-1aa0-4297-bac8-4abb00f1d8cc", "comment": "Malware payload (StealitStealer)", "value": "07531d80301a5a19ba1cd76e697a485a4e7d233a2edabf16953aa2b0975486cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086432, "uuid": "898973d2-61ff-4a2d-81f8-e5a463a9599e", "comment": "Malware payload (StealitStealer)", "value": "171a88c5be1f2dbfaaf38e8868e074e9ac804c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086432, "uuid": "ff9e56bb-6c0f-4645-a9fe-ded494be01e7", "comment": "Malware payload (StealitStealer)", "value": "6cfe1cf7c1c4ae8463016a5b2a340fb5cef994e57add540d96733892e630a48e89c447d398bf19a6e03a5248955523c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086432, "uuid": "f60a86ed-e45e-483d-b7e4-308889a1a1e0", "value": "T1D71833910AC41083C69D9F7F5D96BCAD8BE455E82C4F7DF42ABB4384B426F4F1A63025", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086432, "uuid": "fa2ee4c4-bede-42e9-a7ec-41d4a9ad860b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086432, "uuid": "090c413c-baf1-400e-b416-bff2ed7fd229", "value": "1572864:gD/YqPsDQQIn904C31TM+YOz2wR90wlHDIJF8+/qpatCj9RwSMlL7LLiVjMoRTKC:gDbPsDQVC4qhouxR9PljIJy+Aawj6v+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774086432, "uuid": "089c1685-c706-4ad6-9241-0b7363a9ee15", "value": 87517921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774086432, "uuid": "479ca8b5-5c68-43ac-86e8-66c3708a5968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086432, "uuid": "6f219d0f-5413-4fb6-8748-8d6095f2ebd8", "value": "18c695e53103a5b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64626c29-255d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774121847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121847, "uuid": "8a297bee-b6c5-496f-8ad7-d125c9c344b5", "comment": "Malware payload", "value": "a38e90fe72448ba4c32df2b2d22ce19b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121847, "uuid": "08a63365-485f-41d1-ae7c-182d89d43b6b", "comment": "Malware payload", "value": "075b3caa3a754c23f929a1591c6b333c7da1080a5fdf8ea2a3497d1505b60dde", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121847, "uuid": "c3b18f74-1986-455b-ab7a-f8642fa5b600", "comment": "Malware payload", "value": "dce87a06de47fb420a8b19819feb26cbe35c7a5a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121847, "uuid": "fa2f06c1-ade2-4883-aed7-7db8bad76729", "comment": "Malware payload", "value": "2af183099e2f084a2c980007442dba749835849be023b346c8a2339076d5bbbf5f7729c20d9c546d1d654f9ddb006291", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121847, "uuid": "ac6e83d5-75be-469c-99b3-279b61b1db43", "value": "T10112567DD9E1FDD0876F23D079DAEAC6209B8A13AE6E2E6CD2C404E10B502559BB914C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121847, "uuid": "35a8ffb3-89ec-4c50-8722-23bb0b90f1b3", "value": "192:7K34jEMBB9EX6Qb3goNDMy71Mccz7dzyrEgb83S:7K34jEMBBmq0wMe/Qrrbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774121847, "uuid": "0c43b554-656a-456e-84a8-3d8e759dac2a", "value": 9044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774121847, "uuid": "c4216038-ff31-4295-ac6e-5f75c1c7266b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121847, "uuid": "3f7b8df0-f631-4ad6-87b8-286ecc50bbd3", "value": "Xeno.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73181821-2567-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774126166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126166, "uuid": "f719a7af-ab02-4797-92f3-a7a17b12f703", "comment": "Malware payload (Mirai)", "value": "4fc67ac5eb60f47ad787a573deff86c6", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126166, "uuid": "1011336e-d5ee-4f47-80ce-23977db4e161", "comment": "Malware payload (Mirai)", "value": "07bd1fa18471aa98a22e0712a186c28c8e39c18789be8c370351b321c29e090e", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126166, "uuid": "0eb708e1-af9c-4f4d-b0b4-9663212671f2", "comment": "Malware payload (Mirai)", "value": "1f18272f790857716c4c24c14b72cf20ae44b044", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126166, "uuid": "1af0410c-a73b-4b18-9f99-e3c4809419d1", "comment": "Malware payload (Mirai)", "value": "4e434bb729a3f4dc76a7ac2ab038a562feecd476dfdc07fd0871e743bcf6b70fa9af43b2ce1edeea54faecf23e53ab4c", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126166, "uuid": "1c2bb368-9b24-4683-b733-ad86013e67a6", "value": "T151157D9DE7CBE0E1F66300F1025EDBF70534A12A5013FAF6EF49266274327616F5A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126166, "uuid": "db9f5d40-3e49-4724-81b6-013d06176e88", "value": "12288:Qdepp0JhA68DyliuhgFhtPFe6TdAHacR2rJH+azsu+m5OQDPyt/wzqzvKgRQgALu:1EJ2DDyAuhgFhy6ZArR2deosu8QYo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774126166, "uuid": "0a9c0142-5d2d-4f78-a3d6-d284284edf9f", "value": 935576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774126166, "uuid": "8141841f-1dc7-4af6-af2d-db2ceeeb5568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126166, "uuid": "187ab3c3-dd4e-4515-8848-dc076a428943", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ac0285-250a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774086338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086338, "uuid": "974ff7fb-efe8-4890-b365-3d8d64cf5af0", "comment": "Malware payload", "value": "b0043d154d476779204f5a7f202a8e09", "object_relation": "md5", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086338, "uuid": "1fbdb491-8fbf-48d8-a909-e66a41962817", "comment": "Malware payload", "value": "092e54fd7d5918f7b096987054577b73e1e65775dabbc7fa742cb25e0c98b1f2", "object_relation": "sha256", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086338, "uuid": "e1ebcf68-d4d0-490b-8136-a7ae2241c170", "comment": "Malware payload", "value": "860b52a34a2bf16e7af899cc91e92e264b1f359e", "object_relation": "sha1", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086338, "uuid": "723403dd-f70e-4cce-b50f-850f475c36d5", "comment": "Malware payload", "value": "179eb8eab54eae1facb308f29d79523ae8fa88cc479a8eb31177e285cb5dbf4f978ad2613c5852eb4012534918994c2c", "object_relation": "sha3-384", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086338, "uuid": "e6b5b9d7-b250-412a-9ece-025708d0be4a", "value": "T1B56208E757BC2227511781E56B74F7A1275E801BE8124E2AFDDC8E688F85D148EEE308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086338, "uuid": "ce73ad98-d94b-4a4d-a188-76e0586a6778", "value": "192:xhnmEsWArw8zcSdxxsra61jHAV9AhV6eAVMNT75omjYKA8hdp3YNTH/lCWL3rQk:xYEsWAbsDHAVq5AVo5owYK9dJqcMrQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774086338, "uuid": "390ff110-292d-4d00-ae66-e276baa3b472", "value": 15063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774086338, "uuid": "d71ade2c-5378-49eb-bcf5-2e4dc4463b4b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086338, "uuid": "b0ef6201-3de7-4290-936b-56d0a9ac51df", "value": "zomia-qrcode.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10420b4-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054088, "uuid": "37cc98c4-6deb-4f24-b745-4d77776913c5", "comment": "Malware payload (PEASS-NG)", "value": "e035511bf5f5ea25b12130b35acf531e", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054088, "uuid": "603d619f-97a9-4ed1-b17e-a375063f4ad8", "comment": "Malware payload (PEASS-NG)", "value": "09a356e0de2b2b6125de01d67f28fdc2f533656867748aaf889ae3d675c2b86d", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054088, "uuid": "34c253ba-6073-47cf-abbd-9552f3b636f2", "comment": "Malware payload (PEASS-NG)", "value": "7299b068f05404e2105a515948f8529467af451b", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054088, "uuid": "b2438298-d2db-4916-8d26-256e7207fe16", "comment": "Malware payload (PEASS-NG)", "value": "667a944fb7cf312e0935f3fe614232bba228210e521f15314c9c28c045746650d4151a1b089dbf11fb70b4a7be528b09", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054088, "uuid": "2e6ea34e-fcb3-4b17-ac4c-93d569bc9468", "value": "T1C97338446817763B927BC2390DB61E6011F75F4E36A6232A347D719E8FB208D7819CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054088, "uuid": "bec83523-1edc-42dc-bbaf-90a419698c08", "value": "1536:ozcD2mmmyBBR0LhPa53Mqfiiiiii28BX+p5qiiiiiiiiifiiiiiiiiiiiiiixqG0:6cegDjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054088, "uuid": "aefdc629-b6a4-40c7-8c9e-f5cf84952494", "value": 78885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054088, "uuid": "58274b60-15a7-402b-82a4-f5d7b839fd95", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054088, "uuid": "b46587da-9f1d-4b8f-a10d-7d2b9fd9f70f", "value": "linpeas_small.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7a21f5-2507-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1774085036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085036, "uuid": "185f4883-cceb-47eb-8089-04f28e0e580a", "comment": "Malware payload (BlankGrabber)", "value": "ff443c3e2a25f724d5c451c1116fce27", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085036, "uuid": "5524ffd3-1ed8-4ebc-a365-df8e5071a5d7", "comment": "Malware payload (BlankGrabber)", "value": "0a46c185a25b50311e80569b960f75178b233c402472f1e38aafa5f2b885627e", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085036, "uuid": "1d21e177-9cf5-4e19-b271-22cf71f96226", "comment": "Malware payload (BlankGrabber)", "value": "813108169608f089be8fb3b06cc5015713fd09a7", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085036, "uuid": "3fcba3ba-b952-4e8e-b74a-ba84501c626b", "comment": "Malware payload (BlankGrabber)", "value": "385b5694fe27b59f9f66b3f9146a77670e7dd811fecbd59c5e7f4a270484ad2fe36e63d69263ffddda65dca860541642", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085036, "uuid": "3ac0673a-0f21-49bc-aa48-ebdd43c52207", "value": "T1E9F733258441067FD8628332B9A1D101CD21FC751779CAB69FCD474DFE7BAE89832E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085036, "uuid": "ed9f32c5-5179-4d76-b42c-8d3097a3666c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085036, "uuid": "a8a8e6f4-f4c5-4cec-9b90-80222e8915e7", "value": "1572864:vfjqEz0CBvgngQx8QcO7Ri3Y7gGYBPl19Gf21HbwIFiEBhEN:Td0KvgMP38edGfWwCN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085036, "uuid": "21f8f242-279d-47c3-9f50-56a2422f5923", "value": 76525084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085036, "uuid": "83954b40-f3da-4d56-bc38-f0ed9fdb3468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085036, "uuid": "17cc463b-1c89-4e9a-9764-80e240f4d563", "value": "153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3defdfed-2546-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774111904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774111904, "uuid": "16ede7be-24b0-4b90-9cbc-e6395c285641", "comment": "Malware payload", "value": "5d6c72df7b73439a2e4b053391f06730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774111904, "uuid": "9548ac44-44d6-436c-ae4c-8f0a267ff189", "comment": "Malware payload", "value": "0a4824698404f31c692ed4867716efa290575c277139f291a23c2a52d1a5ac32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774111904, "uuid": "16f4c577-4d9e-4ebe-bad4-50aec708145c", "comment": "Malware payload", "value": "243c26d1ac1970d272de9a05f553f0ca93718836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774111904, "uuid": "dd916b76-5e92-4577-8f6e-f33567e4423c", "comment": "Malware payload", "value": "89b1621cac1441416bbdde91fec7b9bef3e92e30359cf01cd512e86dc74da6b1ca0e941e1bcd8bdd73a21bfe738583eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774111904, "uuid": "0d7ca56a-3f75-47db-abf4-51f069b45868", "value": "T16C57F112B9A0D034E4A33231A53DB3BD8A35BD615B3A86DF93943CD42F742D2653936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774111904, "uuid": "ee91cfcd-c92e-45bd-a23b-94ff40c72ee4", "value": "c0725c2e3deb6acc14a33fadee0f7a71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774111904, "uuid": "8610e163-fdae-4a0b-bde9-9ddee59533ae", "value": "786432:cyKo1Msu7yEhRBY+Z2MvJ4E1SZ+0Jm2EFt6oW2p5VI:VKo1M5t37Z2M+EsZ+Gm2EFkodm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774111904, "uuid": "848f5b52-4ecd-4be8-8877-0d387a64b577", "value": 29373608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774111904, "uuid": "24d5824c-88b0-47bc-b63c-021cc81d837f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774111904, "uuid": "9e05f7e8-7773-4ba4-bc81-66587e35f4b9", "value": "qishui64x_SETUP_QS_192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75a8417-2510-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1774089022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089022, "uuid": "b11e1848-6d2a-4b0f-af81-ceffca2cf4f1", "comment": "Malware payload (RatonRAT)", "value": "761edf12d3a9bcafbc7a1db77e324241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089022, "uuid": "b5520e8c-5606-428f-9c6a-5cba2e60a380", "comment": "Malware payload (RatonRAT)", "value": "0b416f2db255c5c45d5631030a82bc5501d7d890bddd911020fefa74daa31f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089022, "uuid": "f15eb549-630c-4782-8070-22d5c83ece70", "comment": "Malware payload (RatonRAT)", "value": "28e6306524feba79041731d5a99ed58fd184a1ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089022, "uuid": "ca55f6cb-87f5-40f4-a89f-c81777862f07", "comment": "Malware payload (RatonRAT)", "value": "60c3a8ff029aff22c416d1fdfc684391b8a23e1feb4b1c09190a99d725e155a453e16ebe41937c599e3875b8e2c37c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089022, "uuid": "a7377d59-dc7d-43d1-8b42-90766671c98a", "value": "T1CC06DF44BBD4CA1BE5AF87B6B4F246120775EC15E792E70B199037B81CB37042D293AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089022, "uuid": "1bd3d9c2-7590-476b-a587-12f13e147242", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089022, "uuid": "72322850-3295-4dde-a929-01686a6da8f1", "value": "49152:2VUBAJWgVUlsHjkmiGWU5+5WeLGpMZ7iKPfg+DTeC:iJWgVUuHjkDGjYQeqpgmd6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089022, "uuid": "37c395cd-9cc8-452c-b909-e70b6e0b6002", "value": 3692032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089022, "uuid": "69cc25e8-6148-49e6-9d0b-d1e2068f3128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089022, "uuid": "8c37a0cf-ab1f-412d-911e-a2c11a09b2b5", "value": "761EDF12D3A9BCAFBC7A1DB77E324241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f595f05-250f-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774088391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088391, "uuid": "417e69fb-52ba-4098-bd58-7297331c125a", "comment": "Malware payload (NetSupport)", "value": "d44ba6901624be8dd40f97290370890a", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "coastal-dwindlingoverlord-com", "colour": "#0FD9B5", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uuaa-faser-tech-info", "colour": "#098567", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088391, "uuid": "8a09fe20-02b7-494b-b6c8-e52188502bb5", "comment": "Malware payload (NetSupport)", "value": "0dadd95833b6ab8416fcad6386c8816ddb0abd0a3a1e74c8281ea0d96361a16b", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "coastal-dwindlingoverlord-com", "colour": "#0FD9B5", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uuaa-faser-tech-info", "colour": "#098567", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088391, "uuid": "54bdad63-f50f-48c7-a503-34f0035166f3", "comment": "Malware payload (NetSupport)", "value": "ad0bfd0cea1959aa2668fe2fd276ee1d231ff680", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "coastal-dwindlingoverlord-com", "colour": "#0FD9B5", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uuaa-faser-tech-info", "colour": "#098567", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088391, "uuid": "fd568913-6b2e-423f-83cd-4aefee8bf2e1", "comment": "Malware payload (NetSupport)", "value": "0f1fff7a0d05541fc57593d8560e9248a6a284594e90e65621af0cc0f6c07a0d5fe12f7010c85c4539938679a0954d64", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "coastal-dwindlingoverlord-com", "colour": "#0FD9B5", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uuaa-faser-tech-info", "colour": "#098567", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088391, "uuid": "5ffaa743-f744-405e-bf3b-564b034ff91d", "value": "T1BC3633DEF60C8375DA1CE1A1811F7D21AACC9521FF6A44DA436CCCEBAD05B8C77A4129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088391, "uuid": "4d833d92-277d-4d68-b830-c5377f0cda35", "value": "98304:OtBqG/IVtNEB1ixyOqQpQvjfcGITIVfMwVbl/qZ1icAoiS/ZOWLrTmDSO0l1Dn4v:OtKeBkxzqQ268VEIAZYroiS/9rnO0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774088391, "uuid": "2b617b3f-e4d6-4520-be9b-4d535318add1", "value": 5333630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774088391, "uuid": "72709de3-7928-407c-8f02-602caf83ab49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088391, "uuid": "c9d72e2d-9d9e-4f06-a385-920a677496cd", "value": "boot_config.json.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c122da2-251b-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774093593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093593, "uuid": "f9420675-a29e-410a-9c52-3776c74abc94", "comment": "Malware payload (SalatStealer)", "value": "1cdde441ed3b5b3fbcf46b48ebfe2e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093593, "uuid": "60ea3215-3ced-4892-8f39-bafdd170d9bb", "comment": "Malware payload (SalatStealer)", "value": "0e552dea7d3438a9cb0e322c95d94eba11c66c546e10ccf180c54da97a6d96a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093593, "uuid": "26a3eedf-912b-4cab-b834-cf67ac8a800a", "comment": "Malware payload (SalatStealer)", "value": "3da7cd12be5724a54cc0cafc74065a987fb05b8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093593, "uuid": "79ac7cfa-ae7f-4664-afd6-c4809d392819", "comment": "Malware payload (SalatStealer)", "value": "6e7e83da33a89105e35de9e182c7da2f6071c9c5fbd103cbb30e7efe33761474af7bd6f84caf0a9d7927c0401f4c6f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093593, "uuid": "c4346f78-795a-4890-8bc8-fc305c45c535", "value": "T1ADC65B11FACF54F5E943593141ABB33F23305D058B28CBABEB587A6AFC776911836209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093593, "uuid": "f190f615-cac7-4881-9457-d6907bfac3d8", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093593, "uuid": "64f4280c-440e-47ca-b2e2-c14dc766b82f", "value": "98304:OGe940AB/8ivNJIigdLxecN7JB6aE2QbzI:f0AfIZdN7J0H2Qbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774093593, "uuid": "b8d09eb6-5506-4d7c-ba7c-b4e044cc34bc", "value": 12468736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774093593, "uuid": "d5bfbdbe-46ff-4f3e-924c-9db33dd8a1f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093593, "uuid": "db2eed02-3033-453e-8d43-b02a27a96b8c", "value": "000056947961897b1ce18822fd4ba2b5ffcf9ec60e68c6b25e4490db553f4296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6868c679-2513-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774090071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090071, "uuid": "f2ee26ce-a905-4ac0-867a-2d5fa20da362", "comment": "Malware payload", "value": "d53aa092ce1a12b790cfe3df8a07563e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090071, "uuid": "8854a959-04b8-40ac-9079-b24840f649b5", "comment": "Malware payload", "value": "0ec73ab9b92b3b1435f57f6b1aefc28f913047f61994ee1e42eee6a70444b998", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090071, "uuid": "d585d138-d576-4ac5-8e7c-5cc8484f7cf4", "comment": "Malware payload", "value": "e307e0e166cc6b653a50715b904bcc1e0c272955", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090071, "uuid": "3b8b3acb-e598-465a-821e-96e6436bb31c", "comment": "Malware payload", "value": "220005b5c22931eae9649c0619cc497327b3818839ab8372d5bd01fd47553b11da802ee694ad5f8516da2ac30b8aec8b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090071, "uuid": "ca28fad3-6d8c-4429-b447-294ba035f735", "value": "T171252223F4415A73C6BE6D30988245616C2FBC82BEACF846C2C837EE1B754F5A52756C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090071, "uuid": "6bf79bf9-4f5a-42a7-a5e6-85db3d19997a", "value": "24576:HhM8iNRTZhZLshhM8pUxCcYIMN9tXA0PDokby:HSXNRtSSxslLN3Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774090071, "uuid": "d164a414-eaf8-4c42-b8f8-d1bcee9568e9", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774090071, "uuid": "1a7bccb7-0f08-41e7-9619-ec7de6967d53", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090071, "uuid": "197b4665-01f2-4ada-a35c-b2159a140537", "value": "Inventory Selections.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d00b83-24fd-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774080770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080770, "uuid": "56e7e899-bce1-4c26-9fd8-2f13c13fe8ce", "comment": "Malware payload (ACRStealer)", "value": "4cfc3c122758c31df123a1c3b3032ac1", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080770, "uuid": "0ab4161b-aec7-4d2c-b292-fd7699796e63", "comment": "Malware payload (ACRStealer)", "value": "0f6491a71f06d4468f37e04ca5a09df3487fc03c4a04cc73263720c144cde600", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080770, "uuid": "086b7328-1b57-47c9-9d42-190e0b1f0d6e", "comment": "Malware payload (ACRStealer)", "value": "5f9f7aac1b6a13efb8bd70df70050d422f7d4646", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080770, "uuid": "395dd403-71f6-48db-818f-a6fac0f56551", "comment": "Malware payload (ACRStealer)", "value": "8cbe0c2584bdebde45a8ca39a01d88b5328ab8c1e4761a9c2bcfc09fe53a3fb4bddfcb75fbfaec2d448ba8b6dd521c3c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080770, "uuid": "40e580f5-809a-4629-8327-5402d1110200", "value": "T123351B4BC2C75CA3E6A301F75427A657BF39058846B6CC2A65EE41ED36A36FC637B010", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080770, "uuid": "bfd3e9c9-8fa8-4c78-aab7-398d75c7daf7", "value": "73a5110c900b73d484d60d93b9275d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080770, "uuid": "b38f6342-35ec-4f4e-87f3-7207fe165ca2", "value": "12288:E1thttYKYrpal3GuAD3+9YuP5/Duj9CKPDq/T/iaps9cDhC:O53iqL9NDhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774080770, "uuid": "b9df3d3f-626c-437a-aeb5-1cddeb1bb795", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774080770, "uuid": "1bdfc377-0a96-4cce-8596-aa7c127edaab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080770, "uuid": "ffbfeb9b-35a1-4f6b-986a-76544354637e", "value": "0f6491a71f06d4468f37e04ca5a09df3487fc03c4a04cc73263720c144cde600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bd0ae2-24fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774080238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080238, "uuid": "6263004b-0cba-4171-8a95-c3e9ff049e49", "comment": "Malware payload", "value": "76be4bb30a3397771ace560f1fc171d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080238, "uuid": "870bd808-b3ce-42ca-a618-43d90f2c09bb", "comment": "Malware payload", "value": "128acee9bc263b6c746e11e014b71911e8a13063a1692ce61db1e9b9f3801d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080238, "uuid": "2c956f6c-52bb-431a-a133-ebdf62e1baec", "comment": "Malware payload", "value": "a19c95204e80a9fa3bb03ee46c6a6788e351af4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080238, "uuid": "b4ea52e3-9bbe-4e2e-816d-cf62d513b001", "comment": "Malware payload", "value": "2b4535221e2057910ba9a89c7c54d297c61e9be5d3918a4a8f54bd31fb9fe86e87a4bb5258c16b59427a72261ef3ccb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080238, "uuid": "82595411-5991-4792-a6c1-8be4c3c7f85f", "value": "T13A267D0FEB920CEDCA3C84F481955732DA1879190B70BEDB1DEAEA319D51EE80E67744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080238, "uuid": "421d0057-a170-45fa-8331-7077490db3f5", "value": "d7f68e718495bbcf02345066cfcd996a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080238, "uuid": "7cffc8f2-e3e2-4ef2-ac67-b3523b57fe14", "value": "98304:FLNld3RoN+4OZh/BoqtBe3YKJra8P6jq5Js6ffDqtWy3p9D8miA:RZGsN980", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774080238, "uuid": "669ea7b4-e547-4c02-a53d-92a018d86834", "value": 4596736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774080238, "uuid": "f4e0b7d7-760f-42f4-a1b2-c16459acafbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080238, "uuid": "d7c09e98-3f09-4581-9f91-6923cbd49cc9", "value": "google-exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be78c298-24fd-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774080766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080766, "uuid": "24297e6d-6d73-42a9-abed-49f4967c64ae", "comment": "Malware payload (ACRStealer)", "value": "60e90409c6bf0351c709084315a9f7bf", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080766, "uuid": "f76f63f6-b000-4142-bf47-c7985b5f6360", "comment": "Malware payload (ACRStealer)", "value": "153818521e7c5e6dd8c0b1c9f2b48e14d8634f132a57ccc7b98e881702804c20", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080766, "uuid": "76b4efe7-1ef5-4ea2-980b-894a40ceb2dd", "comment": "Malware payload (ACRStealer)", "value": "54367657542277e3970479d896b3f4903aa20f95", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080766, "uuid": "83ccc31e-e75e-418d-bb3c-75976e2a90f3", "comment": "Malware payload (ACRStealer)", "value": "04e785142d9677b9056c1d59582c63a36595621a1ed02c0460398b309d928a07475f2c3d91dd09a077e5a01a4986d02f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080766, "uuid": "080940c5-3404-456d-8348-d1c892e244b3", "value": "T118C55CC641DB07F9FF03A936812BA65FD71C84A4AB04C9DF62A42D9D9E77BE1863C041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080766, "uuid": "f9ad0dc8-9514-455e-af73-798c27f8584b", "value": "4b3d6eb89cb6ea974060108971b6e4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080766, "uuid": "7b9693e9-0a5c-4197-92ce-e7801c8aeb41", "value": "24576:Uo6Vzk+UApcnm/ws2LGTqPnPdgxb7vmfWMUYQ4YkAmZZuEzEqleshTm4RGOOrIGF:CdC1OrIKhaBaWqMoTMFHmYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774080766, "uuid": "40a9c852-7506-46d2-ada8-2d6a99ed1beb", "value": 2497024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774080766, "uuid": "fabdf9e5-7210-4c6f-a7f5-b5bd7dfd6681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080766, "uuid": "218cc5dc-e965-4ade-a59b-a60be7d42736", "value": "153818521e7c5e6dd8c0b1c9f2b48e14d8634f132a57ccc7b98e881702804c20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be14c56d-257f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774136600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136600, "uuid": "fc387a5e-8f71-450f-bd6c-a1b9750c7741", "comment": "Malware payload", "value": "5fd084adf891f1bf82ded8483c23728e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136600, "uuid": "01279ccf-0cff-4a64-bce8-a7fc83a6228d", "comment": "Malware payload", "value": "1588e28cc6363ba74f755ac49d2f66572d279b43ce8449b49f934aa98523f382", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136600, "uuid": "a560b77a-df77-4ad9-bd40-1bba7e1abaf8", "comment": "Malware payload", "value": "efc713f2ee83981670bf1f797d30925f77f48aff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136600, "uuid": "b48a704f-3efa-41d9-b65e-0c0d1d9cbeee", "comment": "Malware payload", "value": "6a8fee0639ca377ee95618c3e483722f2e0bd7f6e57ce77585fd33f38e2a61cab5989170dfa44033f861328059fb2902", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136600, "uuid": "92fe49d5-3ba7-4ad6-b72f-82f5ecb1f7ce", "value": "T122B533C64A86387BCD25E37280DFB7BCB92FBF52CE551AB313A436A04DF06421966354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136600, "uuid": "934006bf-b164-4560-b4b5-0d63950e04a2", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136600, "uuid": "914afab9-a663-4cf5-8e44-b672d7a06989", "value": "49152:HUtYeTzcs928quiFn21Ty3nn/pebE+Tv87Atsu9Q:H6Yef0oiFn21WnysI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774136600, "uuid": "7576ad32-73b5-43c1-8e84-49fb1fa2cce9", "value": 2280960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774136600, "uuid": "53c0fb41-61a9-4eaa-9f12-2f2604f084a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136600, "uuid": "1274af79-1dfb-478b-bd8c-45f26bfc3dc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b30a10e-252f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774102101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774102101, "uuid": "e7a5978f-279a-4207-a5a1-57b897c5f24f", "comment": "Malware payload", "value": "435af5bde1c58407a02b276e3fae95e3", "object_relation": "md5", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774102101, "uuid": "ed501059-85bd-4306-be55-e6d33ced67cf", "comment": "Malware payload", "value": "161ca50ac9bb0518dbff274f1ecbe0ba98cb53c96948fc15461e5a8fcf5c143d", "object_relation": "sha256", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774102101, "uuid": "227e36e9-deed-4936-ac7f-660ba0f7fabc", "comment": "Malware payload", "value": "1b00b4ec416b5a97d38ec5baa1bae49ee542c89a", "object_relation": "sha1", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774102101, "uuid": "778bb08c-3d46-4b97-936a-e57daef25f2c", "comment": "Malware payload", "value": "91239e3a514567d2964abbaa642d9f60194831ec488b09f8a134f4a25aa0c196445960b3095b0677ba2acaa233988a73", "object_relation": "sha3-384", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774102101, "uuid": "a8ae5ef1-5601-44d8-82c3-8b102c10b7d2", "value": "T18D6423001EF50F9518D1E93672E9E6025A380E85904A0B95FABCDFC2BB5CEE5D72637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774102101, "uuid": "4d30d28d-02f1-4433-8d7f-db51eeb5f0fe", "value": "6144:UoFGSKVMUgc75usS+l7hwDmWdkuHdbXU0hci/B7wd3JSk7ptEQ1O+:UQhU4b+l72LbVj/B7wd3ldtEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774102101, "uuid": "a1bb081d-9af6-42f2-9d72-cc6e5866c5fe", "value": 319735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774102101, "uuid": "c96888bf-dd0a-40e4-9b45-cfc80ad52816", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774102101, "uuid": "c9013087-321e-402f-b23f-446e3cc0fea3", "value": "tt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1d413b-2525-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774097912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097912, "uuid": "ab9c2260-e09f-4e58-9c1e-66bc543eefe8", "comment": "Malware payload", "value": "d761a6a7ae9f2254bd81ac234033a8b8", "object_relation": "md5", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "socketusercontent-com", "colour": "#BAB244", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097912, "uuid": "768a110e-e1ea-4017-b9cc-d2060b1f3d92", "comment": "Malware payload", "value": "18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a", "object_relation": "sha256", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "socketusercontent-com", "colour": "#BAB244", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097912, "uuid": "0e403855-baec-4003-b9b3-47a9129909ed", "comment": "Malware payload", "value": "4fed54d88f919c675ee2f575f70698a8d3649287", "object_relation": "sha1", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "socketusercontent-com", "colour": "#BAB244", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097912, "uuid": "1f558367-9b66-42b4-8dae-01be618ba5bd", "comment": "Malware payload", "value": "bb6a865087537333f56507c46c2a28706cf8a535d10a1b9fb3243721d02627d8c2ca93b70a2714a4e5297d3ebf1957e0", "object_relation": "sha3-384", "Tag": [ { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "socketusercontent-com", "colour": "#BAB244", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097912, "uuid": "26f04090-6237-46b4-99f8-9b0a3af05d60", "value": "T109825B13EF222E726F6AE8B44ADF4AD59E2D474A14711CA8F01DE4E91F70970A0F50BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097912, "uuid": "0aed53fe-8d5f-4c4b-873f-4d141ad4c5e8", "value": "384:tJRfIaEkaBSVQD8Pj/EnfjGgatHkBBIBtrrYIU2/2glBU46z++622JMwjaj/J:1fIadaYVQQPrEnfjVMx2gV/+N0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774097912, "uuid": "9d32edcd-4692-4e1b-97eb-ffa152653871", "value": 17592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774097912, "uuid": "7f6e2985-a768-46ef-aecc-dabc37f6a513", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097912, "uuid": "c7814230-1c84-421b-8978-21a25d6e5066", "value": "QGKJPg-gHR5Q43Kt6GATFGgDa_B1SZpimbgZA0eXdZxo.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df01495-24c0-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054297, "uuid": "ed6c2d18-58c0-4296-ac4e-129a44a9082e", "comment": "Malware payload (PEASS-NG)", "value": "f34a966c0d03633cbf36778d0436c9eb", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054297, "uuid": "f63054ec-5eb4-4c2c-8a5c-99d8f91c22df", "comment": "Malware payload (PEASS-NG)", "value": "1929e224e17e121829d53d4a5fa7c253de92bb5f1859684eeddad926a0b92fed", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054297, "uuid": "37f3e448-1d11-4eb1-b769-c57b28c9ee68", "comment": "Malware payload (PEASS-NG)", "value": "f77378689d9f4cce22c535ab4bd41ab4e53524b2", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054297, "uuid": "52c8ab0a-30bf-4de7-a03f-0b1d6d11b7f9", "comment": "Malware payload (PEASS-NG)", "value": "5a61eabb06a5ca015e1cb2e4ecf96aa9cb61ac1bf484f4c253fbdf2c7ae046ee7ad9f5ebccd4356f7abf6a0b4f13e4b5", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054297, "uuid": "a7b12901-16af-44bd-8023-29f3859dd85d", "value": "T15906AF9ABD6C3940D649263E5BF907C1277DFF4B2F1297173944B7AE1EF220A4A91230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054297, "uuid": "3012d42e-125b-4910-afab-567f204088ea", "value": "98304:qpBEHIKKNdXKPns1AyeOO/NyTK8G/bu75RsxEBk4N7hvdYelTjYfdmo4ijDVIx+P:v9/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054297, "uuid": "b302f11f-f74e-4a7f-a28c-ca24fc184daa", "value": 3811458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054297, "uuid": "160eb685-e0f2-4625-87ef-f597f002845a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054297, "uuid": "67f26e23-5ef3-4118-9738-f81c0c89403c", "value": "linpeas_darwin_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2d9352-250f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774088330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088330, "uuid": "e1056907-7273-4fed-ac3d-834532ac502f", "comment": "Malware payload", "value": "894cc76b68ad572c72549658167b11c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IseLoader", "colour": "#43DEA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088330, "uuid": "c55f9807-890a-4c85-be78-75ffdbc19adc", "comment": "Malware payload", "value": "1aa0c9c4461487847e47bd596f0e8ddba50e716d54711d664c44584c0c54a306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IseLoader", "colour": "#43DEA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088330, "uuid": "960999d6-df05-4c8e-99a8-7bb2349edeb4", "comment": "Malware payload", "value": "50dd3d51959eeeade981409c9134988f42b35634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IseLoader", "colour": "#43DEA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088330, "uuid": "0177048d-baf9-4d4d-b387-a51d48cf17ba", "comment": "Malware payload", "value": "a75ffbf9489d0854499ba28c2efcb63540a2003634e9d8d18b5fd8c8ce7559333298ad311cc36e2de00eb9174af062c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IseLoader", "colour": "#43DEA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088330, "uuid": "795734a7-2207-49b6-918b-4dd7b61c3fc1", "value": "T12D157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088330, "uuid": "73e6c54c-d25a-4497-a8f7-b84702ab6dd7", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088330, "uuid": "ca75e2e0-cc81-4993-a54d-d7f0fc644605", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6XG:d/QMnl5YL7WzZyQRdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774088330, "uuid": "e32d19c7-ab5c-4204-b894-a197364a44af", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774088330, "uuid": "3588a272-6226-42c4-ac1f-ca410f07f18f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088330, "uuid": "74936fcd-0a8d-4317-88ab-0410f13ab045", "value": "Y937242603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db30645-2569-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774127016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127016, "uuid": "903c23d5-7e23-4572-ab7e-bcbf529d3491", "comment": "Malware payload (Mirai)", "value": "275429c38e9b8937f099905b6f48439b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127016, "uuid": "901032c8-3324-4cb3-a667-b7310f33484a", "comment": "Malware payload (Mirai)", "value": "1ab6ab16f23a97ebf94432ddc40781f8e728dce0a81b568db44744da705d06be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127016, "uuid": "a05378a0-b648-40a3-9964-61b269072fda", "comment": "Malware payload (Mirai)", "value": "5368c0cab7c769116ab3a475a75e95fc641bd93e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127016, "uuid": "4080a971-43d0-417a-9585-17ceeb226c40", "comment": "Malware payload (Mirai)", "value": "fcf10983273c645de3a41fef63108d3b9705a967445e23461b34e2bad23cbdb215e73b8d2eb627c934e9e7294d313f07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127016, "uuid": "712e7bc4-ee76-4007-aa2e-f94e8496380a", "value": "T172C32A16B952DA12D5C312BAFF9E514933132FB8E3ED72029D206F60678B4DB0E7B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127016, "uuid": "26c6c57d-4232-49ab-96a7-a16131687f70", "value": "3072:jcyCosdXrENRiHbIELIgbKdmaBcvFbfUbGrjGEL:fOtwS7jIKKsaq9Ub7EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774127016, "uuid": "09517f93-36ea-472d-acf6-9d2da8389f34", "value": 126040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774127016, "uuid": "02e40a30-798e-4549-8dc3-4ce4fcb36f90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127016, "uuid": "e6d3d5b1-3014-4e13-b2b3-7e1065fa16cb", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea16da76-252a-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1774100167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100167, "uuid": "952e27a6-af1e-4872-aecb-3d1e54f76896", "comment": "Malware payload (Arechclient2)", "value": "20b9ee710037497e39b8b4fc5514704e", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100167, "uuid": "b55b0764-7bda-4a79-bb4c-4a849213cfcd", "comment": "Malware payload (Arechclient2)", "value": "1af5aad4a5f22146539a05ccae2a7a18cfe49ff9e9a6a1dbf10a9cde0bd0957f", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100167, "uuid": "3d75b214-baac-4edd-bb2e-52eda5d9459a", "comment": "Malware payload (Arechclient2)", "value": "f8b017f0d672074daf95859a32c267ac90ec2349", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100167, "uuid": "9df26949-3862-4afc-a857-a4967dfff7b0", "comment": "Malware payload (Arechclient2)", "value": "072630a8ca6e954e964828df9e01ac6bcaa5475c7fde21fcf501012050e9194148d7c38e45fa579963dae8445d2ba07b", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100167, "uuid": "3436da74-060a-4fcd-ad04-4ddd5859ae92", "value": "T112155B6C377BA922DEDC7F7590FF5F0CD2A49EAB82825146158DA8D40FD9319A34CB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100167, "uuid": "f9214ca8-9367-4da3-801e-1922d44b05fd", "value": "12288:zrbT6W0Nwyer1yEm6+f1ucWF64bOPZLJcjzChB7UNVKDsI1le01r:Nyw1yH/YU5RLC3NV4RH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100167, "uuid": "747a957f-0333-45ec-8f58-3e27b05b321b", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100167, "uuid": "398376b4-4ef1-42a4-a528-bd803f231f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100167, "uuid": "79ce2906-bd12-4be4-a0c5-d34d2025f04b", "value": "1af5aad4a5f22146539a05ccae2a7a18cfe49ff9e9a6a1dbf10a9cde0bd0957f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6e8043-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054161, "uuid": "4a3794b0-1008-44e3-93a7-de27ce3d77c4", "comment": "Malware payload (PEASS-NG)", "value": "3507779630c6511c2e9db7e0f7040825", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054161, "uuid": "ccca6b39-f9ed-43a4-b460-b18409bc198b", "comment": "Malware payload (PEASS-NG)", "value": "1ba433b6fa25c78ef6bd1093945f931eefd00abffe185d011d6759eb518e681d", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054161, "uuid": "28a1d736-4085-47f5-926b-9a853c75d471", "comment": "Malware payload (PEASS-NG)", "value": "4a9f40257aead381008a858266df8961d63f4329", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054161, "uuid": "e36393a8-3216-4f5d-8da1-fcaf855db2af", "comment": "Malware payload (PEASS-NG)", "value": "15ff0f312c4dcb9bc18a6fbc2e0e9e67f1b6f3efee1f41877e9e7c9f5afece4f6d4d9c54342a1d3e4a786165fe6a1a6f", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054161, "uuid": "a07de031-363b-4ee5-87f4-2cf6f6e8caab", "value": "T11A251B5CB80CEFB25025C97C1C951E7919A77F0F2962181874ECB70C77EC8AE60F66A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054161, "uuid": "123d84c2-6173-4de2-b293-f435a20b5ddc", "value": "6144:uc54Yu4hl4h94hB4hj4Qs4vg4hW4ht4h+4hk4ht4hF4hl4h34vm4h70NScHp2ztd:XnPi4b23a+DgVu9DDTYvDnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054161, "uuid": "a2507344-f06d-449f-9f15-2e12bb194c5c", "value": 975444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054161, "uuid": "d44bb5be-7131-472d-b60b-9d53b672db66", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054161, "uuid": "e90e5f06-682e-46a8-b3b8-07f342fd56a3", "value": "linpeas.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bcf3f9-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053963, "uuid": "5303012a-a6fb-4d68-bfc7-5ae1c1d50303", "comment": "Malware payload (PEASS-NG)", "value": "3beb37a1f0ceea38d4aea5b7ad6c6c5f", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053963, "uuid": "38626fd8-8221-4e60-b124-66dce41fd55a", "comment": "Malware payload (PEASS-NG)", "value": "1bcd0a0f671559848969e5089342f4e3492ae57cc77f6c54f4d2965b5aa7310a", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053963, "uuid": "47a340bc-1ff1-44a6-850d-2b99094c7abb", "comment": "Malware payload (PEASS-NG)", "value": "d2aa836c2f382a1f20be898dd7e2e4e9a38cac7b", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053963, "uuid": "5d6cc683-eaf5-4265-a575-2f099dee959c", "comment": "Malware payload (PEASS-NG)", "value": "c0ff56747a0b91356827d88cab3daae7480d487110cc34ad0dcf3b755d0cca400ef4154ce3ca48ec309a00e8f7dec767", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053963, "uuid": "f5fc4e14-d9c2-4076-a786-9dd4922e0525", "value": "T115B6D14062DD046DD6AF0E79906102334A35761A179A8BC7FBCC81AC0F5BFE29F76726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053963, "uuid": "4892a0dd-9132-4985-9ed9-13103ec502f8", "value": "98304:kwcEBhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qj:HPBVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053963, "uuid": "e1aa56ed-8857-4cb7-a227-54001ce495cc", "value": 10954240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053963, "uuid": "ddad5b21-f5c4-4be4-a50d-7d7292c21afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053963, "uuid": "3a9594f8-48a9-42fc-afdc-ff2b886051ff", "value": "winPEASx64_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad66031d-24fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1774079449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079449, "uuid": "0d39c487-7d69-466b-ad9f-9403a163fcfe", "comment": "Malware payload (Adware.Techsnab)", "value": "eeeae217c12b6bf59498415ab9ca5e4a", "object_relation": "md5", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079449, "uuid": "e61c53e4-6584-4427-bf2e-c687a2320d93", "comment": "Malware payload (Adware.Techsnab)", "value": "1cc4d06ea2475d1edb57cf57abdc12f1056a56839a2006e07fa30e71356d57ba", "object_relation": "sha256", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079449, "uuid": "d7027d3b-b5fc-40d1-84a6-dcda4bd3a299", "comment": "Malware payload (Adware.Techsnab)", "value": "8cd860f1823eaaa6b4b3703a9c3a132afbf5ca80", "object_relation": "sha1", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079449, "uuid": "e26ad821-3ad7-4403-8fe3-ae8756f3dbb5", "comment": "Malware payload (Adware.Techsnab)", "value": "32bf42f0fcc693546793e55ad7316056d4b4e5f0cec5063ed4699e4f5880f341b3c08c9a41d6962e7b063d977eb2bf30", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079449, "uuid": "88b62271-86bf-4de5-a8dc-c80a583d8ae5", "value": "T1E633D9CD4525FC3DA263A400016761A341CCFB5621EF4B6C2D65C5AF33DE89EAB8F64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079449, "uuid": "5fdf768f-9e25-4c26-a0e7-30d064ddf380", "value": "768:4T2kvAIEusJH1+O9WMGdUZaEK3TAGnu6W9xD7jZULWh4iFX3c:k3EnJoOA76hG+xD/ZULWOsX3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774079449, "uuid": "76e00422-e273-4914-abe3-7dfa5a827c9b", "value": 53422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774079449, "uuid": "cbbe12b3-8352-4bb9-9e65-e08633355c10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079449, "uuid": "19cf3c96-b48c-44fe-bd60-f5a7064961fa", "value": "bjeymorynum.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519fd8bd-2529-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774099481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099481, "uuid": "03743ac1-9f15-450c-9a9f-659367849c14", "comment": "Malware payload", "value": "75b136b82b56cbb0a3e7e38ffcee0e46", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099481, "uuid": "5379d983-74dc-4a26-8e16-8351e0172186", "comment": "Malware payload", "value": "1dda59a561a6c899dfed489e98ecfc8ba3f79baa9cc187b4e902b7c65b7ca77b", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099481, "uuid": "97e61e92-d736-40d3-9ac4-b2d829b88a29", "comment": "Malware payload", "value": "bd2cde84dc6fa5834d6234e07546bc618e4f302b", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099481, "uuid": "8f2c9a3d-d3f9-49d5-b917-cd586cd41211", "comment": "Malware payload", "value": "226626bc78ffd2434c7724feab3d3d2f99a32cfdc4457376f4c1812924166f0640425e0ba64cb1719ecff941fdd03792", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099481, "uuid": "edc7946c-d00a-489c-a03d-78ac76f21df3", "value": "T17A26F031927278D9EA3753BFA4AC4FD58014B4F0B519EA6B337C2FB58E9064661B2D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099481, "uuid": "f4ff1b3d-2b69-4ab0-8fce-7699a4df2e23", "value": "49152:/eQVYdMV3eVougTQAM4vLNgmUESIEjPMN2lv+oBVEjF1wyeDIKz1aTI:GsYdMV396AM4veHjPMNaxgF1feD51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774099481, "uuid": "c291f254-0de1-411a-91ea-419b87ad6bde", "value": 4750336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774099481, "uuid": "8a52447e-15fd-49c5-86ef-2a77345852b6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099481, "uuid": "1b8fce16-ffba-4721-acc9-4c75f5c3386c", "value": "MicrosoftEdgeUpdateTaskMachineCoreM.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49c46de-2506-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774084615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084615, "uuid": "0ca124f8-80e8-43c7-84e1-652f86c0d6fe", "comment": "Malware payload (Mirai)", "value": "fe6fb5cbd1bc99f5bcc36012d9b3badf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084615, "uuid": "16da9171-48a2-41ee-b850-c2a65acf3a7f", "comment": "Malware payload (Mirai)", "value": "1e1cf2f14dd48f5be6019831491ce4ae71e6d55061da02baf30b9263d5e889c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084615, "uuid": "f5e2e6c8-af96-4a56-b8b7-6a1e4b319a0b", "comment": "Malware payload (Mirai)", "value": "2e36f233966521c842157f4f451b1be6ae6aaf15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084615, "uuid": "ddef6984-ab3d-46eb-b55b-7d35249871ac", "comment": "Malware payload (Mirai)", "value": "13bc7218c5536d23ab393c43aebadf804c6dc10dc1eacf566bc3d1f3eaa2e3ed94f6a09ae3ca5e828453179a2cbe29fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084615, "uuid": "33392815-b5b9-452e-affd-0572dca53095", "value": "T133F36C6AB64F7C81D2C6C3F49F9B4B98342775E18E5791E23D11133CC8D29EA8DA0B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084615, "uuid": "07aaf78e-a12a-4e7b-8f2b-6c4195f8cfbe", "value": "1536:xbL7HuR8BlCGEnNi98Qjmw6NzQPfGIngsMoLv2F5E4PiBT5jHyu3fQWTJNB/LW:xbL7HueljEnqjmw6nGSnfST5jZd7Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774084615, "uuid": "9fa06234-d7d3-4110-bfda-d2e30a6f31e7", "value": 162512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774084615, "uuid": "e5b23591-ad3a-47e3-9996-9275b0b9cd2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084615, "uuid": "0a6b1392-107b-406d-9f8e-a8e881db08ab", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5e0e78-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054184, "uuid": "986b762d-ce1d-465b-8779-490fd16cf94b", "comment": "Malware payload (PEASS-NG)", "value": "30a749f5a563037e808a518cc75c792b", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054184, "uuid": "66daf5b6-bc3c-4ed2-b701-77fbbeaaaf50", "comment": "Malware payload (PEASS-NG)", "value": "1ed329c2b7d68331e174a27eb1a928c6651c23b4c4a478e560ceeb63d4f9669b", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054184, "uuid": "7c60c53e-be18-4be7-a6f8-a66e95ddd56f", "comment": "Malware payload (PEASS-NG)", "value": "d917174bb08502edc4ab5c492ba8677af70aaf1e", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054184, "uuid": "aacaaf13-d5ae-4e03-8662-d4cae2260ce0", "comment": "Malware payload (PEASS-NG)", "value": "53a67924ecef525073b3b8a5c621f29926ee6a28cecf464153dff2fa5c1abad4f21d720ac4e2960eef1dcb4f56a69a50", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054184, "uuid": "3cbd5797-9f46-4b60-9dab-56277f296c1c", "value": "T172F6CF770687BCF93E650C95980129490C5D7B4F2229524AFACC31BE73EE5A8CE3C979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054184, "uuid": "520b8beb-bac6-4810-888a-5ccabc3dd3a0", "value": "49152:3j5WGQHvJxvTSg7Oq6EE+GFbvC84ko2ACfjIjvRoIjPMcIxDFG72HwgSPEUMWS6x:33DK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054184, "uuid": "ebcc4280-e195-480a-9af6-485d64c6e52d", "value": 16550050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054184, "uuid": "7a6adfa4-7020-46b6-a9c0-1264e22317ce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054184, "uuid": "10a1e011-d3c9-4b05-bb11-01e67b90f3a3", "value": "linpeas_fat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59de81e9-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057405, "uuid": "c8b27148-2f54-4cba-987d-dd6ad733e53d", "comment": "Malware payload (PEASS-NG)", "value": "42b741480271649a2a8852de50b7a445", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057405, "uuid": "c2e89895-2158-4d7c-8e35-80525bca26d2", "comment": "Malware payload (PEASS-NG)", "value": "21dedc8dbeed3426d6b80adf0ce50090daf472c8fd23f9f69fb5accac22a687d", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057405, "uuid": "8b309554-a64e-4c95-9847-a7c86f5f1b97", "comment": "Malware payload (PEASS-NG)", "value": "36b3d94c27a5741d0fbdce90d3ae99650acfcbf9", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057405, "uuid": "1d573fba-3c30-49ca-868c-4cc6c18877b6", "comment": "Malware payload (PEASS-NG)", "value": "949f1c2bb7b814834996da60d71a76f8028fb751135386e7686b4732d5af54200d29c143441f43fa41eb086f0f5fe627", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057405, "uuid": "7e74bb88-90f8-455b-927d-21313049c539", "value": "T14CA6EF02F3E401D6EABB527891B61612D672B42A4330ABCF338C94695F337D16E76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057405, "uuid": "33632a7c-6bcb-4833-be4a-9fe1b492262a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057405, "uuid": "5aeff526-1b97-4fd9-93b3-09e5b67f71c8", "value": "98304:w4KAANhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qr:wtNVBFUcwti7TQlyVN8iNISRTRmW5Qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057405, "uuid": "8bd77fef-864e-4464-8173-9f4eeff7adc1", "value": 10026496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057405, "uuid": "d84d8038-844a-457e-809c-33d0f9a5e7ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057405, "uuid": "0dccd9dc-6e33-4ec3-8dd7-4e7dfe089d28", "value": "winPEASany_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebb2aba-2537-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774105382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105382, "uuid": "d0d9c87b-f834-4ade-bd39-76f0d3e306c4", "comment": "Malware payload", "value": "c9d770fce3bacf134a15963bee21e40c", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105382, "uuid": "0638169b-dd90-42af-8a52-8f15bc148111", "comment": "Malware payload", "value": "22ceb6f40fe20aec007e420641cab0da62cd2fdc0cfbe691c324eeae877d809b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105382, "uuid": "f98c9ca2-a493-4ac8-be60-d2622d6033b1", "comment": "Malware payload", "value": "b513248a8be6ca00ccd4a0e08e7d487205c6814e", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105382, "uuid": "e332282b-9135-47c5-b3f2-dbaa46704336", "comment": "Malware payload", "value": "7bb6b432ae6c35c0e8890a95f3d81607700676bae93dc11dafdb653ae81cead337ebc0e7727e33bf250871728f4a076b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105382, "uuid": "971df319-d4e5-4d25-9c21-3d00e3a5cbf4", "value": "T19997222AF72CAC2FCCBB70764D5B12B221162D955A01C79B6901B21C78F3AE94F05BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105382, "uuid": "8e9f805e-9167-4c2e-af4b-1de7cf81330e", "value": "786432:QKewHILSch8LSYNzc6ElcuMQfW9VblZSpMHmdPg6X2HO5z:QKeJScczc6E3OLPKMOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774105382, "uuid": "9e383c0a-983e-4976-9ecc-c139ef55f82e", "value": 40038445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774105382, "uuid": "02a54c96-276f-4595-9e66-d98c713e50ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105382, "uuid": "0365b4a9-d7d7-44a2-ba06-ea5eac0de9be", "value": "com.junkclean.master.kits_1.1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5a2dab-2539-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774106561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106561, "uuid": "2a1212e4-c058-467d-a881-f51ce4790397", "comment": "Malware payload", "value": "507bfad8629c44177315c0661e124744", "object_relation": "md5", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106561, "uuid": "442346a1-f2b3-40ed-83da-abaaf03f76af", "comment": "Malware payload", "value": "2355e519d2d351ba038da8aa18d2d850e996fb67d4c7ee07842b21945b75a551", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106561, "uuid": "bd354fbd-83cd-42be-a9cc-e84fbac3f957", "comment": "Malware payload", "value": "6911d9e479f84d1a149349de406ae00f38d4f6d4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106561, "uuid": "66657999-af23-4618-837c-5fa187385d1e", "comment": "Malware payload", "value": "38539fcf56239faf5241805bd93e97155f3a12074ceb19a46315f61191d7b1c3f37dd1193ef512030d7d312917fb33b0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106561, "uuid": "82a1d632-d9e3-407e-bc17-a73c63edad35", "value": "T16324123331A1CF31065CCBC8843D5939CCB926435A093E89F4E55BBDA76FF66AA62470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106561, "uuid": "2fce785b-0ec2-40c8-8ce3-f918560a0eab", "value": "6144:Qus766u8V2/vD3BHYtro8YIgLqABN4mzH7XlI4P:ls7oJD3Stro8YjqAN4mzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774106561, "uuid": "de7156d4-8b47-4ae3-a8a1-49f17bc0fd18", "value": 224281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774106561, "uuid": "f9d7f583-fe7e-4756-98d7-b433ef1ffddc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106561, "uuid": "49e295e4-6ffa-4262-bcc6-8003738857b7", "value": "2355e519d2d351ba038da8aa18d2d850e996fb67d4c7ee07842b21945b75a551.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f368542-24fd-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774080633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080633, "uuid": "e0227494-e3fa-44ba-a4d7-62d3aa68cafc", "comment": "Malware payload (ACRStealer)", "value": "2df1673c46bca93753888e602ba5e61b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080633, "uuid": "d0ecc20a-be70-4f94-98ad-0c537f065329", "comment": "Malware payload (ACRStealer)", "value": "236c78a9aaf7542088ace5fbc7dac5575a879496807a2b3500ea3d26365b5e82", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080633, "uuid": "e748aab4-2c4d-4be5-a6cf-bcc0944a7c35", "comment": "Malware payload (ACRStealer)", "value": "052f17a6549dade3e7b2f3f43e1774b6780e401c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080633, "uuid": "2d26df6e-996d-492c-b8fb-c8447f9f2ed9", "comment": "Malware payload (ACRStealer)", "value": "9122a4b523cef70d91db10a8e22d316c5020ff8ddc216c7ac2a4be86100ac27d6c540ce198b8716229d04c8c18213b45", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080633, "uuid": "97ab9ad9-562a-469f-8b1e-bd37b7120a01", "value": "T1C6851914A3C75D63056301375C16F0C2FF364A2A21AEFC2670DE59AB67E7DA893BB160", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080633, "uuid": "e8961b56-f166-41be-9e44-2c3e6eb2dfdf", "value": "9529d90d3668cc1e3a9caf2cccc1cb49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080633, "uuid": "c3d4fd2f-7cd5-4e79-8d4b-44ba7f95ea42", "value": "12288:Q979v0GkqLFpPDsSTr+fxuSzkfxtlv/ephfld3+z9qce+UD0f1hhs921ssiGFsjh:QOWXz1aoK9M5sV66m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774080633, "uuid": "9d4ef55b-a7e4-4ff6-890d-97f159cc9483", "value": 1852928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774080633, "uuid": "a81de278-ed8a-4a18-80b7-4bdc9e03ff2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080633, "uuid": "02af6de9-4753-4424-90dd-e60192dc96a1", "value": "236c78a9aaf7542088ace5fbc7dac5575a879496807a2b3500ea3d26365b5e82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0e7074-255b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774121083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121083, "uuid": "80eab69e-e41a-4916-9fa0-862d5c2a012d", "comment": "Malware payload", "value": "e95d1ba07ad3055c62f7ca005dde8a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121083, "uuid": "b957af7d-7d2a-432e-8402-2d266ff79bf9", "comment": "Malware payload", "value": "2622fb251d3653b504e7d9a792fcd48541984f59c3af95a3af6ad669ce7cf788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121083, "uuid": "18474480-a753-4400-88a8-693caaaffadb", "comment": "Malware payload", "value": "12203a99c5e01daae26520fab1c676f5654b9514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121083, "uuid": "8d044c60-5047-4607-b3c5-e5d6d0eeae7c", "comment": "Malware payload", "value": "5a5925b5b1fee638d2e9b55d3f4159344d204fb275204d365928ec06b338465f51e7751a0f20e5bbe3ef4a015335809d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121083, "uuid": "dc375127-6e8e-4152-b1d7-c1706e1f2326", "value": "T1D4C301566313C1FBC5935A34C2B98373BAF6B0142362477EF265C53E6EA4860FF1291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121083, "uuid": "0992c595-7950-4014-8b02-8ccdf06524b9", "value": "c1f4358211a66fe3d457f3e6f5983347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121083, "uuid": "77825e5b-a2b4-422a-8bea-6f2a49a14452", "value": "3072:/VJx4oueifZDy9AVg1fVM1K7p+PYCxjmR:/uVeifZhCC4pdYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774121083, "uuid": "205e4c5f-9a7d-4c13-a2da-edc1e2393b78", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774121083, "uuid": "fced6003-bc26-4e8b-abe2-1b49fcc40bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121083, "uuid": "aa73eb88-f7c4-40a9-853d-5be56f784d72", "value": "runner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a96e14-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054126, "uuid": "da3a794e-7230-4ac9-a925-91738e73d219", "comment": "Malware payload (PEASS-NG)", "value": "620acd3f89891f041c36250561b28f13", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054126, "uuid": "4f8d7aab-4859-4f60-9a6c-a71c538587c7", "comment": "Malware payload (PEASS-NG)", "value": "285ed394e124ffc55c531032149d3dff9540b27bca5065d7f1a212476040954a", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054126, "uuid": "40e6efe0-d45a-4fbe-80f5-67ffc00928b9", "comment": "Malware payload (PEASS-NG)", "value": "d71407865a614c2abf95ddaa9a1621e155a03d29", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054126, "uuid": "03feefb4-45f4-4bd3-9152-7c74a4b95e1e", "comment": "Malware payload (PEASS-NG)", "value": "aa9b073ab5a2dee0b8111bfe477eb31ab09d33be7e39b1c82826adf1c4f921520beea6bf5782126d06f7c72984f4492d", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054126, "uuid": "75b95839-365e-4590-af8f-9d082d4513b4", "value": "T1EAA6EF02F3E401D6EABB527891B61612D672B42A4330ABCF338C94795F337D16E76366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054126, "uuid": "a621f974-1796-4c5b-901e-556f98330e4d", "value": "98304:X4KAANhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qf:XtNVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054126, "uuid": "80867b61-ef57-4f30-ba9d-f2c0cf52f46e", "value": 10025984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054126, "uuid": "11365867-3504-47c4-b059-211a1b27e134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054126, "uuid": "ce6fd444-37a7-443c-9aed-10aff20e66a4", "value": "winPEASx64_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a69973-2501-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774082285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774082285, "uuid": "bd1e44b2-3e9e-4ad8-ab66-15c0af4fa5d3", "comment": "Malware payload (Mirai)", "value": "15c8ba6dfb03c4abe97885ab23be5f34", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774082285, "uuid": "e3357925-95ec-4926-aafd-e1b5ca402d8e", "comment": "Malware payload (Mirai)", "value": "2990ecb627c39d0c0d987c7dd00f0bae177b0b5a2411f736439e86004d5d6e93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774082285, "uuid": "9d82c0e6-24ab-4252-b1c3-43adf1021e46", "comment": "Malware payload (Mirai)", "value": "cad27b060fb4c357888a1e200bd8493de0ca0ba2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774082285, "uuid": "d8a9a3db-53aa-4aa1-8aaa-cb819355714e", "comment": "Malware payload (Mirai)", "value": "843e692bcf4ed8c881b5e05ee3cf94b14d70228315fad09db671e3b64c0b72d9534ee44ec0ddf854bcc4a84645de7b90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774082285, "uuid": "7e09b947-9347-4db5-9698-2297f3b7d019", "value": "T1DA71A6C4C830A4375C868A0BF561C6AA6DDC93E599B4C16C53A99E3712E1F3D7C8B643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774082285, "uuid": "b5eb2f9a-68e6-45a4-baab-78e311123d9b", "value": "48:Za1zqf2lveezXQScxkcJ+Yu/YwV41z/0EqFEQKtYZ/D5+O:Za1zqf2xJzCXsv4zicy5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774082285, "uuid": "06d9981d-47c0-482d-beb0-eab86453a7be", "value": 3496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774082285, "uuid": "b033dd5a-9f38-4ccc-b070-1c85b540d72c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774082285, "uuid": "0cedc3e5-cb67-4475-9044-28ab556928ed", "value": "sshbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1935a9-256d-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1774128889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128889, "uuid": "18572347-85d7-4295-8639-6063881e1ca5", "comment": "Malware payload (SpyNote)", "value": "8990b6195c310f7abadef344e907c186", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128889, "uuid": "3ccf457c-2a3d-4ffb-9436-74ca4053129b", "comment": "Malware payload (SpyNote)", "value": "2b7af4d5fd24ce4daaa2aada2db239d0ec17510d17a55beb214b70b8edc54fb6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128889, "uuid": "668f5f47-8bb0-4305-83c7-1b0a9981dcc2", "comment": "Malware payload (SpyNote)", "value": "77791f490db3672abed80b304fe6f4180a7e84a7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128889, "uuid": "22d6f844-1a5f-492f-aea0-a7e9c0700ae0", "comment": "Malware payload (SpyNote)", "value": "0fea2c1e89d582747aebdcc2a4d59ecc76d874c4205dde7c9c8c290dd8d744d2b3d80c214e07d1f00d66e88a2a1bd163", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128889, "uuid": "1a2bd2c3-5fe1-4d97-aada-f7dc7307e40d", "value": "T15F058DA6F70AB823C9F3C7364275CAAAC54A0C554B43D7871A85723C19FB7D48B85F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128889, "uuid": "309fecfa-05eb-4b8d-97b7-ddaec257aa1e", "value": "12288:+4J6sgRALzQO+hSd7q6+bsUG5WmpYshXZPbGwidNpg4qO:+4J6sjLzh+wdIsUG5WmD9idNpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774128889, "uuid": "ff84cf4e-9fc3-4c83-b95d-ffb81f9b1866", "value": 835886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774128889, "uuid": "1545bb87-b538-4320-85aa-ad918772174f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128889, "uuid": "d8b7209b-1229-4610-bff1-884098ba4f68", "value": "StrayVPN.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a626a8d1-2509-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774085879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085879, "uuid": "4457322b-0f17-4c12-b034-853d1bf15863", "comment": "Malware payload", "value": "b080df249289004a3af8e8b30eaa4c9c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085879, "uuid": "12eafabe-9c4d-42da-8d23-1ebcebc22a3f", "comment": "Malware payload", "value": "2c070a8eccf4ea72c8d36bbe8c9078a9bfc83f35711b031645b5d467bc162c4c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085879, "uuid": "3e04680a-ef37-4312-bac8-a9f86cf4b1a5", "comment": "Malware payload", "value": "3b6a25ae6bd88af7a3172e9c52d26d9a1030bc4e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085879, "uuid": "f7f177da-02b0-41e6-941c-fcbf09d5aee1", "comment": "Malware payload", "value": "9737ffca9d07db07422410b3a7d9015dcc5681f55ab7471eba3e082013085117a7fce89c111cec689c0cd76edd43d1cc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085879, "uuid": "c8003025-5374-47b5-a2fa-78a04e3b666b", "value": "T1FD8601677E87C82CD97740B391C68163AD3A46D9A80BD02F53E44D895E71E4A0393FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085879, "uuid": "5a5f288d-704a-43f4-b4cb-45bd524770c7", "value": "98304:WKiVfqgQ55JKlWa11zARuQj1UJvzhhsCe094IAglNUclEIQXxNfzLMPyCljT3yPu:WrVfr2Lg31UJaLh6CtbBNZ+nmykozzgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085879, "uuid": "c258d928-93f0-4079-8290-7112991449a4", "value": 7941506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085879, "uuid": "7abe47f0-1fde-4098-8019-ad90de7ad565", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085879, "uuid": "a3ad4e2f-435b-4072-b683-0b23bb257c84", "value": "Module2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49d677c-252a-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1774100184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100184, "uuid": "2dc1f524-e1ef-47fa-bf80-359b6e3abbf4", "comment": "Malware payload (Arechclient2)", "value": "d6fbb5a98c58e54f892b4422c7173997", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100184, "uuid": "d9c6ed5b-04d1-41c0-ac72-5250a6b09bd8", "comment": "Malware payload (Arechclient2)", "value": "2c1630f00a7903d2895e648571a5e302475ef1ca56daa862050ae298c06d0309", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100184, "uuid": "c01b361e-fbde-481a-a209-31f97ec6ef86", "comment": "Malware payload (Arechclient2)", "value": "d5d266002564765b275a7506c67aa11279515eec", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100184, "uuid": "0d81a170-39e6-4d2a-b5c6-b8cb7a545205", "comment": "Malware payload (Arechclient2)", "value": "0e31219c61731b042ef7bf545245070b3c6e7958043a4011311605274bf9b5de890b13260f25ebafcede6639a06a95d1", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100184, "uuid": "835cebcb-1b67-4bb3-9087-de49f49d892e", "value": "T14D155B6C377BA922DEDC7F7590FF5F0CD2A49EAB82825146158DA8D40FD9319A34CB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100184, "uuid": "2938cbeb-677d-4fe4-8bdf-e6bfe0bde13e", "value": "12288:ArbT6W0Nwyer1yEm6+f1ucWF64bOPZLjcjz87B7UNVKDxI0e01r:syw1yH/YU5RLoLNV4aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100184, "uuid": "ab558f5f-9855-4076-91c2-aa7bac814576", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100184, "uuid": "77f1d033-e22a-468d-8a16-057fe898f241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100184, "uuid": "4885b23c-bd7a-43f2-96fa-9eaac0423989", "value": "2c1630f00a7903d2895e648571a5e302475ef1ca56daa862050ae298c06d0309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b9b688-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054066, "uuid": "1b53ec7f-2ab4-4ead-962e-9a6c376a168e", "comment": "Malware payload (PEASS-NG)", "value": "8028d4a36fda12cab9eb77306876eced", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054066, "uuid": "b7618a5d-8b73-49d6-8e13-c5195711a348", "comment": "Malware payload (PEASS-NG)", "value": "2cd2d7574448728c703586f7b49304d96f67d2ffc3c9a753d79fca6957a331f0", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054066, "uuid": "0acb10cf-eecd-4424-b072-35d9e5e4c476", "comment": "Malware payload (PEASS-NG)", "value": "717a968913c5b5180acd85dcfd33e28b06c42e01", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054066, "uuid": "7b1684fd-9240-425e-b760-301ad5817354", "comment": "Malware payload (PEASS-NG)", "value": "3298fdcc5a8fa1096ac932d969e05f9e0bffd48bfc5b01934d3e65fd5bd0634f34b3e17b1937fa9eed495f899c14b36e", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054066, "uuid": "57e5b3f8-c89c-4cf3-928c-b3323be0f74b", "value": "T14506BE4BBDE03994C55A523B89EA59C22F79FD072B3113C73E40736A2B726C658F9324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054066, "uuid": "a0fc4111-0a32-4573-b950-9e5dff32a004", "value": "49152:+ZoJeU6Qv7qtrhWMv/pyvFHw9slbgOj7RtlDk48dSXiA:+DpkCslbrj7DAdSXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054066, "uuid": "2adaca76-7eeb-421b-8c73-31a535d64dfe", "value": 3870280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054066, "uuid": "6d043525-5a7d-449b-8020-b35f9acfda56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054066, "uuid": "b4f0f119-0b8b-401c-9d75-36f821661807", "value": "linpeas_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddef852-2510-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1774088818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088818, "uuid": "2bfbc519-c553-4e4c-b55f-31d70110fac4", "comment": "Malware payload (Loda)", "value": "a77c1b82287387ade7d2cc0ea158cb6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088818, "uuid": "7fe133f5-b3fb-484b-a05c-c27d029e6882", "comment": "Malware payload (Loda)", "value": "2cdd303fc725ddb12a305e469223f9aefa49809a9919de479b6c43aa74a5af92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088818, "uuid": "6f2b57cf-65c0-48b5-acd9-c7ed2235947e", "comment": "Malware payload (Loda)", "value": "282526a95dc1088d3d8feae68d8987d5ca3a0fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088818, "uuid": "23f16a10-d94b-439e-acc3-2b8c3bc9c115", "comment": "Malware payload (Loda)", "value": "4649ebee7fee273eac9002b1807471813fec809f7c5d6ba777c275d877bdb890f7467c19462a84b39ab24c840e31cc8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088818, "uuid": "7c7073d0-0da5-4745-820f-ecbd64c631be", "value": "T123A633DE2DDA41DBD9C214B0D7177AFB23F305F558C98C326EC2344AA062EB5306A997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088818, "uuid": "456051ed-11b1-48e5-9689-7afecc1013ea", "value": "fe7c86cdf6037908967e99decf4a7242", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088818, "uuid": "f21f8c8b-2e16-436b-9d8f-713866387e39", "value": "196608:z6AzuNtxzoxklasTwYOYpX0F3W1g7NsTeabDl6xc7JFjjhr3mspjoA3aAmUIdFD:18zlaqw7YpXICkygxc7JFHh3mspczRUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774088818, "uuid": "99ddf695-971b-48a7-b6e7-3b383b285381", "value": 10199040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774088818, "uuid": "2d6684fa-5ed1-4a7a-8ed3-8e79e30f46b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088818, "uuid": "309fdf08-6390-4b71-82bf-69bc693e126d", "value": "a77c1b82287387ade7d2cc0ea158cb6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2512859c-24d0-11f1-a769-42010a9c0008", "comment": "Malware payload (FRP)", "timestamp": 1774061181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061181, "uuid": "30634c92-6751-40f9-84e9-22e0850b184e", "comment": "Malware payload (FRP)", "value": "371f9212095c56676834c1d94edf4ee4", "object_relation": "md5", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061181, "uuid": "2160e959-2e30-4cc2-9294-51d8b09e9f01", "comment": "Malware payload (FRP)", "value": "2d0c4e2ec283c969e9da40dd0b3f778307c88f9991b9a55cd2f97b2a05f2d067", "object_relation": "sha256", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061181, "uuid": "7c50ca52-d378-42f8-ba6d-60e393fdcef9", "comment": "Malware payload (FRP)", "value": "2a8de7c48e83904a35595133dc00ba0932fcc101", "object_relation": "sha1", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061181, "uuid": "18f1090b-6b56-4f5a-9608-cb74c14f165b", "comment": "Malware payload (FRP)", "value": "5079f1b58f6df9f646276a9a20e64912848ba5a25dd4a42e0cfd10d992b982c88d7b51bb737e0b73e058dfa46e86b81e", "object_relation": "sha3-384", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061181, "uuid": "2b22b816-ca40-4195-967e-6bd61a77135f", "value": "T1E9E67D49BC1D60E2DACA76786F2612947238FC085FC1C72A66147B7DBEF23558F132A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061181, "uuid": "3aa43114-6625-4718-a546-fd75b2943f3f", "value": "c984d366a3cc28220c89ab860ab9fd47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061181, "uuid": "5599ded4-d7bf-4a5f-8fbc-b32e50656c85", "value": "196608:AyqhyiWi3bSewcoVs7zfG7QQxJgoug+Yh:AyqhyiWi3bSewcoV4zfG7QSgol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774061181, "uuid": "1eb30ab1-4916-45ba-82d8-73741a45c34b", "value": 14661120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774061181, "uuid": "c395ab7f-238e-4028-8ed0-3fa9b5ccd26d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061181, "uuid": "96e96b65-8bdc-4f27-8b31-ba440945ad01", "value": "frpc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5c84a7-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054110, "uuid": "304c8887-05d9-406b-9900-4ec9e8c760e3", "comment": "Malware payload (PEASS-NG)", "value": "f33588e86c20306a0854177f4bd17c89", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054110, "uuid": "16728a7a-4e15-4e62-9e60-1e203b4c11d9", "comment": "Malware payload (PEASS-NG)", "value": "2d2fc2b9d2914d27ffed6d06e71ff5631e1390ed5d6d35ea1c4b7558e8b7c8b2", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054110, "uuid": "62f44d8f-35c6-4db4-8389-878052d9736e", "comment": "Malware payload (PEASS-NG)", "value": "9595ed7d6c5d2d45647bdcc2107ad8d681129741", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054110, "uuid": "684c6f15-0be7-47e2-b5b5-17ef02eff550", "comment": "Malware payload (PEASS-NG)", "value": "789953bd942d31fa84af330aa48bce59eee7289f8db0fa27e7d13905b6b57b09eb179de74bd76d967c8b080f7ec5d614", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054110, "uuid": "066b8cc7-0dd8-41cc-9133-3df3801e0e75", "value": "T1A6A6EF02F3E401D6EABB527891B61612D672B42A4330ABCF338C94695F337D16E76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054110, "uuid": "1b1ef6fd-ad1e-4492-b59f-cdfd39676a71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054110, "uuid": "2c68a8d4-c41c-4f2e-9e48-4ce57336fbe5", "value": "98304:b4KAANhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qr:btNVBFUcwti7TQlyVN8iNISRTRmW5Qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054110, "uuid": "59083206-9541-402b-8ae9-b7691bb0efc6", "value": 10026496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054110, "uuid": "b537f5e6-58cf-459f-80a2-440b50b0877a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054110, "uuid": "a7b0c674-4f70-45cb-a7aa-0548e78732b6", "value": "winPEASany_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f99095-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057368, "uuid": "fd73eea1-46fd-4e17-83d1-08f47c068a60", "comment": "Malware payload (PEASS-NG)", "value": "cb03de91e59fed59de101718449c6bc8", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057368, "uuid": "1d84b021-020f-4895-b8e6-96e55e53d57a", "comment": "Malware payload (PEASS-NG)", "value": "2d3791bd8072cb670c2d866ff28b24eb55e52895d785b1cba88cbfeba8cf2eda", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057368, "uuid": "60ecc4bc-9cd3-4a36-a4a0-3ddcfaebd50d", "comment": "Malware payload (PEASS-NG)", "value": "c85b78c2c8669ead2c89f73e38923e475811b113", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057368, "uuid": "2a236458-12c2-4969-90af-a237b7f528d0", "comment": "Malware payload (PEASS-NG)", "value": "c353849fce735eb437b8f581324ca27ff3f56ab5e12d11bdf2883e2d76235c80a2a020cd74fa008036d4e18121ab342e", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057368, "uuid": "cc011943-27f0-4416-83cb-e9334a99f9b8", "value": "T11506BE0BBDE03994C55A523B89EA59C22F79FD072B3117C73E40736A2B726C658F9324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057368, "uuid": "9de6b1dc-fc2d-4751-b516-f7b8dac962eb", "value": "49152:BZoJeU6Qv7qtFVhAFHw9slbgOj7RtlDk48dSXiA:BDpiCslbrj7DAdSXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057368, "uuid": "49127ef9-218a-4d2b-9182-99abc57a927f", "value": 3870280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057368, "uuid": "0b33f483-64c2-456f-a831-1734111b16e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057368, "uuid": "a33489a0-cff1-4842-83e5-d78169abcf91", "value": "linpeas_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8e1d47-24d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774063393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774063393, "uuid": "91a8736b-ab8c-4c4e-ae81-13b4735e1f02", "comment": "Malware payload", "value": "353bc3c3c5f23835b2cbfeaf377ebd29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774063393, "uuid": "6db6d6a5-43d8-460e-ab39-14afa3bb58be", "comment": "Malware payload", "value": "2ef9973e259a0959f19ec1307928cc237945179226e8606b386d60cebca4143f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774063393, "uuid": "ea0a9bd5-dcea-47a1-b889-9f8c3d9c8d85", "comment": "Malware payload", "value": "f92dadc24abe5c4736c05d84d7ce43c05d1090a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774063393, "uuid": "b92a3b2a-b065-40df-a3e0-007d18af2e09", "comment": "Malware payload", "value": "33c3ddecc92c8ef1549bf90743cdb9b5cc3f8483bd87e26c42074cfa24ae26ed2893f73a79ae8d756e94b28c442bb86b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774063393, "uuid": "521d9d57-a45b-4bd7-ab15-d40acad2bfbd", "value": "T1A8B56C57FFA144FAD17AA2318533A1767A607C443F2113CB2A90F7682FB2BD09A78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774063393, "uuid": "b1c8f96d-e5e5-45ab-a480-7267c98fd7fe", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774063393, "uuid": "4e4c7baa-98a2-42e0-9603-62d012dc9812", "value": "24576:KXkAdRt8KvJWXaLn5LpMJiiTCAVAjkpOfPmk1mfdR8ciD/QvUSgv5IcbAvDA:KX3d8QJWXe9yJibXjlQc3G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774063393, "uuid": "ed6d25b4-adbb-42c8-a0bf-7b6b8b3d0acd", "value": 2452544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774063393, "uuid": "7b8b7002-bf37-470a-a283-adfc69358961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774063393, "uuid": "fea8d16e-329a-4a66-bfd1-c140a13a0dd9", "value": "SecuriteInfo.com.Program.Unwanted.5384.22222.26849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d5ade2-2580-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774136965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136965, "uuid": "c408516d-ee7c-46dc-ab43-ffd5d3a1bddc", "comment": "Malware payload", "value": "309914a873c3884c1c8a6c005635d570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136965, "uuid": "063ae1f4-0468-46dd-b63f-92a8bf1982c0", "comment": "Malware payload", "value": "2f08e3512c2f383b78cb28bca5020a7d0b0b3afbab83e55b73d15ef0c2632005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136965, "uuid": "072bf1b6-30cd-40a5-84c2-6ac18a5e04fc", "comment": "Malware payload", "value": "99e088c78f6fd262f7c6a74255ed5b9aff9a7afd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136965, "uuid": "2299551e-eb18-4389-9ea1-c6b4fe723ad9", "comment": "Malware payload", "value": "af456045dd7d4a57bc0493bfc1d02704c7318eddb13fce3b2e397904175ae385d7cbfd83288ab9dd036cefc1e53bf3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136965, "uuid": "634dca95-0048-4db8-8f4b-11a7d2e35e9e", "value": "T116D42BFE9D60E325F60DD0BAE247D7528F2138011236A6A329BE93141245873DB6B7FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136965, "uuid": "6f90db98-26d6-4c9f-a133-48fe058db3f2", "value": "12288:r0auuPSlU5B0umJF9Iv/ht+JSe9gke2nHDxH1Wg17RWc:wTuPSlUzuj9Iv/q1PGgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774136965, "uuid": "1be49b44-f967-4670-842a-86bf7e081507", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774136965, "uuid": "4ab7d8d5-abcc-4e03-9c6f-4720b4d31087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136965, "uuid": "7bef57ba-8d82-455b-8241-f9c32ad36145", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ee9f2e-24fc-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774080404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080404, "uuid": "234041aa-379e-4929-95eb-baa52a02b471", "comment": "Malware payload (ACRStealer)", "value": "06235783b0bccc9498eabff14450cc66", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080404, "uuid": "d52c528a-ed78-4309-8b95-81251634dfb1", "comment": "Malware payload (ACRStealer)", "value": "2fb7654e31e95421bb32362a6ba8120cdaf78798d531b97e7893788e0c15e1b0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080404, "uuid": "21d1719c-0129-4b37-9818-1f090609f589", "comment": "Malware payload (ACRStealer)", "value": "3e258aae294e1d3223d0ae7fe984840982e92481", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080404, "uuid": "80eb7321-25a2-49f8-bb4c-5c4f18daf9e5", "comment": "Malware payload (ACRStealer)", "value": "7496a01359015270b52c6f6d0261289d67690d0805c7d2456189258eee9fa8fbabf893bd52aa0b869031f4278ad8ba30", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080404, "uuid": "a32d9e46-bbc8-4593-bb64-0349d39acc3f", "value": "T1C5364C11F8650EAACBB06271CAFF56466364F8041B63B3D70E12BA387CBA1DB9D35351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080404, "uuid": "9cad5a69-8dc5-4a01-97ae-2eadccd96929", "value": "e1cfd71a2ac1e1ab37b3be2f2e2b8496", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080404, "uuid": "f2bfa08d-d094-4725-ac1c-499eea8877b0", "value": "49152:iUZbSf50iBxahN/ChxnjPUEeXbh8Jzr0VNmJItaTAhVTiB4rGS4D52x438YWq:iUIac7LM8Jzr0VNmJIgCiFD52x4s5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774080404, "uuid": "cef7a2cf-7c2e-4244-a5d9-e6babca1d33d", "value": 5305750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774080404, "uuid": "15e5646d-ae3a-4ee9-8483-b041ac1c6ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080404, "uuid": "46f20a6e-d32f-433d-905b-3c3a01b0d319", "value": "2fb7654e31e95421bb32362a6ba8120cdaf78798d531b97e7893788e0c15e1b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3eed993-2525-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774097982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097982, "uuid": "7ce09e16-2ca8-41a1-a20d-9504adc0dd62", "comment": "Malware payload", "value": "c2e97ad957d5608e96bbfcf0f71c0479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097982, "uuid": "e3b1ac7e-a29a-4488-a7bd-8aaef2403062", "comment": "Malware payload", "value": "2fcaf9a4f6d549a86f4fdf6a6b01e044c29fce093a777b114d73dea8adf25538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097982, "uuid": "1097bda4-a117-4331-a913-d232cfeb5efd", "comment": "Malware payload", "value": "8d563b058d659375c34042cc85b08ca03c2fb851", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097982, "uuid": "52b5b8d2-daf5-4496-be2e-c0ed58e86a4e", "comment": "Malware payload", "value": "233d6de41ac9ffe28311066ff01d4d3ac6140c5bae1c284371d57809589aef41f4ad4bab1afe1fd94b7cc8d933477858", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097982, "uuid": "b7f643b1-3593-4aaa-bd22-d3d933e33f61", "value": "T134F533FB589B03F28204977EB27E30CD1A242E3919D848958D65CAC788FECFE5524B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097982, "uuid": "4f07d4a8-4178-4768-a270-892839f9bf98", "value": "98304:/NWqv24wk1zDybo1m9hye4TFXbXzKRGlAa38Ph:VWq/PyboeozRbdKa385", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774097982, "uuid": "f3f00fa0-4c55-478c-8ef7-2d23e8fb7903", "value": 3450672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774097982, "uuid": "9d2823dc-bc84-4302-bd28-e7c1e6001dcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097982, "uuid": "79d30180-ec68-44b7-aa04-394b9278a9a4", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10f7105-2531-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774103051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774103051, "uuid": "7e766ff5-cde0-4d47-a28c-fd69d115cd18", "comment": "Malware payload (Mirai)", "value": "fed4d4bdcb04f88939abd0fd89f68a67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774103051, "uuid": "e98a4c42-3fa0-4371-942d-1e936482287d", "comment": "Malware payload (Mirai)", "value": "3008c25ab60c5397471d691d0fc7a65de533130f50933aabef6b2c00ca3118fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774103051, "uuid": "d33f3b76-8e8c-490f-a653-0d23a21fafef", "comment": "Malware payload (Mirai)", "value": "3623bb8c9e04b685e6327c6d0bcb1370b12598cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774103051, "uuid": "a648038a-624b-4b00-b888-e142cbce9c65", "comment": "Malware payload (Mirai)", "value": "0363bda62d6cb0ac0fd2d5f93810ae8025a762c97ca9577b845058ca780d0c3b350167173ad0a7334abda3cdaf8820a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774103051, "uuid": "6d6bcd54-89f3-414e-9e52-6ef7f90acb7d", "value": "T15EF3FA46EB414F03C49723B9F6DF464533339BA4E3EB7306A5246FB43A8679A0F22915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774103051, "uuid": "440d168a-4941-4ddc-99f9-afd3c2988f40", "value": "3072:oWmbBEePj/UjgmPEatQ1CMs+pG0wH13D+bhkouM/Ryr:oWE/U8OEatQ1CMsES13D+tpuM/Ryr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774103051, "uuid": "5fd51f2e-9087-4e53-9bba-0309381f5ee6", "value": 170655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774103051, "uuid": "f7d04a63-ad97-4a84-aa99-93286f61fe1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774103051, "uuid": "f3238151-a1d3-40b8-8fdc-98fc0de39f09", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5da3eae-253f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774109179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109179, "uuid": "059f39cc-2093-4481-8c27-406792be8182", "comment": "Malware payload", "value": "bc776b00d6975b77d62bc3a3b2a88715", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109179, "uuid": "f9dce2d3-14fb-4283-893b-697aa8c8caca", "comment": "Malware payload", "value": "30fb3d14c28e75295d014ff2e0d918c8df8b41b5287727c67871d0cad4ee0116", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109179, "uuid": "72f38309-7ee8-48d7-ad6c-c563f806a445", "comment": "Malware payload", "value": "c1ce38f3fd488f50d0ca8e82c3ea5e81a49ce0c8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109179, "uuid": "b0987d1c-35b6-4f35-be63-e4b402660d24", "comment": "Malware payload", "value": "f567b964d157a5d5ba1545deca6d7f9bdac8addae94aded2d947e70c462bc6a2ae486f59e4246bc8d5885eb9bb04337f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109179, "uuid": "3616f36c-2e46-48fb-88ba-a77ecc0ec899", "value": "T14457338CD5143F2ECF0E1BF123B6141B4AFA21A84E75193F7B68B56A9C86B5E1E31C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109179, "uuid": "6169765d-d758-4ebe-a084-44d9aae7138f", "value": "393216:M8cJMWSIkQp+wbf0hVG1uP6rU8Z07HdPtvSEyMqPlfFTQp+DqZrgx687hXmpS3A+:lcJMBKUwbfkHtJCPXQfl67hpqVxfDvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774109179, "uuid": "40468a64-5054-4cfd-bbd4-7414640b8cfa", "value": 29321246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774109179, "uuid": "6e14eb78-5100-48e7-b5fa-a0302aeb1eb6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109179, "uuid": "2fccd461-8be4-4657-a035-501158ecf0fd", "value": "Vilonity 16.03.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4f5597-252a-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1774100197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100197, "uuid": "1cc8887b-57ec-4844-8549-3f3233ad6b6b", "comment": "Malware payload (Arechclient2)", "value": "bc27b470ab5c5b40d216e8944ca148f6", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100197, "uuid": "dc816f19-f6d2-4724-970d-efb1a4eac55c", "comment": "Malware payload (Arechclient2)", "value": "317647954fdca6fb8508e2fe3527650cbebf0ad0cb427eb000704c51f0fb8ad5", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100197, "uuid": "a10cb3fb-88ff-421e-97f4-169992757ad9", "comment": "Malware payload (Arechclient2)", "value": "3321412cf797e94f5b0200572be502617a1d5154", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100197, "uuid": "3ae5fdda-8a73-49fc-8cbc-e2e4cd65ed8f", "comment": "Malware payload (Arechclient2)", "value": "7152952ea3f4a2d28059d904c4449d5ad6b59d1b5f907a49bd98f38c0ae3c6084cf543e3701214f877125f4b863a6e99", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100197, "uuid": "cd610a2a-003f-47a2-a658-3706b3f751b2", "value": "T12D155B6C377BA922DEDC7F7590FF5F0CD2A49EAB82825146158DA8D40FD9319A34CB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100197, "uuid": "7724059b-7f26-4d89-b597-8b1f7ba2ab24", "value": "12288:grbT6W0Nwyer1yEm6+f1ucWF64bOPZLncjzYBB7UNVKD1IcB01r:Myw1yH/YU5RLs9NV42x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100197, "uuid": "7f645ecf-3194-4703-be49-4bacce441064", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100197, "uuid": "118f75f2-e2a1-4cb5-94ff-9b685aa96d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100197, "uuid": "41a3789b-5e5a-4201-9a3f-2aa9ff23166b", "value": "317647954fdca6fb8508e2fe3527650cbebf0ad0cb427eb000704c51f0fb8ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9890cd42-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054074, "uuid": "4d272d63-5755-4388-a1cc-b44ef323bbbb", "comment": "Malware payload (PEASS-NG)", "value": "7cbbdde215620be672c1252f6517914d", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054074, "uuid": "ea3a9f2c-552a-48af-bd6b-df632ba398a8", "comment": "Malware payload (PEASS-NG)", "value": "34bbd72cda6683f6deafb627aa8f5cfeb35addeb5099d88ddaa2d59c9cf60ba3", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054074, "uuid": "846cf2f6-c72f-44ee-95a5-7ed2bb4435d9", "comment": "Malware payload (PEASS-NG)", "value": "a940d8b4c4198eb8512d2db859015b117f3a2588", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054074, "uuid": "15d83955-9f89-41eb-b7ea-bc2cf99e4c49", "comment": "Malware payload (PEASS-NG)", "value": "3fc5d05d6ba7553ef0f373490bb0a78593c00be38b0147e0e87a798eb8d8e23c8ed63daeb807c922a54282e3fadb339a", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054074, "uuid": "dc8b9c70-0192-406c-90de-ebfa2a6538d6", "value": "T1F5069D4BBCD11A45C5D5263BACFE45C4376AAFBB2B9253063D04FA7936BF08A08B5314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054074, "uuid": "df0e2da9-76f5-48c7-91c5-7b1ff46bbced", "value": "49152:c+BrG1RvwrhWMv/pyC+GghWI3UioF0XpmFA:HBrGAghWSUJGpm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054074, "uuid": "b9490d21-2d1a-4bc9-bbec-0ecc4b29b022", "value": 3790937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054074, "uuid": "ddae9d1f-7340-4513-83e3-3a9aa16651b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054074, "uuid": "8c546d56-0321-4bbb-9e36-951f497d0eef", "value": "linpeas_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21acc48f-255c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774121305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121305, "uuid": "e8a306aa-af2f-490b-8d5c-bfe8a6ecc68e", "comment": "Malware payload", "value": "80931c36f45c74fac0040eb4ec245655", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121305, "uuid": "3a4925fc-cb94-448d-99fa-abea5cd66dc9", "comment": "Malware payload", "value": "35720cc45220a15ce829d6c752b434cfde65533d6b9d2fbdcf75d3b26d79f0cf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121305, "uuid": "0875dc35-3415-4d4e-bb99-bdfd565d4eb8", "comment": "Malware payload", "value": "2d48f6dc38788a54202e76b31893e5a96ab64328", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121305, "uuid": "25907f74-bbaf-4b78-9abe-1867e487b556", "comment": "Malware payload", "value": "ecc60a53948e7756174dca2fb6d4227b1f30769976ac343bc9365205e3b60f1613553c3e04ea84254656acfe467a99e4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121305, "uuid": "fbefffa7-0337-4afc-878e-8570b98fb2ea", "value": "T1676733DAA8A00FABE037643585F461544E77FC1D2F42882B235A7259B5F36E1F2FB409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121305, "uuid": "151f6f4e-0844-4ce0-ae91-a3d293fae80c", "value": "786432:HewAf20YI94IazD9vXSw7gFat9dDe+aHG0XGG:Hej+0Y6EXrgMtb4HG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774121305, "uuid": "afc08060-2fa7-4b66-ab59-60dbadcda4a1", "value": 29818880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774121305, "uuid": "27c55a93-e801-4b36-acab-11b14ab4a5af", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121305, "uuid": "10a0bb90-cc24-4c38-8033-fc038b4e061f", "value": "RivalMods.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c677cb6d-256d-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1774128883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128883, "uuid": "d4c97e27-eb02-495e-add2-09bf0c6b3fc3", "comment": "Malware payload (SpyNote)", "value": "782d46cb899a736a7eddf9e279215c40", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128883, "uuid": "de47315a-5d54-474e-9740-9a67ebb831c1", "comment": "Malware payload (SpyNote)", "value": "372607bbdf97e253a8970876a4bb1c9419859a9b0bd9d421750f17c28995017e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128883, "uuid": "98ed69ad-58e4-4aee-9fc1-f36f290bdf69", "comment": "Malware payload (SpyNote)", "value": "178f2439502d43d33b0d6a8af7719634c4021fe1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128883, "uuid": "bb617100-5a5e-4cdb-8847-be9060776fac", "comment": "Malware payload (SpyNote)", "value": "798e9017bddcf81215f1c991d9464a2d6ac07189954a510be04861cba1a2bfd49bec2326adf6352c8cabffc9e63f029c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128883, "uuid": "dd1dd5e0-dfff-4373-817d-25899361a992", "value": "T1C3058D96FB4AF863C9F3C7364275C66A96460C584B43D7431A85723C09BBAD48B86FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128883, "uuid": "f81bc616-29c0-402f-8c01-6d02a69cc563", "value": "12288:/pH1tVJ6sgRALzZIkBs7eCN6+XQSJ5WmpYshXZPbGwidNpgz2:/pHTVJ6sjLzqkW7LQSJ5WmD9idNpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774128883, "uuid": "8a4a6fa6-476f-4343-8380-f76df7596b5f", "value": 829612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774128883, "uuid": "a34079ab-190c-4a8a-ae35-39d88e93421b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128883, "uuid": "6c90f042-ed27-4453-b1bb-1b4a954311ed", "value": "stray-vpn-setup.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c6d666-2525-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774098014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774098014, "uuid": "c5d3a689-9d9e-4342-87ea-7780153a5751", "comment": "Malware payload", "value": "bcf7beaaa99d55e87090b3d6edad14c5", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774098014, "uuid": "14f35baf-0dbb-4570-9cb4-2ee2b3d4d4dd", "comment": "Malware payload", "value": "3909222008a9cd2f2f88d6bac2ae581689e3615cb8de59df93c2ebcec242bbae", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774098014, "uuid": "7328b6a4-7f38-4b67-acb8-8039ffe06ca9", "comment": "Malware payload", "value": "4490c430c379e15a67b8e83e83d4ffa68a592fb5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774098014, "uuid": "cb25a141-a81f-49bd-b175-c2548c980937", "comment": "Malware payload", "value": "6bff83b4662a5afe8dc0078027e22bb88dba60953e3198c07c35706825d548e7f75083245ff9348d27b9434f42b14159", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774098014, "uuid": "50cfcfa9-1086-46e7-bf30-855255f08644", "value": "T1C167335C1DF10B01E52A7AFDD5C0AF60F6815586BEB9F124223A86D3BA4DC778C06CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774098014, "uuid": "e433b2d1-b69f-49d5-8347-74e4ce6f6f42", "value": "786432:9GnCYF0UG8WSM29ChdwQfosckkHEENxgaqzKDKgRSpjwV9+h:SF0l8WSUhdwXscRDgku4ajwVch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774098014, "uuid": "31329093-c94a-4cb8-9f95-297614ef6a2c", "value": 31577998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774098014, "uuid": "4a576419-68a9-48a9-ad07-ca1b2c73c1af", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774098014, "uuid": "6c8a4aed-b16c-4dac-aacf-1ab615400362", "value": "822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e351eab-250f-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774088443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088443, "uuid": "dbb94625-0527-43a6-b3e0-3557e25848ad", "comment": "Malware payload (NetSupport)", "value": "04dd4c27b724b91cfdbfde7c6ebedd64", "object_relation": "md5", "Tag": [ { "name": "coastal-dwindlingoverlord-com", "colour": "#0FD9B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uuaa-faser-tech-info", "colour": "#098567", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088443, "uuid": "7fd2a8d2-1b3c-4686-88d4-1704cf3d6c3c", "comment": "Malware payload (NetSupport)", "value": "39da6dfa5c8565017175ac05cc6d612a1a1e6b4fe70f5fe6aca049b1c0607514", "object_relation": "sha256", "Tag": [ { "name": "coastal-dwindlingoverlord-com", "colour": "#0FD9B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uuaa-faser-tech-info", "colour": "#098567", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088443, "uuid": "40e41448-169f-478d-976e-f1faf2cb442a", "comment": "Malware payload (NetSupport)", "value": "2225f90d526257d3362ded818d9a671a264c9b84", "object_relation": "sha1", "Tag": [ { "name": "coastal-dwindlingoverlord-com", "colour": "#0FD9B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uuaa-faser-tech-info", "colour": "#098567", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088443, "uuid": "e9c17976-98af-47b9-bbd2-7d29c1f2d873", "comment": "Malware payload (NetSupport)", "value": "e3f2f9758d6547f6da1f489245c17ba61483901dde2017c7d434845f4540748398e2159bc28f0dd2def255249c70fcc2", "object_relation": "sha3-384", "Tag": [ { "name": "coastal-dwindlingoverlord-com", "colour": "#0FD9B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uuaa-faser-tech-info", "colour": "#098567", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088443, "uuid": "38cd5f71-14c1-44e0-a97d-bfcfda7bbb08", "value": "T1863694D97BC457E46928DBDC824775DE1394A13E6FBB180D02E048BA381EE1766E0CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088443, "uuid": "37c9684f-9892-4246-ac35-af99943de968", "value": "24576:HvMxUBFAz9A8VcbKGl+C9Jw6SII8oIV4KU5PBlvsHWbNIbWyzoPB3lCH:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774088443, "uuid": "da36a35c-4c43-4501-94ea-d47e85ba413f", "value": 5007014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774088443, "uuid": "b278ab20-af14-4f2c-950c-3b338d7aea4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088443, "uuid": "b826ca52-af1c-4d96-b162-abaeb98ed017", "value": "denyexorcist.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41219bb4-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053927, "uuid": "1769cda3-bad1-486f-8fc2-09c9b74ebadc", "comment": "Malware payload (PEASS-NG)", "value": "a83c47ab8c4244fc2abec6f91c1a88f3", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053927, "uuid": "88e78c89-a34c-44f7-a213-bc927a553a03", "comment": "Malware payload (PEASS-NG)", "value": "3a20d1a83c122e5bbd010738e1978106167f8db873780d836cad8bca11bff5be", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053927, "uuid": "c77e203d-4c43-464b-8554-8b9f8552483c", "comment": "Malware payload (PEASS-NG)", "value": "8791472be1387eb4a3a425b8eb7bda7f8c634b84", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053927, "uuid": "15f95dc8-5685-42ba-931b-9548e515acce", "comment": "Malware payload (PEASS-NG)", "value": "fff65bab49581c6718531d0cbcc948bbcb48d0f0428bccbaee2b389d334bddcac865b953e705d39b21b7d54dc3089dc9", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053927, "uuid": "da37f5dd-0aad-4f4c-9031-c3e5e5455a6f", "value": "T15D06AE4B7DE03994C626523B89EA69C26B7DFD472B3113C73E40737A2A726D618F4324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053927, "uuid": "7dd18267-03e0-4e13-a346-d1ae93a02571", "value": "24576:TPIiyXWV8uGQSYsHw2Sn1WvxdyCy91h+Tlzav7NGEJgypHb8BrjeK45L+/VPHIck:TPLqWVBGjY08lDlFHw9VsaPqk48dSGPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053927, "uuid": "eb8d5fb7-2cff-463a-a6fb-850093cfcf85", "value": 3923528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053927, "uuid": "4303b03e-dc9f-43bb-83e6-68b567d01343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053927, "uuid": "3c455847-7883-4318-af72-546fd85018cd", "value": "linpeas_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0c458a-2512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774089567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089567, "uuid": "96950cfc-89bd-4cc8-8c9b-db4531ab9898", "comment": "Malware payload", "value": "76c1d85a3cdfa807ebd976c2f5c741c4", "object_relation": "md5", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089567, "uuid": "b548752a-b9f9-46df-98aa-c009fa4c78f9", "comment": "Malware payload", "value": "3ad8820c0e4f064af92e8e7761b07d6f8c6c4dc91b096debb4bb302d1e375422", "object_relation": "sha256", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089567, "uuid": "62d4b70d-b25a-4ed4-a0e2-35a24f826c9c", "comment": "Malware payload", "value": "fcf92b2b6872053d2656bd2a45b085783881e319", "object_relation": "sha1", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089567, "uuid": "056b99a2-23b4-4339-999a-4cc665465e20", "comment": "Malware payload", "value": "7e4c7f11ff4839f986914af9461279f1414600e7d8885fc2927997ba9668a0d497e6f8f52b6fa42790bce7c064596568", "object_relation": "sha3-384", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089567, "uuid": "52177634-0b95-4b71-a11f-d0c6944cb290", "value": "T1B322C89A90B3403899C2C6C41F74AF855679D00F8509D8647FDD2698CF4EECAEEAB34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089567, "uuid": "2de386b4-ee8d-46e8-8608-2615a07b068d", "value": "192:Br6cMOY6Q3ux0S1w9oIiH4IlHanSqQb9SvmILSPXgzqD/F5QZrUK5AhgnxHD/EWx:Br80B/zoUP6HvtMWPOZ0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089567, "uuid": "1bd07b46-d683-4a91-b70f-5caec216e301", "value": 10699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089567, "uuid": "40ce8838-e478-4b7d-ab92-cafe9521bfa2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089567, "uuid": "db5a4843-9844-4ff2-aca8-82d60bcfefd4", "value": "3ad8820c0e4f064af92e8e7761b07d6f8c6c4dc91b096debb4bb302d1e375422.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120a2aa5-252b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774100234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100234, "uuid": "894b6d7e-3351-4870-9d84-4bfb8b05610f", "comment": "Malware payload", "value": "d8052aa4b493c4058ea707f29669d693", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100234, "uuid": "a0e35fd5-5bf9-49ad-8732-f31caa929738", "comment": "Malware payload", "value": "3ae10af093c417a22f7fe9a9dd65356f0d13fd1186e06acc405b50c89265a69d", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100234, "uuid": "bb45b30e-884c-4c39-ad59-fe97a72107d0", "comment": "Malware payload", "value": "230af4a431db53d0f0181a434c6ab1ca923c9758", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100234, "uuid": "be7ba5f9-598d-497f-903f-8c669f87d275", "comment": "Malware payload", "value": "5f36eab881f6dec03fedafe082cb6e5c5f886d7e451234828ff402c2d53b7300b540eb1a9fc2fb454e9e742c8e8bd22b", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100234, "uuid": "3807946f-9b6c-4aa7-ba8d-a72feaf1e392", "value": "T18636D031927278D9EA3753BFA0AC4FD58014B5F0B519EA6B337C2FB58E9064661B2D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100234, "uuid": "7fdbeb18-3ac0-4ae0-bec8-1e829f8b9e38", "value": "98304:4sYdMV396AM4veHjPMNad8F1feD91Y+K:4S1eH9dQZeD91Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100234, "uuid": "15bcafe2-c8bb-41e4-a8ea-ac3f891185a9", "value": 4895744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100234, "uuid": "ab52e746-a870-4b12-a2b8-b114761aa91a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100234, "uuid": "9fcb7ab2-86ab-456b-be42-3986d3eeec6c", "value": "MicrosoftEdgeUpdateTaskMachineCoreC.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c905cd-2539-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774106300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106300, "uuid": "fedb0632-f84b-4197-8701-4ad7ec57820f", "comment": "Malware payload", "value": "54fcebd434293705efb5089849cce606", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106300, "uuid": "07474430-0a8c-4659-b7c8-3782c1c0c0a4", "comment": "Malware payload", "value": "3b63d262d09d97903310c1c469924413866abe013e93cd290f11d39a3eaffbb1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106300, "uuid": "b50b8052-17d3-47c5-bf24-68a388eb59dc", "comment": "Malware payload", "value": "b95461a1de4642dd26edaa18ee976bb1b0e96efb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106300, "uuid": "be65c415-5c57-4dad-be6d-fa89977d1da3", "comment": "Malware payload", "value": "4ed1e352cf8c543faef7b38adca662ef5c8aa5c7b6fe5d5352dac7e90706393d33491395940a59503c557617ca96da05", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106300, "uuid": "85f51f83-0dcf-4c4a-9aae-de4f21214776", "value": "T134925DB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA4F39205A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106300, "uuid": "ec67f8ab-496c-4f9f-b03c-8baeaaa12366", "value": "384:cFcuQpWx+BL0SWL0g4zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:cF8i+BL0SI0bzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774106300, "uuid": "14e806f9-601c-4d12-b8b1-85fdae0b44ec", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774106300, "uuid": "4b06e773-0cc4-4e94-9d52-3bbe32d39c2e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106300, "uuid": "e8138915-c7ab-436b-a334-1130be7a1861", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485d5569-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057375, "uuid": "1acdc6bb-1a54-495b-bcfc-16e14052b842", "comment": "Malware payload (PEASS-NG)", "value": "3607658d5780acebd6c00e02e3aa4473", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057375, "uuid": "2ea679eb-c6ed-42e8-9f2c-20563f2bb518", "comment": "Malware payload (PEASS-NG)", "value": "3c1534bf261eb0924b7f6e32114e8da523518accc502e309104ebc16b5bddb9d", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057375, "uuid": "b74d4908-9c6a-4196-a6e0-185082643cc2", "comment": "Malware payload (PEASS-NG)", "value": "bae81663cf511fdae7c8217f9cefbb4cbfca9835", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057375, "uuid": "38e06de8-2733-4e7f-9616-205e48fd95c0", "comment": "Malware payload (PEASS-NG)", "value": "d630f420dae140ce3696f9f56e80d0e363e3ae1b7ceb05b9bc85096191ea50fbab63b68e04c325d644d6167fc233d6a5", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057375, "uuid": "86998017-5b15-4170-bf07-f747e4d5eaff", "value": "T13F069D4BBCD11A45C5D5263BACFE45C437A9AFBB2B9253063D04FA7936BF08A08B5314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057375, "uuid": "e8e89806-d34d-403f-969c-eb7cf331febe", "value": "24576:uPug3p8BlFtem9DNoAUWbtIAyeNO15TWdA/hwHYxhfO7Duq8ZMX0s5tEnyVu3jyE:u+BrG1RvwFVh3+GghWI3UioF0XpmFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057375, "uuid": "ce48a19f-c5c3-4c61-995d-ad362d7312ac", "value": 3790937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057375, "uuid": "1f163d00-9026-4f1d-9827-611295c7daf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057375, "uuid": "38e31f2c-3f91-4839-bce7-32c2a0906d57", "value": "linpeas_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c965683-2507-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774084763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084763, "uuid": "96c588eb-f121-45f7-a8ce-9cf7fe144d22", "comment": "Malware payload (NetSupport)", "value": "b604b89db5374d3fdcee2b5bd890483a", "object_relation": "md5", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084763, "uuid": "f007e1a1-074f-4e30-9baf-0f2ff2ecffa4", "comment": "Malware payload (NetSupport)", "value": "3d0f9aefe715a2e2be75cc33040dfbe5289cabd93450f4c132644db62c56f439", "object_relation": "sha256", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084763, "uuid": "c67e2406-63e3-4d03-b129-a6b0cdb94a5c", "comment": "Malware payload (NetSupport)", "value": "673354f5779999834cfb5cbd9229012de6c82fc7", "object_relation": "sha1", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084763, "uuid": "122f53dd-8a63-488a-b6f9-341621610fa5", "comment": "Malware payload (NetSupport)", "value": "bf54fa3ee83e75924fb7131ce63370720257da89b7885c2ae5ac285abd5a843c9bf33a8b3bfb7ce3ed49e2698a53ddd8", "object_relation": "sha3-384", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084763, "uuid": "5dc6d7f6-667f-418e-a5b5-d4a114c6dc0b", "value": "T11972C036E3046D9BC5F1C43A5DBD3556D2F2C84D62B6639C3522C008A6B6F7540EB61F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084763, "uuid": "3ef8f48e-0a7d-463c-b3f3-b6b93c245809", "value": "384:F6sCYEe35gfQDnNQ1lYOYWY9Z1TeghW2Joevrc4O/1Rd:xCYZJgyNQ1WVj1bhZzgZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774084763, "uuid": "5cec51fe-0736-4ad8-b218-4bb5ac9edf56", "value": 17146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774084763, "uuid": "77c18eb8-540c-4716-adef-e38b77dca28b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084763, "uuid": "5f3c9abf-1c03-42fa-af31-f396dd523818", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f079fc-256b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774127708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127708, "uuid": "7a82ab3f-4cb6-4821-81bc-c97a77268a56", "comment": "Malware payload (Mirai)", "value": "e05776fbbdcc497ff5c2fbec1778f3ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127708, "uuid": "0aadd8f9-1025-406d-8dfb-34679d42ccda", "comment": "Malware payload (Mirai)", "value": "3e292845bfdf3196c53392cb1478212a0b7e0f804230548b72d1541b3aa5248b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127708, "uuid": "84a205ed-8508-4ebe-bbff-7c821cac5908", "comment": "Malware payload (Mirai)", "value": "54f116ddddd71a688994e6e2759fee421b679697", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127708, "uuid": "7f4e5445-2272-45e0-8404-72f5026a3c01", "comment": "Malware payload (Mirai)", "value": "1a49af5a8349dc5efeb5c978c49a2e041c8fe8a03ced0da36c1ae31b869230f00d8e3bc80a01bebfa522f2a22f1b0249", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127708, "uuid": "904d5e43-551a-4b23-888b-727660be801b", "value": "T124B30A52BE519F13C5C722F6B7AE464837137B7CD6EA3102ED247F60274A8EA0E27611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127708, "uuid": "457fa532-1d68-4abb-b090-c6ae68129a85", "value": "3072:5O8WhCLkz2pF6+hDzuUVy1SIRyjQbMRQr+X:53kCLW2pFt/Vy1SIEzR4+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774127708, "uuid": "eb852f1e-c268-49d0-a994-35d90dbd00ed", "value": 117148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774127708, "uuid": "c22d40b5-7cab-4aa2-9e90-c1a89b3ab922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127708, "uuid": "59b8f908-7281-4ba3-9235-7dd1be6f6bdf", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb17ee1-2567-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774126102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126102, "uuid": "2fa253ff-db4a-4593-8864-ba3745aca677", "comment": "Malware payload (Mirai)", "value": "6610ef10fce6c832aae62ba55eb2ad73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126102, "uuid": "f25144cf-f200-428f-be64-25831372f2b9", "comment": "Malware payload (Mirai)", "value": "3fd20cfd1c884f1f43eb28bb02a486f12a235e292c940842817cb87ca11be300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126102, "uuid": "e7b0dcaa-58ec-4fa2-92f3-11e842b36585", "comment": "Malware payload (Mirai)", "value": "fe250c5d491748b2ee34f3333cd027f45ee8a85c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126102, "uuid": "79a0da12-52b4-4a88-81d6-fe3238366c12", "comment": "Malware payload (Mirai)", "value": "887b643e367ae83860b3cc6a7c74d6ef2f185126bcf6d7fa99268a5ebff4b5cdd517f4d5d44717ecf80b3808362eaddd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126102, "uuid": "331fc43a-fa06-4d7d-93d3-408f9a9de735", "value": "T1EA156C5BB2A374BDC057C43443ABDAB2A935B42502226E7F65C8DB303E17E701B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126102, "uuid": "c020fb01-a70c-46c0-bd10-eb608a0b7e5f", "value": "12288:ee8sCO+BjF4s9bD/gkgOOCaLLvNuvhV+tL6Led/kA2P0F8Tch6dzuFgkJy1nkR4H:isHY4sykgOt6lupV+tL6LedIPLTJEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774126102, "uuid": "6b386f43-6b51-4ed7-b0fa-e23272b438ab", "value": 902856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774126102, "uuid": "8cd7ec19-41bb-45fd-980f-b1bab60a9e71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126102, "uuid": "43ada6b3-eb86-424e-a36a-fee4d1c73689", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5523b791-250c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774087032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087032, "uuid": "2621d64b-a23b-4c92-be16-acfe34bac593", "comment": "Malware payload (RemcosRAT)", "value": "1f6691644d5e8a16c08c06bc0de3228f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087032, "uuid": "797d5c68-7a3d-405e-aba1-5dbcb83cd115", "comment": "Malware payload (RemcosRAT)", "value": "401ce6db92e4eaa12db08edf230bae05e15117ae737b221358827c9af40d7e34", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087032, "uuid": "7c87a752-30c4-45f7-9d57-910061bf4664", "comment": "Malware payload (RemcosRAT)", "value": "6d7b69cd0aa5614f581a53eb4b472a5cc7600de6", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087032, "uuid": "903a8351-5575-4a08-a678-31ebcbc8f251", "comment": "Malware payload (RemcosRAT)", "value": "11219b3059bec3f6e72608317b93df4181048aedd1e55991f70ac8461a1807ead461c560672e52dfa2c3c4a0c7f2ba1c", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087032, "uuid": "036db58d-4126-429f-b0f2-b9583290c46a", "value": "T15A667C0A62EA41E9D0B6D138CD5745AFD672BC554B3297CF0171BA0A6F3B2D08E39732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087032, "uuid": "002becdb-8cac-4fda-bb03-fe03f7575c1c", "value": "257670f56ff8877f9177ae6446e88b54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087032, "uuid": "86c9b68b-00d0-4415-8fc5-5bdbdcfce38c", "value": "98304:vLRwVnV9ctO4GqNL5Hnw9qLGUqk0Nyzp0BM:lyctO3qNL5HqPk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774087032, "uuid": "e1b4de50-8e23-47b4-adff-420f9c63ceea", "value": 6874624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774087032, "uuid": "66eb41c0-c2c4-44fa-b269-5f779482706d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087032, "uuid": "ab128a95-18a0-4131-8222-fe8d712f08a8", "value": "e34ef072b4ed69c4302cd9683fb9eeaf7e142059615d475df24930076a16406f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a043f2-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057389, "uuid": "c165018b-62b9-4747-bd24-c75ce2a5c668", "comment": "Malware payload (PEASS-NG)", "value": "8c4bc2232f7cd6f332b8eb65801a5dc3", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057389, "uuid": "e0cade03-eed7-4f78-8ab1-67fd77e5c4b5", "comment": "Malware payload (PEASS-NG)", "value": "42971c5adb3f6ddece9ecfc9e58865c339fd04c0e98ed7ea8e329f61bb310330", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057389, "uuid": "a01d6780-a3aa-4484-a059-5f7404a9cbca", "comment": "Malware payload (PEASS-NG)", "value": "ca839b8769625a8e32d28fec0d0664c904862e8f", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057389, "uuid": "82d233a0-7ec0-47ff-9f97-be43ecfcde87", "comment": "Malware payload (PEASS-NG)", "value": "51bb66a5fad9ad2f96c076afb3444311a5ff019c92bc68c76bea7426836e491d50486344d7d1418a5f95e4b5f2550ac2", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057389, "uuid": "b7f9b061-abff-4b22-b636-ab7e3809a794", "value": "T1E77337446817763B927BC2390DB61E6011F75F4E36A6232A347D719E8FB208D7819CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057389, "uuid": "c1554ed1-cb01-4940-a25b-8d3a895a1219", "value": "1536:ozcD2mmmyBBR0LhPa53Mqfiiiiii28BX+p5qiiiiiiiiifiiiiiiiiiiiiiixqGB:6cTgDjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057389, "uuid": "81de019c-5c34-491f-a821-4c7a2c155d6e", "value": 78883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057389, "uuid": "17f12300-087e-40c7-bad7-6abeffc92f22", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057389, "uuid": "156d943c-0c4a-4d87-acea-a549f2bb119e", "value": "linpeas_small.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e97e6bd-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057332, "uuid": "2cdde17d-86e3-4326-bba4-fd183ce8f2a3", "comment": "Malware payload (PEASS-NG)", "value": "2f374c4f64871a49e2258a2b7645d260", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057332, "uuid": "d8a9f34a-9169-4886-88d5-c2fe8602413b", "comment": "Malware payload (PEASS-NG)", "value": "42e2df5d70c07bb247b66dc8551d81f7d725282e071439f25109f8b5216c3d2f", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057332, "uuid": "8deeaece-f30e-4ab5-97a4-25bf15acb1ec", "comment": "Malware payload (PEASS-NG)", "value": "80c907f55c2e2ce5d9549a858655ca896eb8284c", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057332, "uuid": "9500e3fe-8ac9-47ce-8f59-09fb5c1357f1", "comment": "Malware payload (PEASS-NG)", "value": "c2b2449f9f4ead4afa5937ac97654c4dff62f3ebe689069a25c657c423f787881ddd0b875d15994d0e20410e2df8bf0a", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057332, "uuid": "f3e09fd6-16b4-4198-903b-ef59fcaeaa69", "value": "T131B6D04062DD046DD6AF0E79906202324B35761A579A8BC7FBCCC0980F5BFE29F76726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057332, "uuid": "a8718e79-ffcb-4f7a-ba55-9430db5960dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057332, "uuid": "b21c8b3f-9e2c-4b40-bc41-0048febb388a", "value": "98304:3oKcJJHhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qj:YPzHVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057332, "uuid": "636eb14f-94c9-48a7-b83e-7d0a9e14e95d", "value": 10961920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057332, "uuid": "2b8ca0ca-020e-4a52-a0be-5d2103b9e674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057332, "uuid": "cbd0995a-5a22-4d34-9256-7d7092831e6f", "value": "winPEASx86_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea597328-2551-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1774116917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774116917, "uuid": "c32c3cf1-62f1-48f0-b8a4-88d02fa78ecd", "comment": "Malware payload (RatonRAT)", "value": "c61e5b9039c9926fe493a90d6289c4a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774116917, "uuid": "30d44999-c024-4a1b-8c70-34b0aa782e1d", "comment": "Malware payload (RatonRAT)", "value": "42ec685129d82a5f097fb5357e7f6ff27ab094d8f57eccd701e25fa1bc0f4d5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774116917, "uuid": "b29027e9-4413-4d4e-8a7e-a1e1be8bc7df", "comment": "Malware payload (RatonRAT)", "value": "998ca62eecbf88e8756b0a8eecb0eb7f71514f31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774116917, "uuid": "b96392ba-8779-4028-8aaf-2e80c68acca1", "comment": "Malware payload (RatonRAT)", "value": "4ec183cf4db5acbb2a41669abb8fed4cc87a0109023796006a4dbec29c0c70dfc268970c21f06fd3ca5dd3760aa6c6b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774116917, "uuid": "53951e86-f4fb-4b82-82b3-a7e787b8e7d3", "value": "T1DB06DF44BBD4CA1BE5AF87B6B4F246120775EC15E792E70B199037B81CB37042D293AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774116917, "uuid": "487cee43-fee6-417d-b233-6452d8738c29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774116917, "uuid": "73cea288-41fc-4338-862d-3b8ffda65a41", "value": "49152:XVUBAJWgVUlsHjkmiGWU5+5WeLGpMZ7iKPfg+DTeC:fJWgVUuHjkDGjYQeqpgmd6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774116917, "uuid": "12de7fcb-37d1-475a-8ce3-0bfac927579f", "value": 3692032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774116917, "uuid": "fdd61325-b013-4195-861d-e79f25be4d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774116917, "uuid": "aebc5074-9dcf-4300-8355-ee03f019102a", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce35605-256b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774127901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127901, "uuid": "fa926729-5971-4bf9-9691-baa93bd5102a", "comment": "Malware payload (Mirai)", "value": "86d6e09dddbf4d22765efcce2a61397a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127901, "uuid": "213c23aa-9bd7-438e-ab1a-ea505c01e912", "comment": "Malware payload (Mirai)", "value": "43b46bfaee6d5fc8e8ba75f58ce93155bf3fcbc1e7f6c03d2a7af023a29dfeb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127901, "uuid": "ba56da9c-2bf8-4535-afd1-db60f9e65214", "comment": "Malware payload (Mirai)", "value": "d0c763149cb6c7e3cc43d8a36668c552a8ba9c57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127901, "uuid": "f69c78c1-ddca-4a34-add7-cde39abe0232", "comment": "Malware payload (Mirai)", "value": "a0da4f30136c8430a50ecadbcb95fb16dfaae12dcc4e4cd2799f1a7a19c8f0e9867ca5a06639db65602446f68815257d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127901, "uuid": "442008e8-f591-4f46-aae6-6b261694f36d", "value": "T130F3D60ABF600FBBEC6BDD7702E90B0125CCB85715B93B797534E818B60A18B5AD3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127901, "uuid": "5c4a9afe-652b-4c49-aa6b-01dd59cb2c0d", "value": "1536:qU47NHF7d85/nhaNd3H4sExiRW30Lx9XIMgAGjZTkFgF3tTqxYpZEsStWPKDvUua:+Z85/hasjAWhYFu5dS9lCa+7R8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774127901, "uuid": "f447f1be-5adb-45af-ab2a-463ce46880d5", "value": 157768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774127901, "uuid": "e0b16b5c-7278-4c89-9335-f0b1be66af30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127901, "uuid": "b3381cac-5e1a-4547-a0b5-0f16d85d6c3e", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8cff1e-2536-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774105214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105214, "uuid": "2c4e6cf2-3db3-4edd-b236-1a232c25ca7f", "comment": "Malware payload", "value": "2d641f822cd71413cf1cd4695169f997", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105214, "uuid": "aa24e4e6-8fc7-459f-8679-dba76a363d38", "comment": "Malware payload", "value": "44531bf62abff2489bee13e6f4dbd962302aa7c7b88197d0249de9adf829d018", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105214, "uuid": "6e00e2b8-fb65-467a-854f-609f65b11a31", "comment": "Malware payload", "value": "b2a27095649a00b17d99dc43791e6c3601311f27", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105214, "uuid": "4ab8262b-078a-4191-9cf4-ac2e6b451017", "comment": "Malware payload", "value": "d937a3991cca8f24873fd58b8ff4b546263983365e7096d81d3fa8805a4c87655522970f159b8563e2ca84d896380515", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105214, "uuid": "d4caf540-cfd6-49d1-94c2-9bfa2cda6230", "value": "T1ED77F146F20CD92BC9EAF07C9D8B07D7B8116C565710C28B2921B60DBFB37D49A52BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105214, "uuid": "8f82de12-90d5-4ae0-9108-89c0ae587717", "value": "393216:vw3H13jUELTp/evJ8ZpQxfWy/r5wG+1BZatPHRrQxCuKrW701QCFUCa0++Mv:IFbR/eOZGxfj/lL+nItPxcFv4S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774105214, "uuid": "ee49f6b3-25d1-47ff-840a-ce0eaca9e78c", "value": 32916172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774105214, "uuid": "18a50962-b912-4f0a-8aff-5d9de7331f23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105214, "uuid": "e609fbfa-e4b5-42a9-b408-4505bafa17b7", "value": "com.text.sms.textmessage.messaging_4.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b789499-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053971, "uuid": "8c8d2270-26a2-4378-86ef-45dd47915c8e", "comment": "Malware payload (PEASS-NG)", "value": "9d8337720fb735e1b6964d50e35515a9", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053971, "uuid": "961b450a-2b87-4f89-93a6-7b53aea67397", "comment": "Malware payload (PEASS-NG)", "value": "447cbf2449ef80c203b28b5fe74ec819b3cb1ea3f95869e411385d4338e6d828", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053971, "uuid": "7b0b67fe-0220-4746-aadb-f48ce38cef35", "comment": "Malware payload (PEASS-NG)", "value": "91852c8e633ce89d7dfcd70c119a0f5a389bc38a", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053971, "uuid": "2ee8c5d7-c546-4005-9146-62c5c7a2e351", "comment": "Malware payload (PEASS-NG)", "value": "c938b8b266061310da821f6c5285e88670ea25a85a33deadbc96a86f4da6c21a2939eb142d1b03a5700ae4912afd6737", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053971, "uuid": "7b3c6315-b0d1-4d77-8b50-ce48e2acbe75", "value": "T11AB6D044A2D9096AD5AF4E7D806102321739760A139ACBCBFBCC82980F57FE5D777326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053971, "uuid": "4ad61ef8-356c-46d3-a29b-f6d7aa401c10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053971, "uuid": "9089f21f-08a3-450b-80cc-77650f109eee", "value": "196608:tV5/AVBFUcwti7TQlyVN8iNISRTRmW5QWP:3xYHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053971, "uuid": "bb9c43df-49de-4558-8fc0-51275bfb66b6", "value": 11108864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053971, "uuid": "d5dec06e-4d67-4e9b-b5a5-8149c62bf98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053971, "uuid": "38c12e09-4523-45a4-a3cb-b7d7aff4f6f5", "value": "winPEASx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61434a2-254f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774115971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774115971, "uuid": "215099b6-679c-4a55-8cc8-d041eec488a6", "comment": "Malware payload", "value": "0cbf4d9a7440d731118df453f4d0bc18", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774115971, "uuid": "dbd49534-4b82-49ec-bd9f-0fb1f35fc341", "comment": "Malware payload", "value": "44bcb51ef26fe58edd36ea97714f79d9ac9772ee62e3bdbcfbcf4469fedff337", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774115971, "uuid": "58cce18c-ae28-42a1-8587-ea1c46523e8d", "comment": "Malware payload", "value": "7b8f1bf49429585ee87978a024f0833ace2978bc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774115971, "uuid": "06c73df3-b6c6-4f23-af0d-c1ee023d215e", "comment": "Malware payload", "value": "f182a1116acec9e13d8c654b21313af6ae36f44664b6ed76ef734da06b80a19402e34dec14c46bd2e3507c835d5bd25e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774115971, "uuid": "78b16d40-c721-4d8a-b3cc-bf5b4457bce7", "value": "T10696C67B216442AAC15D82FEC0A28E4BDCF366791F2385F702510FDBFA159C59D7AE20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774115971, "uuid": "e94e2fcb-1b88-4578-87d7-748b9098c533", "value": "3ddebb65c2eb980f7e40797e62c34d3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774115971, "uuid": "3c3202ce-9529-4c07-8041-c1c7874d4b7b", "value": "49152:hIpabd5kc+rOhiMj7g5Fh+uuddlS4hwo+MVhRBPO3+8Q0KHAGCG71UM3rohR2khB:BH3Ou81KHlx3cWk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774115971, "uuid": "36bfb2be-9e0d-4f43-a0ed-487683eee588", "value": 8960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774115971, "uuid": "41fd2297-fa3f-4ebc-bd04-d3513eb62413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774115971, "uuid": "beef98d4-c603-4484-9db4-d9089a155af1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d806da-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057316, "uuid": "a23c21b1-c73b-4c34-87bc-f5bafcae8c5f", "comment": "Malware payload (PEASS-NG)", "value": "02c7b4fa2ac5d07aa3fa841a5012b173", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057316, "uuid": "bacfd7ac-4c4d-4df6-b76a-da5be4f930f4", "comment": "Malware payload (PEASS-NG)", "value": "46ffe7a6284023dfb161e46b56c06c6dcec626a32d4b188a28a5d5b404486f05", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057316, "uuid": "ace9ace0-3294-4ed3-bb29-ddcbf0f2a290", "comment": "Malware payload (PEASS-NG)", "value": "729426889802702e3b496bd21c25a82b90d1880b", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057316, "uuid": "01176b35-213a-43f6-b431-5675d7589d08", "comment": "Malware payload (PEASS-NG)", "value": "b11294f92171a2fbc975cb9103c005a0699891c8eb4871eab23e2d8dd8cd0d0cb8df7d901275a4cafba4ba6c9c0b4a08", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057316, "uuid": "453da54c-aa6c-4f4c-af30-926e59d747c6", "value": "T173069E4B7DD22A05C5D5363FACEE45C537ADAF7B2A9252063D04FA7A31BE09E08B4314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057316, "uuid": "ff41d3b8-6627-4b6a-a677-86c9c21b92e7", "value": "24576:cwKYHv2Gn0cm5wEFy1xBjcCjd/6HOkdVtKkEUkhcOWDufh8Fgn1WvxxqvGtm+mYc:Z26AuoER+wArnhdghWIl8YNXpm1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057316, "uuid": "8904270c-33fb-4b05-8669-ffc9180b5c23", "value": 3856497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057316, "uuid": "b369740d-7b1e-4c6b-a83b-56539dd25110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057316, "uuid": "f72fac6d-1159-4e52-b9bd-d98bf83b25c9", "value": "linpeas_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10695fb-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054168, "uuid": "c3ceeac8-4362-4226-a00a-5f74157a3e55", "comment": "Malware payload (PEASS-NG)", "value": "d0b8b5fae5b0868e441e30367a2e819d", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054168, "uuid": "0269be30-c5cb-4584-ab41-f7979b8c5fcf", "comment": "Malware payload (PEASS-NG)", "value": "476fea13d8ecfa9e452dac5a3f0a6b124584192a5657aad30bb13fbcb4e0837c", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054168, "uuid": "2463834f-dbba-4543-8d5f-ec959a70f442", "comment": "Malware payload (PEASS-NG)", "value": "a7308d9ade0dcb41d49f8ef801bd8ae3d21f7bd6", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054168, "uuid": "a594120a-628b-4c4d-a61f-cc81a345c23a", "comment": "Malware payload (PEASS-NG)", "value": "38f7ee6c9b8845cc4243ac141573fa6f657b19c6398c079163607c0f5a62bcf5eb0f5b6d5071a3886d7ce0d3eef13589", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054168, "uuid": "d8015afe-616b-4c2f-83d0-ab8c8df3de0f", "value": "T161069E0BBCA02590C52A533B49EA59C22B79FE4B2F3217D73A40B3B52F726D654F9314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054168, "uuid": "533008c2-963f-40e9-8d75-f5d85deb76a3", "value": "49152:d7x/ogdtO+aGrFxuv/py+f9Anl8lD6nxKl2Qfeap4tEX4gSfh:d7ZHOpV9A+snx+tT+Ndfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054168, "uuid": "1901f814-5b16-4785-adde-c48ffc77eae0", "value": 3794432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054168, "uuid": "4de87b7d-fc83-400a-95c8-967ef02b093f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054168, "uuid": "cbf37ead-0a9a-4e90-bbf4-8901fc813d66", "value": "linpeas_darwin_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abee7a60-2577-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774133134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774133134, "uuid": "ab4c98a9-e592-414f-a47f-eeca464a5564", "comment": "Malware payload (Mirai)", "value": "2ef9377044a1758d6853e8787421c5c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774133134, "uuid": "12e422fa-e969-49f6-945e-a3a7c0221fd5", "comment": "Malware payload (Mirai)", "value": "47de78a9f1d77c718dc70b98c967615fcad00696e1aad515efeb3e5d5709d1d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774133134, "uuid": "d4388093-615d-41a5-b318-ea22154e0974", "comment": "Malware payload (Mirai)", "value": "f0b3dfa60b2712378e75cbaf468d28697623cc1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774133134, "uuid": "ef6c89e3-3540-4165-a3b1-0eca75b8be40", "comment": "Malware payload (Mirai)", "value": "e6342ffdf7cd9bddf7bab2491e4bccce2c6d684a234c98934d465352b9747a1f8482d6c3b30545fc64bff4091fd9c8d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774133134, "uuid": "560027c0-5eaf-425a-84b1-e965b603fc3b", "value": "T159634C02B31C094BF5E65EB0393F1BE093AFE98021E4B685690EDB459272F735585FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774133134, "uuid": "2f68a989-aedf-4108-945e-82656886058c", "value": "768:rqQew44zXX1uSJqt3nRkyybYPfmBkRvC977ZzjrgR34QRyuJZm34FD9zZNab0F6F:kZ4zX1uSod0eY79IvkuvmIF5z/Ifgg1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774133134, "uuid": "6ef7688b-50d1-43ec-96b7-42cc8551b6c3", "value": 69168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774133134, "uuid": "e543a908-ceae-4a87-8af7-8b07c7d0289d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774133134, "uuid": "f4f0c27d-df05-44a3-bb38-ec85c3ae65b8", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000a601f-250b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774086460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086460, "uuid": "3aef30fd-20f6-46db-a089-61ca6f57079a", "comment": "Malware payload", "value": "a7a91b3ec93356abea4cc30ac3549957", "object_relation": "md5", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086460, "uuid": "d272dd8c-9b64-402e-93e2-1ee54e000447", "comment": "Malware payload", "value": "48428482b92b9ed8b3eed42e19cda38b7a90d16ae89763c0506b8eaa6bc4c326", "object_relation": "sha256", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086460, "uuid": "456074f6-4d17-4b22-a16c-1c4b1f6817ad", "comment": "Malware payload", "value": "a6eae5b450684314c9a8639b4c5ba4e10c0e287b", "object_relation": "sha1", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086460, "uuid": "a4332b06-69a5-4ebf-b8e2-27d8971579ad", "comment": "Malware payload", "value": "dac0999d9ac4e53fe09d8e063899c9548b73b460ec5e5c62fe3ad153393c32cb13f33eeefcf79c547b23728c0f2f68ae", "object_relation": "sha3-384", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086460, "uuid": "0fc12081-5973-49e1-b8a4-cbdedbb7fa1f", "value": "T1B4F3567066F74867149B90C069645B1A7FD6F723C91A1A913FEC1BE2CF53CA2ED2B018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086460, "uuid": "6110f786-974f-4928-9726-1e80f5d5c459", "value": "768:gGh2/i/Kz3WZ6zZvMiR2GGY0p1WGNklVf:BaVS6zbR2hY0p1WXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774086460, "uuid": "fbbe21be-3276-402d-8384-191fb5df4ab7", "value": 158800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774086460, "uuid": "1994c624-1912-426e-86e6-8e305e82f744", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086460, "uuid": "a1c4c175-8d9f-4af8-85e7-9ed4ccf74870", "value": "zomia-number.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc80722-2565-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774125486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125486, "uuid": "9e506e00-1931-4cf0-b5f6-c90aaa9c3a85", "comment": "Malware payload", "value": "e8e8def14ead394ff6fd873cb7682c31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125486, "uuid": "fe329d74-8ac4-43ab-8b21-cac02fee3a7a", "comment": "Malware payload", "value": "4872489c0ef7a010919385d0dc975715e6773c7bf555abae38b3d93c14bb024e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125486, "uuid": "a722eb96-d9d9-48c2-aa49-c31e755a417e", "comment": "Malware payload", "value": "2dc1d4f18d6e45fc31097989b7714329b06b357a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125486, "uuid": "c970f160-6a7f-406f-871a-158fdca3843c", "comment": "Malware payload", "value": "b4650f83a8fe909dd89383c2059f6a7e3d27d4193ba5f31be69935a28f6b8efa94758d797079fd22d19786ebd1c8d461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125486, "uuid": "821fe55c-387c-4775-883f-353d7cb89870", "value": "T163E33A06B5C0C8FDC899C1744FABE636D971F41D5234B19F27D8AB226E8EE201F5EA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125486, "uuid": "f15a3e19-6c1c-481a-959f-787996c48c49", "value": "3072:NrUlTQIwXHsdz5vThzG+WKXrPFnC8Lzj0+v:WdDwAAIrlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774125486, "uuid": "b14b0df4-c77a-411c-8935-fb15016895c0", "value": 155816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774125486, "uuid": "e350c433-d785-4c2e-bc7b-a616d09e501c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125486, "uuid": "e15c4762-b3b7-43ec-a679-8a46ad261656", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9037c708-2535-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774104740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104740, "uuid": "af7a4031-6039-4c8d-b416-8001cbf292a3", "comment": "Malware payload", "value": "346f98354a3c95a6581567d1ff27c4be", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104740, "uuid": "1a296646-0283-4bca-b696-12939186d601", "comment": "Malware payload", "value": "490f62778713185be4ab4ac38ee3738283a3e9442be92d11a436774b4f7c4302", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104740, "uuid": "4da5b603-6aef-462f-92aa-b20cb9abd1d0", "comment": "Malware payload", "value": "38233f39bffcc69f76e682c2c65c266d157cfa52", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104740, "uuid": "76d65e23-7e69-4ec2-a4ea-a4d09947662e", "comment": "Malware payload", "value": "f8f7dd5fa8e2701faf6fdd3d16377a01ace3dbd03e494425188d5840cf2594bf8998293e8c339930ec565bd4c898de8a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774104740, "uuid": "85c109c6-00b1-41a8-acba-b83fd008e711", "value": "T173419B87B9E164B12B4FC43E9B5B2005318B002F00296C19B39DAE317FAD648B5E5FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774104740, "uuid": "fe0e629d-49b3-4d0c-aea9-64d084756814", "value": "48:LXq3KCjFYVZllHne+rFiq0Q80w8zJtQAJBgcALWczhBvpJNB4R5NTBP5N/2Ve:7qa1ZVJFrTALWczhBvpJNB4n555N/2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774104740, "uuid": "9a269985-3b44-42d6-adf5-91b48e05dba5", "value": 2018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774104740, "uuid": "75381c7e-1cbd-4bf2-b936-c5b9064fb6ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774104740, "uuid": "715e839c-ec52-4526-9da4-2c380e25dbad", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403aa13a-2570-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774129946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129946, "uuid": "9af7b6a7-8f78-4874-8816-17b1f75e7adf", "comment": "Malware payload", "value": "0e097957e8bba01be6887dd98902ee92", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129946, "uuid": "ac1d10be-fa41-4ce8-b180-3fb6f2fad271", "comment": "Malware payload", "value": "49399521ebaaabb6ffe30093cff9ff8f3afb389fe0622c85eba522bf2d31580b", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129946, "uuid": "5379d491-0497-4b46-977d-ba872ee7d2e5", "comment": "Malware payload", "value": "7141c4cfdbf307c44ebb0f2022f81e75bc8d063e", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129946, "uuid": "aeabfd14-8ff8-428c-aa47-299e64d91d07", "comment": "Malware payload", "value": "a4aa905c1dc1c0a4050eb055558b431c75e982e0e8162a6a9efe279595ace17f4fed4755300d48c9c24718c2bd870c42", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129946, "uuid": "6f48ea3a-ccfb-48aa-b506-62ac42bff410", "value": "T1B5B3FC9C498AD474DB2F3429461F5D0B9AAC9253031EC480BAEE6F483F519E4BDBD9F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129946, "uuid": "031e9788-8301-41f6-bf41-d709688740a1", "value": "1536:/J3rpaOSRVG/T4snk7gpzzyWAZMLRscffT+:nS3Gr4sn5/yWAIscfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774129946, "uuid": "e90d16c2-671c-4ca8-83a4-e576f9f7118b", "value": 117307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774129946, "uuid": "f70d4629-02bd-4948-b080-538347ce2644", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129946, "uuid": "844dc5e7-b14e-48c3-b280-9b62b25c91f8", "value": "Notes_Home__88.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6891d03-253c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774107784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107784, "uuid": "7e266611-a34b-4271-bf10-d40f8950eb94", "comment": "Malware payload", "value": "b1adde08d1736e0d30ecc708acfc9533", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107784, "uuid": "bb43c91d-2b91-4fd9-89ae-2a6ebe36584e", "comment": "Malware payload", "value": "495289174bc60415fa365c6df143d1da3a88f4992abce76d5e6e83e941e46b67", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107784, "uuid": "e8920fb8-599a-4ffe-85ef-a866c5f43f85", "comment": "Malware payload", "value": "92879e947460268a2ed80c5085e87b7279cd28c2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107784, "uuid": "a9f0316b-b79c-4b83-ad0f-5dd9dc3dd756", "comment": "Malware payload", "value": "90d6d76870c264be504c27b7e1f27e7a0ec38c0f8a6d8d6df22b58e724094bb4c20e587b0d7c4345410365840b270124", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107784, "uuid": "6c1a2d46-6a8b-49b4-b119-dc49c3f09db3", "value": "T10A66E1317EEFD233D4A873B9D5A06308AE147E84D16045ADE87C7D8938798016D6BB3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107784, "uuid": "3c9ddb2d-64bb-4310-a295-3c85046ef61e", "value": "3144fec4ec8da0d7cf44a51c6cf2ded2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107784, "uuid": "98702974-4305-44c6-912a-4c5d99394278", "value": "196608:lWeYAHmN4f00wI0KeGrpV/DH6aP6k0UaxHN:lNjmN2HuGrvz6c6k0UaxHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774107784, "uuid": "43761fb1-d987-413c-b6a2-6c9ab94356b6", "value": 6867360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774107784, "uuid": "c0921081-6778-4cf8-8cd0-2d57561212ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107784, "uuid": "0558d338-ab6a-4643-b0fe-579fbc260adb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7909ea-24fe-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774081035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774081035, "uuid": "9a23a03b-1200-41fd-a737-aa7c3780ae8f", "comment": "Malware payload (NetSupport)", "value": "3951fb59375cab07f89464d4e83f1565", "object_relation": "md5", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774081035, "uuid": "b74a0334-6b0d-4e4a-89b7-6bd81f9b2a67", "comment": "Malware payload (NetSupport)", "value": "497c5c734751280105a6320271fa1830a861e6976086484511fc0d8f02040929", "object_relation": "sha256", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774081035, "uuid": "46042a36-63c9-46b4-85f3-20a51d86fe8c", "comment": "Malware payload (NetSupport)", "value": "12c211d508363a7fe4633ca2ed41d5c61f61bbf3", "object_relation": "sha1", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774081035, "uuid": "951e8e8e-7095-4807-a800-d1accbe1a4a6", "comment": "Malware payload (NetSupport)", "value": "184f03ff95c2c31f6fa29afd8f18e95fbf6c99d68e85ab20da49b3d87ecfc3b56a1899678b8523bf9485037fed4e3747", "object_relation": "sha3-384", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774081035, "uuid": "741643ff-b6e5-418c-8820-a826008faed6", "value": "T124B55B5BFCB118F9C0AAA135892791557A707C442F322FDB2A90B3782F737E09A78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774081035, "uuid": "80ea8790-0632-468b-9a74-409436ebcfd5", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774081035, "uuid": "b52bb45b-e00f-4dbe-8771-bc930a6dfc11", "value": "24576:KkIPXqnza1NqtIQhkTO8yNZdNFbWXIWnMjW/Ucr39pEIt8ciD/QvUSgvqAcb+at6:Kk4GzSNqtnLVNZdNfjqGQc3Ct6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774081035, "uuid": "6e02099c-c978-4f42-b451-2fd1e6102840", "value": 2441384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774081035, "uuid": "032a474e-b903-4550-8b3a-c0766bbec8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774081035, "uuid": "6c6478f8-702a-4087-b6fe-6d069c22bd24", "value": "497c5c734751280105a6320271fa1830a861e6976086484511fc0d8f02040929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f072bf-2510-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774089020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089020, "uuid": "25326f55-35cf-4771-b654-581be0c03e06", "comment": "Malware payload", "value": "0895c593610fd19e0d7173d3b467d32e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089020, "uuid": "1cbb100c-96af-4f47-8303-de2d6b90ceb0", "comment": "Malware payload", "value": "4b9779ba64383f4147d0ee4f6e760798409ffa7dda2b3f97d5f9b88feca591a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089020, "uuid": "eb150e0c-4fa0-4c09-b329-cd6b69fab20e", "comment": "Malware payload", "value": "2d2637d2c67284f811bf4b05d923cfd21d2cb6f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089020, "uuid": "950d297e-e30c-4b68-b0b6-a018e5e56f2e", "comment": "Malware payload", "value": "e5a391a1175dea71f2a1b4828a1a42439d55722a7c2abf30db096273b934086833be5c88705ea3f400d9f65643ba70dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089020, "uuid": "ab0e7a1c-eb3c-447d-8ddf-bf8f0e4813d4", "value": "T1B8D49E6776524E10D2998733C1CB4A41A3B46B8676B7F70E7645339A24123FFDB0B2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089020, "uuid": "b0ad33f2-f679-4547-8198-8d258b5416e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089020, "uuid": "4c10682a-4e43-4ac0-8846-7964f74d0789", "value": "12288:Eg07DH1+KpSEJ4GaEigQ4T+sxYMOUwSA3v1Z79BNy07:EKyi54T+sxYMESADB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089020, "uuid": "52e0c7a7-d2a3-4ac5-903d-defd932231e4", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089020, "uuid": "279144a8-4e91-410c-a8fe-24bd4fb2b80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089020, "uuid": "dda5173d-1649-4c32-9969-ba91a60d17ff", "value": "0895c593610fd19e0d7173d3b467d32e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b66cd6-2510-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774088959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088959, "uuid": "ac53eacc-7d9b-4edb-9fbb-16ddab38a750", "comment": "Malware payload", "value": "399d4b9eee4d13774dcf466a907782b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088959, "uuid": "85f1262d-e259-49c8-b32e-4cb97d2b1e65", "comment": "Malware payload", "value": "4ba5084e6282749e0805133ed8082fc4dd15ce72ce222fe600f672644da5af7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088959, "uuid": "e5c1e860-7e9b-41dc-ba6f-74eba33ba502", "comment": "Malware payload", "value": "df721d1fef062c22f0574c22683ac19c41e318c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088959, "uuid": "70ed7a2b-ff7a-4397-bd15-024b829cd05e", "comment": "Malware payload", "value": "134ffab7f0481771a8a7811ccd2a847a2a7a75877bebfacde4613a4d955f8fdcffd413cfe3f801170cc62490eff531aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088959, "uuid": "567cceae-7cd7-4523-96f8-e02c4ae65ebe", "value": "T165B723D796EEB2D8C8C30A48658F12CA59C095B9C4EEC93D29CB6C035920DFF85C9977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088959, "uuid": "22132876-c8e1-4cde-9684-52beeff64648", "value": "51a80c51a9f51ec0f33e41ec969fdeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088959, "uuid": "3464af3a-8f46-4565-8a88-5f2f4aee6458", "value": "786432:tXleRfPmy4WX2w0ZqtdM/O1himPo9Ii5lae8Yb1BUjc8gpIy6MdiCFImNqt8r9D9:FlUfPmbWeZkIO1hFmlae3wc8g5HRqQ9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774088959, "uuid": "33bc78fd-2350-4ad4-af40-6191cd6047d3", "value": 48517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774088959, "uuid": "bd5cb3bf-4f3b-4cdf-b7ce-b2031547862c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088959, "uuid": "57476267-b2f7-445e-b72c-ea6ad1254f6d", "value": "BrodyIsAFaggot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d105e2-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054141, "uuid": "5a738054-bc57-4b57-8941-a2118542e30f", "comment": "Malware payload (PEASS-NG)", "value": "3f7968ba5b4e3939ca01d542d986e36c", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054141, "uuid": "89907fa1-e2f0-4b08-86df-5254b1f9a4c6", "comment": "Malware payload (PEASS-NG)", "value": "4d4161392bf438e96d9f068767bba274b4f7f79900e8f4aa62314ff33926c557", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054141, "uuid": "0363303c-d043-4f7a-b7cc-3845abc063a1", "comment": "Malware payload (PEASS-NG)", "value": "2f51a2c95c5b4ac96d07bac7665a7bd4aea0bda5", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054141, "uuid": "d6913b50-20c5-4886-9852-52232c746269", "comment": "Malware payload (PEASS-NG)", "value": "4ea2d565656a9441d0c413c068eefbfa78fa3d2d46370ffcc16ef92fc7a9f7641728536fb7e87856d4052251726ccd54", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054141, "uuid": "8e8c1f8d-9148-4f2b-af2a-bace67efe5ba", "value": "T18FA6EF02F3E401D6EABB527891B61612D672B42A4330ABCF338C94695F337D16E76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054141, "uuid": "d45dfec6-2870-4a88-a314-647a6e34a2dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054141, "uuid": "1c6dcdb3-81d0-45c8-b4a5-a1f2f21a119c", "value": "98304:24KAANhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qr:2tNVBFUcwti7TQlyVN8iNISRTRmW5Qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054141, "uuid": "424e45a4-0675-4048-ac55-d155ddf5ba31", "value": 10026496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054141, "uuid": "7b78d71c-1fe0-4bef-8066-50119b96e386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054141, "uuid": "610f0012-31fc-422e-986a-085cd4f877e2", "value": "winPEASx86_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939ff726-2507-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774084989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084989, "uuid": "bd7cde8a-b4b3-4f51-9f0d-dcc3fa248758", "comment": "Malware payload (ConnectWise)", "value": "c6b330d0048c8e3449049f8285d7938d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084989, "uuid": "8c34bc90-7df9-4cab-9dc5-b4a8869b6adb", "comment": "Malware payload (ConnectWise)", "value": "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084989, "uuid": "8e33631d-a7a4-4dfb-a460-8b3fc0e454cf", "comment": "Malware payload (ConnectWise)", "value": "bcccf67983bc32a327b58e02ef1ce9a8a94d5c15", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084989, "uuid": "e6cafb37-5963-4f70-99b1-feb775834fe7", "comment": "Malware payload (ConnectWise)", "value": "2a4607a701a9d8aaaad6fe44a93737120101272fcf0a6fa11ce845c10ba0b7503764f5b4d68d51efb6c0474b1fce466f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084989, "uuid": "d009624e-b3e4-49b0-9dc6-21b266827e1d", "value": "T19276CF06B9E159FAC0BF5635887652917B70BC051B2297EB2B90BA3C2F33BD05E31365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084989, "uuid": "37011ef2-6544-4cbc-9454-a83835f25110", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084989, "uuid": "e9ded233-1bba-444a-81bf-88851cf4a700", "value": "98304:EQHbG3aWzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl7:EubqhfefPtHxcp9ym3nltDUJVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774084989, "uuid": "818fefc1-e50f-4dbc-8d9b-a2e51d0c5a60", "value": 7694904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774084989, "uuid": "c264f2a7-560c-47e3-8dde-ea714c16ad90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084989, "uuid": "d29c5b57-1d14-41c8-81e8-77df348bf512", "value": "2026-03-19_c6b330d0048c8e3449049f8285d7938d_amadey_coinminer_glassworm_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d2e699-2581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774137469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137469, "uuid": "76dfcd19-52a6-469c-9d7c-a73dd0419563", "comment": "Malware payload (Mirai)", "value": "f9f410ad529dcf8cffd886573a0c1927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137469, "uuid": "6710bc63-8e9a-4fc5-8038-f33f35bc338f", "comment": "Malware payload (Mirai)", "value": "4e9ff4ec0b5f76f70a2bfa2d57d8fc994427b5b34012bbdb25153751adbfad5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137469, "uuid": "a612a0fe-18dc-40a2-8a7d-124295024e0e", "comment": "Malware payload (Mirai)", "value": "64e0db008f8f1a41593e31eecbe7e7760bf54401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137469, "uuid": "29be2b71-cf40-494a-989a-cf9b1a2c0ed3", "comment": "Malware payload (Mirai)", "value": "11c58009dda6feccb5b55d834ba11420dc3f3dc5449453384f669b57a8abc52b2c8127a17794e224814a08e853870012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137469, "uuid": "fb5bcdca-5abf-4297-84c3-4282951cd25f", "value": "T1FA03F12010665820C9215E33B92E568B7B3B19FCFCB82B03B510A2546EDF18B327DB1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137469, "uuid": "d2813aa2-31b0-45aa-b3f7-8a8cec00984f", "value": "768:Vv8LIvUGTygkuC/P5dsx6xs6DoT1CrOaV/20o/xhJdmxehlBtxqJ9q3UELfe:0V4yC+JfDO1+vR20sfJdmxe/BtxjLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774137469, "uuid": "b4353c45-16fb-4eb6-9adc-711733f59923", "value": 38064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774137469, "uuid": "836516b6-d94d-426a-a66a-3f56675c525c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137469, "uuid": "0bac6983-a36f-4f2a-9a73-a47250c78c8d", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e93aa1-250c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774087094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087094, "uuid": "59743e38-1713-4cd4-bdc4-d57a2e895179", "comment": "Malware payload", "value": "ed921ecdd4b5160bdb775d0d1f20d061", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087094, "uuid": "9f4e62a5-7195-4bb5-97a8-6a71fa90a88c", "comment": "Malware payload", "value": "4fa815fd60d65efbc9d6de0e511020084000ca587791313fc1b24cdfb107b732", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087094, "uuid": "1454e0e3-52c9-4043-97ff-e641b2d8bfaf", "comment": "Malware payload", "value": "e92ed85dc969199d43f945a9716b0b0dde0756bb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087094, "uuid": "b8ada085-0129-479d-a91f-e5ca89d9551a", "comment": "Malware payload", "value": "6dac5ea36cef1c24a28573fb91af4d0bd09b6b45c497beac35931c4f45b20fd4a77bee65d46a0dd4d3c80f0eb6990b39", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087094, "uuid": "95a5b4e6-62f1-4fc0-87d2-e6d42c7ea90f", "value": "T11D6733C7C98093CBFD7B943189D491ACC6B9BD685C17858BB625331258F37A233BE984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087094, "uuid": "cf01d104-e057-47a3-b7ae-7bd86ac0c722", "value": "393216:lOUZgPgWAcw1fT5ZAVpCCqN2wJL/wqIpHVUv4mDMGtCWfB/DTedEla9N/D3XMrH2:ll6PF+/AVpCf2wMV+l0Wf1KQaj/WWj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774087094, "uuid": "d401aeb0-fd50-4526-9765-02f2f3e1cb66", "value": 29843456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774087094, "uuid": "baff6022-de7d-44f7-af39-fb13ef09e6a8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087094, "uuid": "f9a8d42f-3fb2-4e7b-adb9-498793e78154", "value": "AetherixCore.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625ededa-2513-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774090061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090061, "uuid": "dd572c73-39e1-4c39-8261-b671df4d071d", "comment": "Malware payload", "value": "7cc8d457164522d7e671165af6c24f6a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090061, "uuid": "641ad455-5bfb-4057-8da9-32cdf462b548", "comment": "Malware payload", "value": "518f1f214fc69d862820e4b5453e52967a3cb42a08f04830270e1b29bda955b6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090061, "uuid": "351dcc86-0083-4ad7-a959-50e3f080da9f", "comment": "Malware payload", "value": "4d8d9375899f1925234a911d8b9c707e506eb758", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090061, "uuid": "f86e0c8d-258d-48ba-8951-e1cd9a55046e", "comment": "Malware payload", "value": "76bc92a1548fb1c8ddcf5f85b7b1ccdbe9e383441a508a5206cf0ef27d978e9ec326a3565486e0e1ebd7fd8286b18a9d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090061, "uuid": "33d6c098-61ef-434e-8814-90ad8846d209", "value": "T139445A79F198C4DCC607C1B1A6668A41170FEC943B698B61205FB736F4B3EACE793582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090061, "uuid": "80a9eb6e-661f-4fcc-a579-55a6ef9192c9", "value": "3072:5hW9rWNXULqd+O13x6cwCLTK9rWNXULqd+O13x6cwCLTaQrAtEEdTCqA0mK08:5h99+Qc3xCmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774090061, "uuid": "2fb11673-ea74-4a73-bb7a-4c10244e3510", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774090061, "uuid": "1128d3b9-12b3-4cac-b51e-b0986f619e3c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090061, "uuid": "dfc61dd7-4155-49b4-bb63-05f072883d8b", "value": "7cc8d457164522d7e671165af6c24f6a.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0af6b36-2567-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774126377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126377, "uuid": "30632e43-a9b8-4772-9bed-734d8386c966", "comment": "Malware payload (Mirai)", "value": "04191359cb7cf320e208eb8ce76b01b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126377, "uuid": "44156786-7721-4332-abf1-1bd47993443b", "comment": "Malware payload (Mirai)", "value": "545a59a819cabe72a1f8c1e72ff8969ee7f0f9b89032712fb3f610686452fcd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126377, "uuid": "f7fc7d7a-560e-48a3-b55a-a67712c0b1cc", "comment": "Malware payload (Mirai)", "value": "9bd88e93f675512225dbee7e94b666afafbde2da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126377, "uuid": "861b36a2-e93c-42a9-ad1c-b8cd6541d9de", "comment": "Malware payload (Mirai)", "value": "0f48969d0a18746ba943946c86479b837b66f4e02a30a3c8243baa9232805a0749aab0f82d22b06b8085bad7995b0e30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126377, "uuid": "e4aba893-fa67-4fe0-930a-a3037ceab95e", "value": "T16EF30946B8819F15D5D216BEFF0E128E33131B7CE3EE72029D245B357B8A8AB0E36515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126377, "uuid": "3d796aab-a34e-4d67-a991-87fff60877a0", "value": "3072:okeXOf1hzvWU9iw0Dfk/aaaYZ6x9kddT9+YsZC6o91:oofemkDfSahYZ/dx3CCr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774126377, "uuid": "7c4c7e45-80d8-44b2-b6b2-ea4b4b58869b", "value": 160540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774126377, "uuid": "4713ccb5-b13e-49d5-b1b4-29a28a48f50f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126377, "uuid": "6c4a9d1e-e7b1-4d9e-aa8c-6a4a85cba6f1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1090aa4a-2518-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774092071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092071, "uuid": "2940eb2c-644c-4065-84c2-a84c57baa991", "comment": "Malware payload", "value": "dea4161a3cd529a8a1f18f4448ed5166", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092071, "uuid": "30f8e35b-d65a-4c86-a21e-9863d6f31072", "comment": "Malware payload", "value": "55e73c51aa9156e5c390384557c3f60e77004a5b227c50af381383be66d19d53", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092071, "uuid": "d48c263b-6855-47c1-965f-45470da5ef41", "comment": "Malware payload", "value": "6b4c904307ca5d93a48a6d4e935ee4fdea313bbf", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092071, "uuid": "a330ca00-a3d9-4169-810a-12b3a232edc1", "comment": "Malware payload", "value": "0603168a1a7e72e95e239752f397d17c4590bf4a11805c5c40b28d5b2fb900fcf5e922e7f74ea30cc0dd0d5a791b726f", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092071, "uuid": "fb678631-3dda-4384-b37f-2c4c5434f117", "value": "T1CBD19E91D04DA022E282113DC90ADD8B3223567EE952D0FE4EFD64E436E1564DF37735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092071, "uuid": "ace4c083-c87f-4c37-a02d-67ee7d18ab4f", "value": "96:KgN0TNiS9BsHyGR4DsSw79lJK/C7E58nRBpeHFdnLFImo9teMKYfaCNPMZkR8BrS:bOFLqy4KzwpK/P8ULL+mVqpMl2uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092071, "uuid": "1fa12623-7407-4911-916e-dfd52fb2b9bb", "value": 6581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092071, "uuid": "0f611379-d197-487e-84ea-e8531dc06859", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092071, "uuid": "5b8cc827-42d2-4fe9-a8da-3140e087bb43", "value": "photo-511633068.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198da72e-24c0-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054290, "uuid": "c0e8c063-4899-4a1f-b551-c8c836a3fb7b", "comment": "Malware payload (PEASS-NG)", "value": "52b9df8b62fda35b38e2607c84d1f3d5", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054290, "uuid": "666e104d-20ed-4e76-8fc6-27db22ef3bcb", "comment": "Malware payload (PEASS-NG)", "value": "5786b5eca3045d0bc95e19469b852cc10a454f94302c528e336f183bc25bacd4", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054290, "uuid": "e6828e19-203d-46c6-88c8-506e5c9f7307", "comment": "Malware payload (PEASS-NG)", "value": "612d050785577bf7fa4f2a7a462dea1226fc2294", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054290, "uuid": "f1c07819-46e4-4893-b030-c7789dd13409", "comment": "Malware payload (PEASS-NG)", "value": "7b4b724b7adfcb533cbff7bf57d816d4d1d401e59dc478efcd3ac0d6a02ea93275ac70889eecddb7dacf9d6f40aeee09", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054290, "uuid": "3d9835da-8248-46f9-80fc-340dc54814a4", "value": "T15A069E0BBCA02594C526533B89EA59C22F79FE4B2B3217D73A40B3B52F726D254F9314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054290, "uuid": "9109c69b-66f8-40c0-a69f-418c6ecafede", "value": "49152:37x/ogdtO+aGFVhVf9Anl8lD6nxKl2Qfeap4tEX4gSfh:37ZHOpW9A+snx+tT+Ndfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054290, "uuid": "0f491d2c-d695-473d-824e-503675b3f393", "value": 3794432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054290, "uuid": "dd6c0bec-05ff-423d-abd5-6220dc9299ab", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054290, "uuid": "a4f2943b-2ac2-45b2-9ffa-120ab1c14924", "value": "linpeas_darwin_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457d1e58-2501-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774082281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774082281, "uuid": "a8636ad7-95ba-464e-8924-7b5ddefdb64b", "comment": "Malware payload", "value": "62a0e401fcc42c435e66fae9f71d6c10", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774082281, "uuid": "fe555c61-7424-4bde-9ea4-99fadec1be78", "comment": "Malware payload", "value": "5992b0575201555ed33defd0f9d989627c295f4f7bd2522f787b11f8a15b61d8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774082281, "uuid": "f59da7d0-98ef-4762-b6cc-a27e27793a10", "comment": "Malware payload", "value": "7b90db6476d73bd046ccbeaace38ad8e1933abb2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774082281, "uuid": "e6e13cbe-4441-44da-90cc-748749b6eeb2", "comment": "Malware payload", "value": "e5d6fb8b3856d2a958981f77be7691d33f62a2f9d8da7fd41f1ed1f55bd18a48939b581aa9f52dde166277c3b42380ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774082281, "uuid": "d20a29d8-c3ff-432d-9492-09e6d54601c5", "value": "T13031F18E70F45E43A58CCF0C70F58DCA6316D991619A2A32ED4A1FF7A48AD54301AB3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774082281, "uuid": "44ea2c1e-d732-4ffb-ac90-d9d33752c879", "value": "48:YUcWsZZCSu1xVCFJty6EmMpAO0o7oDNC4oRkOF:mM1qBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774082281, "uuid": "44fcb61d-f646-4cbf-be40-aa28e3bd92d6", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774082281, "uuid": "d2fececd-f8e7-4cf7-a104-e33fd3a0adf1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774082281, "uuid": "523b4b25-aa34-480f-b017-c510b72e6ad8", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f164e42-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054058, "uuid": "229eeed8-f21f-43e7-b8c3-b67465538598", "comment": "Malware payload (PEASS-NG)", "value": "995bd49f0768ef2b9144c13129ba567b", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054058, "uuid": "af1a0277-58df-4781-ac33-0cd631bd8724", "comment": "Malware payload (PEASS-NG)", "value": "59a720298197fbeacced0da954a2d0c590f61ee730a79d4d329d0974e5e29324", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054058, "uuid": "828bc34c-ccac-4763-a023-99e61b17cca5", "comment": "Malware payload (PEASS-NG)", "value": "2d8e5d7500f2b3ce07264687ac2a8d0cbe6cea2a", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054058, "uuid": "cb8e451e-df4e-4afb-9da1-52fa345b04d2", "comment": "Malware payload (PEASS-NG)", "value": "7f5ca77cfa58cc16c30222b3aeb7b6b8da9f18a283cd31d412a8453de1d20f4bddc26944210cb1a6d8e8aca7fb36d128", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054058, "uuid": "5a4a9d10-914f-430b-b1af-7b318dbe643b", "value": "T18306B045EDC724B5D603163648EF56DB0B2CAF0B2F319F83B9443B6A667749B04B622C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054058, "uuid": "2f084408-dc99-4463-93e9-33acff852378", "value": "49152:omhiUhF0R+rhWMv/pyD5mo/b1cpqRkzmE6Qv:bh9b8Z8ojO8xEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054058, "uuid": "48b5f895-3577-48da-9a72-adab47c3f858", "value": 3714212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054058, "uuid": "dcdb6b9d-30f0-4dce-87ce-6d1e79cddd3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054058, "uuid": "f5b2e252-7835-4884-9a8b-99cd5d52d070", "value": "linpeas_linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e327e56-2531-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774102831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774102831, "uuid": "bc873806-92fb-474d-9b7e-cc53bca432c2", "comment": "Malware payload (AgentTesla)", "value": "9313ef7ae3c34f4470f41a0ac49fb7d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774102831, "uuid": "44ad2240-3a3c-4cc0-b210-21779938ebf3", "comment": "Malware payload (AgentTesla)", "value": "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774102831, "uuid": "6eb406ca-fd57-45cb-bdc6-3b0e112d707a", "comment": "Malware payload (AgentTesla)", "value": "4bde0bf5f9ac1b46ad2451a421c4bda743324abe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774102831, "uuid": "ca19e3c1-d4bc-4d19-b236-b209adc5550b", "comment": "Malware payload (AgentTesla)", "value": "2b3e60e0a0f7610c2e7acf1fac6d42ef026c2d06397e1a58d7aab49186d4c5a9d544555cc5a1178944276d9ac43621de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774102831, "uuid": "a3957e29-fdd2-4b2f-9318-679eb0a0b5cb", "value": "T14E340F027F88EB15E1A93E3782EF6C2453B2B4C71633C60F6F49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774102831, "uuid": "01937426-9a74-4e5a-8909-711b2017e095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774102831, "uuid": "bbc863ac-4a34-4bc8-a791-935f92a5c245", "value": "3072:E2liq6CyZ1ij6cKc2BLIgkTHo9rG8KaG5jnTqdqYufzz:piq6CyjW6ckusq8KaWTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774102831, "uuid": "757cbe80-d0d8-4f50-8d76-6fbbd3e3f718", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774102831, "uuid": "32b98686-fb42-4af3-bbb6-f7721322b1ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774102831, "uuid": "c88071ea-8338-40cb-bf8b-ccb332bf6730", "value": "f45b853c-c9d3-495e-9acb-d41a4a90029f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c535a3b-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053999, "uuid": "0db924c3-8808-480e-b9a9-0acefa69f45b", "comment": "Malware payload (PEASS-NG)", "value": "871de1a28334bd9db1712fc5166c324f", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053999, "uuid": "8ea96f60-2983-48d6-a95b-da1e7b5f757b", "comment": "Malware payload (PEASS-NG)", "value": "5a193ea4c326f14bf9987dc02622b660c2b135c9e99af500db2dcaef8cbc8996", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053999, "uuid": "8d53d565-c6ba-4bc2-b7b2-22f405ef0161", "comment": "Malware payload (PEASS-NG)", "value": "a4e3a543a7e264ec288c3d40a3393f68b58fc583", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053999, "uuid": "2238619c-f3fd-400a-b999-a407e53369c7", "comment": "Malware payload (PEASS-NG)", "value": "a49844c1ab9c1067fd97ff8d82f619ca44c9fe9ddb8a21e910eb71a8c09b1a9998b6a6305ffc021822408e61661e87af", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053999, "uuid": "a7ebcfa0-56d6-4ec9-a719-1f38c3e609eb", "value": "T183B6D044A2D90969D5AF0E7D806102325739760A539ACBCBFBCC82980F53FE5DB77326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053999, "uuid": "6fbdc801-ed98-4d15-b88a-29d2fd866392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053999, "uuid": "17f2a307-17fe-489b-87e2-cc24d6fbe084", "value": "196608:xkvwQVBFUcwti7TQlyVN8iNISRTRmW5Qqh:S4IHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053999, "uuid": "7fb2bd32-124c-4d89-a085-1e5c0657b430", "value": 11085312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053999, "uuid": "20b3b39d-213f-4f4d-9d75-2c7a9c99b5ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053999, "uuid": "b16e4963-1edc-4274-8493-5ec80860f302", "value": "winPEASx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af9d416-250d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774087525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087525, "uuid": "ef0bc04a-4506-4fa7-b43f-6ba987a0ed52", "comment": "Malware payload", "value": "85a1e479630eab09eb4208dc9ad1c786", "object_relation": "md5", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087525, "uuid": "5e0b3cb2-09eb-42f0-80a7-a482239d78a6", "comment": "Malware payload", "value": "5a482e8939721f3da69671b3b36c945154d64cd8f60d9bdc2e4bc7d1a8f2e1cf", "object_relation": "sha256", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087525, "uuid": "4e8797dd-55d8-40fe-88f7-614f04c992a2", "comment": "Malware payload", "value": "3407eb89d7440f83149ac296221e18c861e479bb", "object_relation": "sha1", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087525, "uuid": "8301b861-1f7a-40f3-8509-6d2fabcdc38d", "comment": "Malware payload", "value": "1c4566c9919884968b2280b2e99c0249508899c61ccffa2e370552cc834244d15a205b423a5be0d23fac6b73882e4c23", "object_relation": "sha3-384", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087525, "uuid": "849a0aa5-dfc4-48a8-8292-c59b49755fe1", "value": "T160083339E4D365BCC78038BBE4F810D1E1A6E67C2AE48A57461C6B801FD1461AB3FE57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087525, "uuid": "6ab2a6df-b197-43a1-b797-067390a27264", "value": "1572864:OG8O7lwmtU5h0V7hCSJIKwDtFm8HSoEC8S894ULmJ61sKQ8YiSrg+wDK:J8yA/0lJIKkPHSoEC8SOY8QzwDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774087525, "uuid": "19df1b75-cba8-45db-859e-1a2718dce1b9", "value": 81840799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774087525, "uuid": "8e48b6fc-3e2e-4241-949f-024bf4ca471e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087525, "uuid": "d64baefd-a162-4eb2-9718-08c4ccb3979e", "value": "Cyrex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30107fa6-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053898, "uuid": "9c57fd22-1c7a-4064-b650-9552044bd89d", "comment": "Malware payload (PEASS-NG)", "value": "bc3ab82631f7337f2f879ff94bbb3a61", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053898, "uuid": "ccad50d8-dff9-43ed-bf50-cdfa0e4e1d97", "comment": "Malware payload (PEASS-NG)", "value": "5a7110828ff6a69d0b7c3a58b8022b7c29cd2ef52110bae5ee87fbb715246811", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053898, "uuid": "012cbde8-9b27-4007-91d0-e772fcbad162", "comment": "Malware payload (PEASS-NG)", "value": "5626e177b5d0da7391c3813f382aa09b6f524ece", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053898, "uuid": "3193b63c-1707-437a-95db-373bfa3eb0f6", "comment": "Malware payload (PEASS-NG)", "value": "57b13cc09d3247be1ae69bc15b14fd71fb9b086e702efec1b5b4b5325fc06c1aa62a54cf7ce21ce5aaac37b8436a33b5", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053898, "uuid": "e6d1af8f-4a6b-4c05-ba87-ac897dedefd2", "value": "T14BB6D04062DD046DD6AF4E79906202324B35761A179A8BC7FBCCC0980F5BFE29F76726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053898, "uuid": "57c7f451-8661-43ff-8a70-5dd62da4a2c1", "value": "196608:mPzHVBFUcwti7TQlyVN8iNISRTRmW5QS:QPHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053898, "uuid": "a1b4f457-5dc6-4a15-9d6f-d9ca126349f9", "value": 10961408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053898, "uuid": "92b073bf-3c94-4a23-aedc-b39ed3212105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053898, "uuid": "328ac125-2e7f-4fec-ad19-51bd40f0b583", "value": "winPEASx64_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acafa52d-252b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774100493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100493, "uuid": "11cef222-051f-462b-96b2-e08460abec38", "comment": "Malware payload (Vidar)", "value": "24e34ef8244605897e4cb750030d1e89", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100493, "uuid": "51741c3d-1c51-4623-8eae-b1153eb6d631", "comment": "Malware payload (Vidar)", "value": "5ae30eecdfb95d98cf238ff69b392cb36d1d3fb09481d79fa92c69dad48a0df0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100493, "uuid": "fd7573c8-98b5-47ae-9190-418f26c8b6c7", "comment": "Malware payload (Vidar)", "value": "734e8407c3323d2c26dd1a108084b3bd873d5bc5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100493, "uuid": "435cba76-d7d6-4fb6-a059-1bd3f427659b", "comment": "Malware payload (Vidar)", "value": "a716397792cec3da796536ec43876f4008160251dd5efe3b890079fed43737b8fc9b31ba3f290588866cc53667a41e73", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100493, "uuid": "e2112673-fdb8-4cbe-9d66-43c61c3ee0fe", "value": "T1168412866BE81915CA3D4731B473E7BBA2B0BE630920DBED31D86DEF3B4578011522D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100493, "uuid": "564ac4f3-3e04-4d3e-8e96-032786dada33", "value": "12288:nHfdbye7MHyOQ6yvE+R9tXASbOVJcbm6pPl:HlyyEyvt9twXV+bm69l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100493, "uuid": "957afb92-290b-4042-9056-14fcc60713a1", "value": 393952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100493, "uuid": "8eaee7da-d963-4968-a66f-42cf260dc9e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100493, "uuid": "e2330644-980d-450a-b7ed-e0f3f1ed3959", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520f2664-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053955, "uuid": "3fd68ad1-3f2d-4537-91bb-ce0fc8b39347", "comment": "Malware payload (PEASS-NG)", "value": "04d3e199b366b4b5aa5ffdc04d81e025", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053955, "uuid": "f6fcbd76-3561-4f46-85d0-f6a5c091f8f3", "comment": "Malware payload (PEASS-NG)", "value": "5b355e00fe7880656895f4318d9ad2676f19b1f503461372c58264bc06bdf383", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053955, "uuid": "b04a0eb7-3fbd-40a3-b294-5def7f4c2c7a", "comment": "Malware payload (PEASS-NG)", "value": "fe7de7ae7e472299b3d2d6726e718b7809b5ed1a", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053955, "uuid": "36aca3c2-c0af-445e-b421-42d0c97b5294", "comment": "Malware payload (PEASS-NG)", "value": "8086caca462993e0fbeee7e798a9e27189a5eca951fd214a3d57726a036927134cef77a27abda1ae04a3db903360c262", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053955, "uuid": "0493aaae-6530-488b-bc0a-ab5cc3c745b5", "value": "T19FB6D044A2D9096AD5AF4E7D806102321739760A139ACBCBFBCC82980F57FE5DB77316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053955, "uuid": "f0f8f3a3-2ecb-4558-a132-e9c560061b1f", "value": "196608:HV5/AVBFUcwti7TQlyVN8iNISRTRmW5Qg:1xYHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053955, "uuid": "f2b9bbec-7cb8-412e-9332-b02100a51cf3", "value": 11108352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053955, "uuid": "d19f888a-46fa-4f07-be20-3f79fabcebfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053955, "uuid": "874b5160-627b-44c7-a348-5cec21f5f9f6", "value": "winPEASx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915b73e6-2536-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774105172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105172, "uuid": "64ebdc15-c91a-4933-be68-b3e2da21f333", "comment": "Malware payload (Mirai)", "value": "7eeef4b4e72ad0cd82699cb7d9c0ef9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105172, "uuid": "6e37ff67-0bd7-4bca-a73d-256ba66316ae", "comment": "Malware payload (Mirai)", "value": "5c4d5866c57d5013ceffe295b4ba875ad7b338168a0238e980328b2dcc4f510f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105172, "uuid": "de263ff0-25dc-41a4-800b-4730c81129c3", "comment": "Malware payload (Mirai)", "value": "362ac486ca362665645db1ed18f4ffa583633c29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105172, "uuid": "b2bba8b2-3857-4f17-838a-e6721995aaa2", "comment": "Malware payload (Mirai)", "value": "915cbcb38d9887660a375e8fe69b5f3a3e09bf5a77b81f68b5c963a30fc6720c186f471b87922c3d5fd53b06d21206d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105172, "uuid": "c7428d07-f17f-4a19-bee9-28ce06efb990", "value": "T1E9931946B9419F12C4D621FAFBAE41493313BFB8E3EA7101D920AF5027C69DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105172, "uuid": "a8ce9ede-1b01-4cbb-afdb-c8f88595f71e", "value": "1536:iunCm3tap8Q28ukwTvgWKGxKqcagMLj0r72YbcuNlqPif+IGMvyRPY7Cyci:d9Q8/DgWKMKqcagML4r72YiC+I1vyRPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774105172, "uuid": "5db8e541-f488-4900-805b-26dd65369937", "value": 94500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774105172, "uuid": "a3532c0f-a3ad-4678-ac12-0ed750177338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105172, "uuid": "295bf60c-d9de-4a1e-9722-f10e89b477ac", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba465ba-2511-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774089351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089351, "uuid": "c11da8c9-75b5-467f-b8ef-c3ce7594ef3f", "comment": "Malware payload", "value": "977d969b43815ee39323694372b5b61a", "object_relation": "md5", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089351, "uuid": "07b1040d-c0bb-4979-931e-40ba1b9351b7", "comment": "Malware payload", "value": "5cc33eddbe7afb9b67caa60dd6b135bee62b79f2756eeae5778e4ececd811442", "object_relation": "sha256", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089351, "uuid": "c8874890-7180-46e0-ba5e-fbfefe7a2f72", "comment": "Malware payload", "value": "0a6c556309b5e03b731a0e5dd8857ab7ed2d18eb", "object_relation": "sha1", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089351, "uuid": "b769f951-d020-443a-bbe4-ce511874c528", "comment": "Malware payload", "value": "b1356aff572afba6ec990d8f2efc91a6c5ad63efb0fc0ce0800d10e552e21b4c18ba4e1e545997551b3cd67c9e6ffcb0", "object_relation": "sha3-384", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089351, "uuid": "76934028-3ef6-4d0d-9391-d18ae553bf32", "value": "T168E3477066F74867149B90C069645B1ABEC6F723C91A1E913FEC1BE1CF52CA6ED2B01C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089351, "uuid": "fd71be9a-d471-4fdd-b8b9-6414ebd56a7e", "value": "768:GR9cvCwRKkRiRoRpRPfWZ6zZvMiR2GGY0p1WW/yxp9R:w9cCyK+kKpI6zbR2hY0p1WfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089351, "uuid": "dce541f8-38c8-4054-80cc-d7905b338223", "value": 155949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089351, "uuid": "8629beb3-5f52-48fa-a44b-9f4a8a2c63cd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089351, "uuid": "a25e39f0-cc63-4acc-9c9d-af1981b3c783", "value": "5cc33eddbe7afb9b67caa60dd6b135bee62b79f2756eeae5778e4ececd811442.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ceb27b-252b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774100381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100381, "uuid": "4a1e92c9-2dc3-412c-8d36-a2cedbecce8c", "comment": "Malware payload", "value": "a9bfbc0ef333f871d2d2cad91cdfa6ea", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100381, "uuid": "6b329f93-b7bd-4a7f-b675-7c0c4fca3ab3", "comment": "Malware payload", "value": "5f35fae9db1abbf9ee743d78ee65b6be5f3482bf11b5ae81ddd44da364291ee0", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100381, "uuid": "d79eaa2f-0a77-4e43-bb39-bed333956881", "comment": "Malware payload", "value": "ffa87e60d4b46faf22280c85636dcc87b33141bc", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100381, "uuid": "97200e81-8130-43e2-ab20-2a9bdecba9da", "comment": "Malware payload", "value": "efb97047df47897ee6f4de5d7f36825eb831a665cb6981cbf66736f45a5c59cb08076eb0ccb156fd565a287d1341fb02", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100381, "uuid": "451d8dc8-1c2a-4d10-abe0-b59353f00b9b", "value": "T1D9360F20927679D9EA37A3BFA0AD4FC1C110B4E0B555EA6F23782FB54F9134625B3903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100381, "uuid": "60e63fd5-52a3-48fb-a082-570a7209ef4d", "value": "49152:kGY+u6Q+DgZSGMTynsd6YAMV3eVougTuA9ljF1wyeDIKn1aae3usX:LN0sGJnDYAMV39gA9FF1feD91Y+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100381, "uuid": "ce300208-2329-4e1d-94be-6c4d40f5f6cc", "value": 5125120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100381, "uuid": "d6d66156-1920-4bf7-8756-0da0fa3ab9a5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100381, "uuid": "ba55817a-2f33-48f6-becd-f2a171bfb224", "value": "5f35fae9db1abbf9ee743d78ee65b6be5f3482bf11b5ae81ddd44da364291ee0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604d1f00-2518-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774092205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092205, "uuid": "abdd6763-38bd-4a5f-9e3e-df3a0b31760c", "comment": "Malware payload", "value": "5f1a7db47d897cdd474dacfa8d3c553f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092205, "uuid": "3c726266-b8a7-4e24-92aa-5d3bed0d119b", "comment": "Malware payload", "value": "6013b7c83d60ea0f0cd6b98bbfde2c959b6736765e4d49d03ec9d4f7737d9478", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092205, "uuid": "82732b12-ecae-42db-9c7e-a3a9c2d70262", "comment": "Malware payload", "value": "ceff932ee802bc7dcbe61f5f13e086e497226eec", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092205, "uuid": "51fcb04b-ebbf-4548-822e-333fed838eb6", "comment": "Malware payload", "value": "5008bdc5adb97853517a400ad95ded923ff1ba9514f078505255e66683cc588cff23fd681caa281d9b29e75f080254af", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092205, "uuid": "0e9c9e80-07da-4a25-8fb0-cfa218a67150", "value": "T1D231A01117F20328EAFB4F3D9CB6A3214676B90ADF21CF9F029041985574520E878F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092205, "uuid": "4bb77ea2-df7d-4d17-bea5-13aaf6e9e8e0", "value": "24:8kGdmGjMDvSwjKUaWU3AcPWkp+/CWzlsCeUMkWx34z0KRnAH4I0WK6c/6Cab7Oaq:8kEmeKpUQLl1eHJ3KTnIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092205, "uuid": "5ae48afc-f4ed-4692-86c7-7bbfbd73e1f5", "value": 1545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092205, "uuid": "e305aaca-dd8a-4d35-b33e-5744974fbf1b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092205, "uuid": "371c90b1-974b-4d60-9142-4089e68d23ca", "value": "IMG-651658890-png-lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d304a6f-2569-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774126881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126881, "uuid": "7319fea4-ff96-4cb6-b0a7-edb0b0600a5d", "comment": "Malware payload", "value": "c7621031488f75d919ec5c9935aa8319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126881, "uuid": "b8397f76-0511-4d10-90a6-a60dc487db8c", "comment": "Malware payload", "value": "617bf6c60afcec3b9b5f3a82fc999eb7f258868244df9a5fab029bf0b2844142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126881, "uuid": "cd3f22c3-9154-40b0-8edb-9698573368ed", "comment": "Malware payload", "value": "4faf1b7d87812117c6e85b780037534b51492083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126881, "uuid": "03a5a2bf-0b1a-45be-99ad-8dee6350f1a6", "comment": "Malware payload", "value": "0707a34040387fe1d6d3c1ff5fb23ec3616c4c4511dccb50d0c4978211552b42a35e92b8fcb332503ea7c19da1de9443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126881, "uuid": "986d6952-70be-48c4-b344-8f937e3c7ca8", "value": "T19FD73333DB556CB2F4ED883DF56B5071092EB938B9DD605BDA6D300EA130949ABE108F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126881, "uuid": "35a32f25-85c5-4316-a107-5f4f80d54bf5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126881, "uuid": "a4ff234c-f23c-435c-8ef3-bfec1aa8a7bc", "value": "1572864:eWDVF4kvp7bWLB9aSBcbGxrdN1oMTVjg7:e2VF4k9a37nKMTW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774126881, "uuid": "fc45d5e9-278b-40d5-bf49-645f66766dab", "value": 59973770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774126881, "uuid": "b4f8c469-7f95-4a6b-ae04-47a2f68214a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126881, "uuid": "be17ecdd-74e7-4476-92e7-12da2e1711c6", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ea6150-2507-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774085047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085047, "uuid": "27fd7386-b485-451d-963f-7cd0ad5df2ba", "comment": "Malware payload", "value": "2c5eb7faab3668566cfb11247e8cdfd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085047, "uuid": "0e61f817-8be3-4c9e-91d0-85a8117deed6", "comment": "Malware payload", "value": "625a58782958b22bfc4a35df93e876e438d1273dd3fd08c8fbfe01a3c69d87e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085047, "uuid": "22825210-594f-4023-8ad0-ac645ec6e333", "comment": "Malware payload", "value": "135517bd987b2d580483f04d3f5285610cc9c391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085047, "uuid": "ea949257-b4bb-4a96-8b9a-16139a01c375", "comment": "Malware payload", "value": "52828553772441eea445d3408add1300d42fe66a9f89e1caa9291752af9724a0b5376de6c1907118b9b7693bbf2e2548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085047, "uuid": "ec407355-da07-4998-ada9-20a4b8579e8b", "value": "T195371219D4773600E1EC8232B186CE195320FA5B16228CFF65BCC6C265137A77EB5A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085047, "uuid": "e4fa64d0-ab69-46ee-9a24-42b51df8d651", "value": "3aa237c99a25af881fa61986aee4b45b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085047, "uuid": "fc96bc02-827b-4fd8-9d5d-addc40330c58", "value": "393216:kfUhQ5zzPiYfcLYnzjbLYg/GXv2pXpH9P3il/gsHoEl8h/lt8/QH+/:1QpKYf+CLHGm9PggsHzylt8iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085047, "uuid": "2ff7f775-fb9a-4736-a2e1-4e83c45adddf", "value": 23428152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085047, "uuid": "f592d19b-1d09-4123-a421-4dcaafcab6a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085047, "uuid": "4dc97946-6a4e-4071-a905-edaaef047778", "value": "625a58782958b22bfc4a35df93e876e438d1273dd3fd08c8fbfe01a3c69d87e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec89d6e4-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054215, "uuid": "11dbdcc8-7134-44bd-9d62-cff40d644a15", "comment": "Malware payload (PEASS-NG)", "value": "dceded8bdcc8f03a4fc8101ab291f50d", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054215, "uuid": "44fae453-a70b-4227-8cd3-7bb9cb337cbb", "comment": "Malware payload (PEASS-NG)", "value": "64e35f89ac89fce7d2d52dc6064561451c0f262f51f10bdf17b296eddd60841f", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054215, "uuid": "981329d4-9a39-41af-9dbb-693476fa9752", "comment": "Malware payload (PEASS-NG)", "value": "f8787c3f049a1c017adeb923c3db5181513a4641", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054215, "uuid": "bd4a07bb-0711-47f3-b264-f82531316b61", "comment": "Malware payload (PEASS-NG)", "value": "d299eb05b741928756e37b7ed93618184583ba8e30c1bb544b396eb905854a3674155a50c0e68b60f09238e0f2a1ff3c", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054215, "uuid": "9ac1a580-5bcf-4058-aff5-746bee76c080", "value": "T13306AF99BD9C3D40DE896A3E5FF505C1272DFE4F2F4287173A1473AA26F22098E95234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054215, "uuid": "926e7f08-df6f-4707-99c1-51a20919d80f", "value": "49152:TZ1lK6gNrFxuv/pyJO0hnsVpx3/ZXPImKixHs:11lK6Ka/36R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054215, "uuid": "3e9e0f70-f619-437d-914e-d68c31ec973f", "value": 3923737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054215, "uuid": "173d6bc1-4c4d-4169-8175-421f3247d680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054215, "uuid": "f6ee319a-97d4-472c-9804-2032e891cb07", "value": "linpeas_linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d376d4eb-250c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774087244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087244, "uuid": "58b212bb-71e9-46b3-a9cf-624f192d34dc", "comment": "Malware payload", "value": "329a60722305b1e412bc56f3c9137dfa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087244, "uuid": "9363c4e3-fa16-4310-848c-b03548d54ba4", "comment": "Malware payload", "value": "65f0b96fec639f7f63da09e221082e0898002f5e883705e773b91ab0ad62f538", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087244, "uuid": "7142071e-39ff-4add-8455-b84b546ade99", "comment": "Malware payload", "value": "2eaadd730f104ac2d006dc8e67aed12e6b6a6931", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087244, "uuid": "f1ac80fc-b24a-498b-957e-7fd4573351b4", "comment": "Malware payload", "value": "aaa6a9d59cbb028c92ea55e9ab3f38946805fb7ca0a78bec991e0fab9880398907a65e70ab1e254fb2316e56daba8c29", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087244, "uuid": "744d7231-d6a7-4f6a-b160-f181ebd63263", "value": "T1065733EBF4648BDFD433C03E96F07664D0B83E6A669244222A5CF1BD69BF3803679145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087244, "uuid": "d13321a2-c4a1-4a65-9caa-d5ca12ea55ee", "value": "786432:inxE+q9QMNJrj42T1E8yQF3YG7frEGJmin9/2bHv:inyz1E8yYYwDX9/CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774087244, "uuid": "6fe44259-001f-4967-a1a0-9f6414aee7c9", "value": 29372416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774087244, "uuid": "097a7420-eccf-477c-a387-0167901e3634", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087244, "uuid": "507e424b-afff-4367-b559-efff382b1021", "value": "CrimsonLoader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb7f8ca-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054191, "uuid": "61956f4e-d28a-4d66-a934-a311c3c6ebec", "comment": "Malware payload (PEASS-NG)", "value": "f176900032466b032912ae1646af6ab9", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054191, "uuid": "6c50d573-c9cb-4fd2-967d-a305e4684805", "comment": "Malware payload (PEASS-NG)", "value": "6664b0422572b39301c42392eedd722e8007dc17b579e111166dc41f4519f306", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054191, "uuid": "6e44e712-19cf-4054-bb59-f158f02ba1e9", "comment": "Malware payload (PEASS-NG)", "value": "04334cb163c3e1623fe0dbc1f35348c53f12df5a", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054191, "uuid": "ef029748-172f-4278-90fe-5a84db2f3c91", "comment": "Malware payload (PEASS-NG)", "value": "febd286a4316700c1658391aaa2c817dddd2f012681a01bcabd0c3ed8ef786eba16da5d80d54510d98f9f2cc2b180b7b", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054191, "uuid": "47d0cbdb-6fa9-45c9-882b-f10494130ef4", "value": "T12C06B045EDC724B5D6031A3648EF56DB0B2CAF0B2F319F83B9443B6A657749B04B622C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054191, "uuid": "50054da5-ca3b-4684-9b72-298fadec3733", "value": "49152:YmhiUhF0R+rFxuv/pyD5mo/b1cpqRkzmE6Qv:Lh9b8k8ojO8xEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054191, "uuid": "8b405c19-2247-41ab-858b-f0ae73fe8421", "value": 3714212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054191, "uuid": "586390fc-bd71-42c8-a5e1-d589fb2a6347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054191, "uuid": "479af545-4e7e-486f-9c98-ecbd0d6281a7", "value": "linpeas_linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3b0e9b-252b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774100308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100308, "uuid": "d4b1e3ad-ac30-4080-b870-01cdab3d8a94", "comment": "Malware payload", "value": "4fbe9a06ae1992584eafd53bb5b2ef77", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100308, "uuid": "cd5bd224-cde3-4e04-a6f9-29a5ab212e4a", "comment": "Malware payload", "value": "674476f4d330270fad239a47fc0c4806b17675be074619d4125e46673581d6b6", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100308, "uuid": "3f917bf8-6025-4170-b4e9-53d7b0b144c3", "comment": "Malware payload", "value": "6baa66fd3a77e3ccac69c97884ed8cb381b2ffb4", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100308, "uuid": "55eaef30-fdc4-4b50-a627-ccf8f507a1cd", "comment": "Malware payload", "value": "08a392667bc464a2b1a8ce2cb8a0c4700a67b4f2ef52b473d52f4c067ee8d16fa355388f0678ea7f49f0c4e74ece81eb", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100308, "uuid": "2af5f369-521f-4c07-a721-c2b5020917cb", "value": "T1AC36D031927278D9EA3753BFA4AC4FD58015B4F0B519EA6B337C2FB58E9024661B2D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100308, "uuid": "8df50fa2-8c2c-45e2-a1ed-59dfdf598b5d", "value": "49152:bDa0YdMV3eVougTQAE4vLNgmUESIEjPMN2lv+oBBd+jF1wyeDIKz1a/6PE:f7YdMV396AE4veHjPMNa94F1feDh1Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100308, "uuid": "46c400c0-bc8c-4cbd-bdea-37a518f7e045", "value": 4887040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100308, "uuid": "7bf5dd1c-eda2-4696-a51f-5831708ab87b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100308, "uuid": "b7b131ec-271a-497b-b555-6aa7c56b1d68", "value": "MicrosoftEdgeUpdateTaskMachineCoreB.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13ee98d-251b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774093629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093629, "uuid": "b7f8ec2a-8948-4ee5-b70a-fbe0df287e11", "comment": "Malware payload", "value": "3de566e8d523a0d57429244ff39125dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093629, "uuid": "37c68c79-65e1-4740-b4f0-302e454e1e5a", "comment": "Malware payload", "value": "689d38aa455c64a1ae36e08f2531e97622aed9eb1e955639620ebb1966f34759", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093629, "uuid": "6fc49634-2ee8-4ce9-a203-caed3f0a9e61", "comment": "Malware payload", "value": "20f651cbc4dbc6ea8cf0de0ea986d4ff86b41573", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093629, "uuid": "17b0c740-a800-41cb-a833-f517515ee1ee", "comment": "Malware payload", "value": "86414d91071f40d454c82049260f93492d0a9c85580247ff72b2a7ce61a517f60b24f9f5cf1c8427e8af79aebab87252", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093629, "uuid": "7848e611-891a-4636-94bd-1de84fb064ce", "value": "T16734F78CA59E7145113FADB7692B209FD5699DC0A338D07CFAD4B91FBC2835C8827938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093629, "uuid": "7a43721f-fcc2-4150-8ae7-6b6dfdcbc93c", "value": "6144:m1iFdbQqSwqTlld6ZZnTAAS+CpV7/EVZQsXZ83sEcLCVoKUz:/hTKI8cEcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774093629, "uuid": "621ee4c6-c30c-44a2-9d44-8835af5b59db", "value": 237811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774093629, "uuid": "acdd8927-565c-4e69-bff3-4e81854e317a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093629, "uuid": "d75ef719-f63c-4ed3-9113-2be1032ca846", "value": "689d38aa455c64a1ae36e08f2531e97622aed9eb1e955639620ebb1966f34759.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b24f066-2519-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774092545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092545, "uuid": "911e1aac-76e3-4e6a-8c34-32754e4b81dc", "comment": "Malware payload", "value": "46b7dff19396d5a830ef7b608c7209e9", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092545, "uuid": "0e690755-8c7f-43c3-8d29-41044b758ccd", "comment": "Malware payload", "value": "698e1490e1d87b9ddd4136bae196709174ec8b9513f254bb42af45f640566291", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092545, "uuid": "ebb7c0dd-639d-4792-8dbf-ce4ce28e9ccb", "comment": "Malware payload", "value": "ae233b60d0917b9a3407c6638639e5393feb10a0", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092545, "uuid": "51e71972-4beb-4ccf-9387-62eb8384e7e7", "comment": "Malware payload", "value": "c5236412e19a13db35e4ab1da1dccd1890ee5e3343c92273dda9b345ff388b4fcdcce0175e75b220b099952372ff707a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092545, "uuid": "0bc13ddc-dc8c-4ec2-9547-52a49de05f17", "value": "T1AE51DC1BA7EC066BE4670734AEF3035737B4FC109FB6977959800229AC60B645E35BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092545, "uuid": "9bbd894e-74e5-45fa-acb4-cc1ff3030a89", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092545, "uuid": "9c2cd39b-01bd-4fde-8857-7c475f33085d", "value": "24:etGS//BepOEl/d8d7itoXltkZfCZnHUWI+ycuZhNWakS+PNnq:64MUuMtoXQJCxH31ulWa3iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092545, "uuid": "d7995870-8f64-475b-b01d-60a60e2f0c62", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092545, "uuid": "342dfc60-88da-4669-9bb9-2cacf1f96ce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092545, "uuid": "268a98f0-94a6-4c2d-8746-8cffdb5d17d5", "value": "tfkcyjuf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6aa2764-2512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774089880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089880, "uuid": "25f65d11-135e-4358-bd4c-68f724eb1282", "comment": "Malware payload", "value": "a45a6d6497366026ec7c3df17f205e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089880, "uuid": "61fbc0e1-0be7-4011-b40c-b51ea71a9089", "comment": "Malware payload", "value": "69d64e7daeed1a283c13eff702b73d780108301e1a9e104eddcc9637bd607aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089880, "uuid": "6a48c2a4-dd71-4dbc-8f94-bbaa0ad296b5", "comment": "Malware payload", "value": "16be8c56336db11bffb271b0ae057d4241d026d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089880, "uuid": "ff104b0e-79d8-449b-8cf8-6fc54e03d931", "comment": "Malware payload", "value": "21e6f0e753deee0162a65bcf1e25ac7fd6d1316c3181265970666c63f0c4cbfc6bb377fa1380b9b56f939e9d86da011d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089880, "uuid": "e35f79a2-36a1-4310-ad11-1a084a79cb8c", "value": "T1DCD4AEA6B2724E21D2492777D0DB8A40A3A45B46B1E7F30F714413E659033EFDE0B6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089880, "uuid": "e88ce165-9b14-41b7-8860-2a660d393465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089880, "uuid": "8167dc02-ffad-426e-9ce4-07cba079d68c", "value": "12288:RyuEC2MOWBUfknsQn5OQkVz7LwgWjA2cGMA+E3UL:Uel3BUMsQ5v8ogQA2cGM3QUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089880, "uuid": "06fffc70-f7b1-4ec6-9db9-6df47508587f", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089880, "uuid": "96cbcf64-b19c-4910-8473-3f44c1fa41ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089880, "uuid": "7896c64f-c1ac-41f5-8ff1-ca8ff5f629ae", "value": "a45a6d6497366026ec7c3df17f205e9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7c9963-252b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774100360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100360, "uuid": "e044e78a-fc48-43e4-ad4a-2639683fe74f", "comment": "Malware payload", "value": "26fb56426c249e2c2c00597b9a253475", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100360, "uuid": "a5c49241-4b8b-4ec3-a411-3c09faed8ac7", "comment": "Malware payload", "value": "6a408e350e42c1d3df8370839f37af561de50457e06a7c7d1574104de5b54056", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100360, "uuid": "b742a423-8ecd-4dce-9c09-8b4a84ddf5d1", "comment": "Malware payload", "value": "3df71b9ff06382889d88cea2ab4968e37a3c84e7", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100360, "uuid": "698b8703-77f2-4541-972f-2f2ffe396d6b", "comment": "Malware payload", "value": "c68efaa724ec6c28e19e1346321399293b389685b24bce7e2a73b5cb43d7c2b801652e003b9a18053d1803a7330bc8c2", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100360, "uuid": "13cadca1-f9ee-49fb-8133-1966bf62629a", "value": "T106360020927679D9EA37A3BFA0AD4FC1C110B4E0B555DA6F23782FB58F9134625B3903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100360, "uuid": "40bd8299-eb45-4e3f-847f-850215a8475d", "value": "49152:zGV+u6Q+DgZSGMTynsd6YAMV3eVougTuAo6jF1wyeDIKT1ak7Lq:/N0sGJnDYAMV39gAo6F1feDx157", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100360, "uuid": "cd6ef000-c443-41a7-b4dc-1ccd91c3e7cb", "value": 5125120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100360, "uuid": "9f780c56-f96f-4a19-8248-56f6ee80dc31", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100360, "uuid": "28e0777a-9a16-45ce-a52c-7bf5d08752db", "value": "6a408e350e42c1d3df8370839f37af561de50457e06a7c7d1574104de5b54056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5166b4-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053947, "uuid": "eebb2a6d-49f3-4b43-a16b-31e92e907ba6", "comment": "Malware payload (PEASS-NG)", "value": "d2ecd561959675034fd93e4111cda748", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053947, "uuid": "0a5e7ef9-72b6-44e6-bf22-ed42bfc6778c", "comment": "Malware payload (PEASS-NG)", "value": "6b6cc3179bf505565b0779133f52ad6cb96cd0649f939473e9756fdaa1367f78", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053947, "uuid": "beb672f4-7335-4631-9451-cc6295bfbe4e", "comment": "Malware payload (PEASS-NG)", "value": "75de54f64f595c9779bf6440312c2b167e173283", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053947, "uuid": "ada19455-9d21-4de0-9c18-599c760969fd", "comment": "Malware payload (PEASS-NG)", "value": "399d1f722d9528cee8286e3620aee379a78d2b62072f5c7f013a78745cbd46bcfaf02f3be5bec8efbd9f2f87a07974d6", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053947, "uuid": "0726ceb8-9930-4ed9-b8d5-8f1a7ddfbaca", "value": "T1C3B6D044A2D9096AD5AF4E7D806102321739760A139ACBCBFBCC82980F57FE5D777326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053947, "uuid": "9ad4f965-98d7-4f08-986d-57295c52cf22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053947, "uuid": "d1c5fd10-e024-49b0-83cf-70311ad7f91f", "value": "196608:eV5/AVBFUcwti7TQlyVN8iNISRTRmW5QWP:IxYHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053947, "uuid": "4dfda0fa-9064-4a40-86c4-f63d58b4150f", "value": 11108864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053947, "uuid": "b2bfd563-b612-47e4-a39b-9f72e78aa639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053947, "uuid": "b0d22b2d-3e1d-4bc2-8ef1-a4d0fea6509a", "value": "winPEASany.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7278c4-2538-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774106100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106100, "uuid": "0fecbbe3-cf32-4e91-a6b9-b416f3c17323", "comment": "Malware payload", "value": "4fecaa95dfd5881fc3df645f08c7c074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106100, "uuid": "4d8299cf-17c9-4585-b7f8-52c41ed77306", "comment": "Malware payload", "value": "6bd4d0c030239bb39468a9d5e544591485e41422c14160e32b4896ac57e9c6f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106100, "uuid": "a05d1f5d-6f1b-4906-b212-95c465ca5dcd", "comment": "Malware payload", "value": "18648c31573b4e84498d15c246fcb2221ca7dd8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106100, "uuid": "713399aa-d3e6-43a1-87e0-f4190bd46b44", "comment": "Malware payload", "value": "f1e3735a3b039f3143b36fbe68c51e5145a42038eebc8ab45d4306aba46693fbe06f92b8b591ca4419ce6ad4b1cf09f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106100, "uuid": "eb08ee83-656c-411d-a96c-c73110ba6270", "value": "T1D3D623EC99A122E4D4A30680738763DD75D0259E81ED4C2C79DB2C022F51DBF664EEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106100, "uuid": "b2044d06-2708-4ac6-bc9c-581fe2e405b7", "value": "e4d89cdc17cbaa51a438bc7d8a4abc27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106100, "uuid": "a564fc75-2256-499a-b595-08bd1616e07f", "value": "393216:NNTjiGISi4hBGvKhKWr69AIVsLEWxYruiQm0ew:TiGIS/B0KPDIQqruiQm0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774106100, "uuid": "1794dc56-5411-41af-8341-972c553e8c02", "value": 13498312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774106100, "uuid": "4580e5e3-aa42-4fd5-9f29-6cef0b40e320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106100, "uuid": "380fca46-f377-4022-bd57-538c388a1cdf", "value": "Lust Goddess.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4822573b-2525-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774097747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097747, "uuid": "d0d37fc9-3a64-47fe-98fa-807a10b57c6e", "comment": "Malware payload", "value": "1c5d954f5b1f8e9c873dc461dc274829", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097747, "uuid": "98e3e094-732b-41cc-9116-12e03821696b", "comment": "Malware payload", "value": "6be0a8c29a313dde74d61b19c82016bea9682a40e1d98f0fd83de13c7fb7c73e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097747, "uuid": "6ddc289b-e19e-4152-866a-777f395629d1", "comment": "Malware payload", "value": "37145c2edf034da08c6277f330ee1947903c152f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097747, "uuid": "dfca22b4-365b-462c-a245-abc05c6ee787", "comment": "Malware payload", "value": "098ba1148387b3365b2d4f0b5eb3fd1a9e3e424bd941ffe717c30ab3beae1a87b9def173e7b63b7d64c1ea77c7752e6b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097747, "uuid": "c366081a-8d28-42e7-8c0b-23d7d66b1663", "value": "T161664A47ECA144E9C0AAD23586739153BB717C494B2127D73BA0F7282F76BE0AE79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097747, "uuid": "ccb281c9-19e5-4d80-adfe-7b7f2f90022d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097747, "uuid": "f151ab59-3ab4-495a-8de2-d4089d9b6e25", "value": "49152:KmjkOXEey+PAdGFZB69aDQB5MSJHA64LVoI80dch8F+2zj3JLmQusCY2U4VkzKrW:KAkOkKlDLaI80GeHgQBNQXbKYwKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774097747, "uuid": "7fab7ca2-4dc9-43f0-babd-119ef72d3ec6", "value": 6963200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774097747, "uuid": "7f65e619-b68a-4c95-bdca-f6c683a00996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097747, "uuid": "4eecbe6c-9fd7-4918-8644-8cc260480661", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5004371-2539-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774106627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106627, "uuid": "4f097f6c-c0aa-4a27-b517-2b027ae4231b", "comment": "Malware payload", "value": "0b829991187db378ea12dc2d29b4b280", "object_relation": "md5", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106627, "uuid": "1280bdd0-568d-4459-b03b-fc96d606eb1a", "comment": "Malware payload", "value": "6c0f7dc0851b623e8957bf243eb5458e99dce79c303d875ff2c4f28d0098c83c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106627, "uuid": "e9b5bd81-bc86-4227-85ab-8904417e46be", "comment": "Malware payload", "value": "80b233ab210462a6bab320c786b82f58fb6f38de", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106627, "uuid": "836d639c-2346-4f37-aba1-5376a4f9e1e4", "comment": "Malware payload", "value": "b44c70fdcd0f19689db0369845b1e5eb4469bef3c91bc38ca84759f3709286ede7b5b0872050963c9cb274bbf73d32b7", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106627, "uuid": "9729792e-9767-499d-a21f-5828904e7b3f", "value": "T194142384A2F96F58BB97D706E332BF71AB9A747C73852C3C98A16B1842C395720510F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106627, "uuid": "4e1e1fe9-04c6-41b5-9192-02c8c1019d39", "value": "3072:aFy37uwKugpX7oy7TE1xCC6fy9ZLGxoPq1Avy7mxT+LiQ1DbLd+EpQsxKogz:aMKwdyUwKxCC6fyXGGBvA0cDfd+E3Klz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774106627, "uuid": "b8d3c362-1139-4cd5-9064-3a75cdac93b4", "value": 194538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774106627, "uuid": "e5179539-d914-43a3-83d9-31e0c916ba7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106627, "uuid": "969d5621-ec41-4e1d-943a-b3240ca5acab", "value": "Oauth3API.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f44047-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053860, "uuid": "a9d467d2-5db7-4229-b76c-b1122530e520", "comment": "Malware payload (PEASS-NG)", "value": "bfad03c7c0538be977704ca3d00675af", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053860, "uuid": "88d55745-7387-4fe6-99ca-3dfbb5e49830", "comment": "Malware payload (PEASS-NG)", "value": "6c523cd65d1dcb302b24fae3f602047b68961550c112dace0a147e8c343009ba", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053860, "uuid": "b6347a37-11c1-42d9-a376-238082bdebf4", "comment": "Malware payload (PEASS-NG)", "value": "51b82beba049c2879476e1fd45f44596239b3eab", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053860, "uuid": "8eb41e7c-1439-43ab-8514-6ed76ba1f231", "comment": "Malware payload (PEASS-NG)", "value": "a85ae74ea67a20560b681d415dd135d5b97fcada171232558d3f52a6711147b6bbd2cce77ecde6cfe3a51636c79d37d1", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053860, "uuid": "e74507f6-2f7b-4d70-b604-8f7097c0cfe3", "value": "T15606AF55EDC624B4D6031A3A48EF56DB0B3CBF072F319B83B9447B6AA17749704F6228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053860, "uuid": "dd6b606c-5f69-4c7f-9015-d9e87353f557", "value": "24576:O8TxO39UBLESgPwHZgtHVQ43P5Wp9qhKMMe1GexgE3n1WvxxqvGtm+mYRDgAr/ut:O8jhG1/GZiR+wArGOmo7S1cpMHxQE6iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053860, "uuid": "c3bc3e52-50c1-4044-b4fb-2252cc64bda6", "value": 3779748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053860, "uuid": "5e0ae0ac-ed8f-48df-a504-5b5b8c0f737e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053860, "uuid": "3fcc8c68-e948-4688-b0a2-6214d8b4fd39", "value": "linpeas_linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f30cb61-2580-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774136951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136951, "uuid": "8e37d1f5-10c1-4dac-b29c-a3aef00687d3", "comment": "Malware payload (Vidar)", "value": "ace025a6785c7d97b58e0def07d4690e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136951, "uuid": "418f5866-4536-41ca-8634-640c0af43878", "comment": "Malware payload (Vidar)", "value": "6c643706fb6ffa1622de6f9256be0e6676748e8b99dd1d3e31749695cfe79822", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136951, "uuid": "62c3c351-6e12-498a-845b-7b90067eb788", "comment": "Malware payload (Vidar)", "value": "bd53eda51a2e8591b29b4d39ce03c64bd3a0bc73", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136951, "uuid": "7f240ceb-7d9f-4b89-a4e2-522513d65f90", "comment": "Malware payload (Vidar)", "value": "192f074aa2e56d2834907d0138246f77ba18d1c325a8114c428fef04335aa0755e94706fee1bac065fd04b6f98108c6d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136951, "uuid": "25cf221d-3976-49dc-a5dd-0229cd0c1313", "value": "T12A2423DD6874A36DFECE02729641D292ED618C2B9FA5D0DEF098E6DD2F0382D315341A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136951, "uuid": "660af532-301b-484c-931f-22849de57ea5", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136951, "uuid": "70cd0c3c-6ab1-4867-a291-dead2f5fb53a", "value": "6144:rhFSwJnW8+vITyT/myad6zVuWP1IDu9Zv9l5LrdI:ryKW8e9T1QWP1IwZFLLRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774136951, "uuid": "050207aa-28e2-48ba-a31d-bb9ff2686dd5", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774136951, "uuid": "87fc82cf-5537-4a60-ac9a-c37c750f183c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136951, "uuid": "3bd9bc1b-f4be-46e5-8502-043da66a8cc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed02839-2569-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774127018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127018, "uuid": "945310cf-6949-490b-bb5c-dd11dd6a0bfb", "comment": "Malware payload (Mirai)", "value": "d25208a0a155d1cedbb6e591d8a3c5dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127018, "uuid": "b6dd098b-85b1-481c-aab1-776d7180ad4e", "comment": "Malware payload (Mirai)", "value": "6d9fb495bbbfb9e8ae52dc7690a89992c42785886939c037f103ee128a8175b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127018, "uuid": "2410dfb5-4513-4637-9066-efdccdd7d284", "comment": "Malware payload (Mirai)", "value": "47056f255719b9a6c84acc13075cf2a8bd824d10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127018, "uuid": "378981ec-f795-4028-99fb-2096b6c734be", "comment": "Malware payload (Mirai)", "value": "533575aeb905050b1a1bc527d5c6e56ff48ba55d378e505a00019759087623d2986a6620fbfae6c491f6601e3e3cdd01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127018, "uuid": "acf49dbf-63a2-4a7a-abb6-7fadec640217", "value": "T133F3971A6F328F7EF269877047F78E31975877D626E1D684E1ACD5401E202CE241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127018, "uuid": "90cebc53-e9cc-4be9-bb9d-d77270bf23d3", "value": "3072:dwDaso8Bv4NuvdqYRtRSQDuLjgfb20gKoOF9:dwDlL94NuvAYRyfvgfbtdN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774127018, "uuid": "27d99f78-0f9c-4bd3-a2c1-0f86ef9512cd", "value": 157768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774127018, "uuid": "85bab151-4bb7-4425-b542-90bb962db834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127018, "uuid": "75eea26c-c396-4af5-b1b0-05f811a006ca", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa3d5a0-24d0-11f1-a769-42010a9c0008", "comment": "Malware payload (FRP)", "timestamp": 1774061164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061164, "uuid": "3e8ae548-6e1a-4d9e-a7b4-64a1bf8f3c51", "comment": "Malware payload (FRP)", "value": "f453ad35d80c25a4d4f1e5a46fbaf883", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061164, "uuid": "15f343c1-32e7-4de2-befb-f78c853843d4", "comment": "Malware payload (FRP)", "value": "6e89b763cd4dd79f0c3082f09813efbd3dac4374a95455fe86ed27c363309a45", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061164, "uuid": "94b5fef8-fb36-4b2e-8edb-4a2de41669e5", "comment": "Malware payload (FRP)", "value": "57a48a88bc122cc156acc8946df5522f2436ac4b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061164, "uuid": "aef08656-0a94-47d4-a27d-476c012b1566", "comment": "Malware payload (FRP)", "value": "620cf09a190bc390f8d5e8be2702333918f0e99ed1f36f5e1f58e1115e6db471f9bc3e97eecc310b6bb4d2b6924fc302", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061164, "uuid": "de5a8beb-8e8d-4274-a802-00781f3bc600", "value": "T1DAF66B57ECA104E8C1AED6708566A653BF707C494B2523D72B60F2243F73BD0AEB9760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061164, "uuid": "d78431a8-f911-4a85-8614-0de5fa0b6ea7", "value": "b196866f0bf37f1f128fa153413b744f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061164, "uuid": "7a9d89f9-517a-428d-a0cf-ae7eee8243c6", "value": "196608:zp0vW0wJw1BSukrzCuxTaykn6g8Cfr+Hjm:zp0vYw1BSfrmUk8Cfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774061164, "uuid": "57189fdf-9980-4485-b9b2-433c00f18bdf", "value": 16777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774061164, "uuid": "2a3c2326-775a-4786-9872-487ff84ab449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061164, "uuid": "cc324a95-654a-4277-a7a6-7293dd3125e5", "value": "frpc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c0cd9b-256b-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1774127706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127706, "uuid": "b28cd351-fcb1-4f24-9d63-0a2dadff6d6f", "comment": "Malware payload (Hajime)", "value": "ac8524c75f109c5b9c0a89ca01d1a6f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127706, "uuid": "6a6bb985-856f-49fd-a859-e3f2da5aa0dc", "comment": "Malware payload (Hajime)", "value": "6fb391ff4f585925c0f40c8f9e6b69a00110b6295fcacb7a636c9a39c3924299", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127706, "uuid": "1543bf93-6b6f-491d-9a81-38d0dff9c309", "comment": "Malware payload (Hajime)", "value": "a7bf98452425ba7cee6ecc0283d8b69c30d797d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774127706, "uuid": "3e1a17cd-8694-4116-b2f6-635d45d0b80b", "comment": "Malware payload (Hajime)", "value": "6a19fd9f92d1da67705ec6bec901723b6b9ad5d0318cdf844fde44b3ed77498c0d0a038d9d3bb7d4e8403825ff6143af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127706, "uuid": "6c8bf8aa-34ad-4a89-846d-ccdff306b3e7", "value": "T1C043124623663E76857249F0A7FCBF8EE24A3E588FF55C197C117A28A93136D2CC491C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127706, "uuid": "d1f20dc2-d00e-472c-91c1-1fd2694d6b1b", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6EfyqH:yYI0ARqw1qAEv7UIFM8oJorFquyjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774127706, "uuid": "af7edec3-fc99-4b80-91f5-15f89963174f", "value": 58220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774127706, "uuid": "a7f12c70-1aff-47d2-9ae9-6f4ff1627f75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774127706, "uuid": "a5689c38-d5c8-4442-900b-2d19bdd1766b", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d869618-2518-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774092227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092227, "uuid": "245e65bb-02b8-401a-883d-eca2229d1631", "comment": "Malware payload (NetSupport)", "value": "9f18081e6dd8bf1ef4f33bdd110284c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092227, "uuid": "50cb29b9-1564-42c0-973f-36654909618a", "comment": "Malware payload (NetSupport)", "value": "713f95a3ebdf4d45783683d67740c3fbbdb85e89f1b632e2af66c8deb388e6bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092227, "uuid": "1af4a00e-616e-48e5-a1c1-d43a811fc7eb", "comment": "Malware payload (NetSupport)", "value": "5cf261d5872477466a1000b47fb0a2c3ee7458cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092227, "uuid": "6e7905ba-27b0-4e96-9e52-0dfc098d0204", "comment": "Malware payload (NetSupport)", "value": "dc99e14c86e15e26819779eecb982b7a8708dcb579256ffeabaeaef589c9126615df9af115133fdfa515648537e422f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092227, "uuid": "0deea76b-d19d-4f21-99d6-4d9e01c11d44", "value": "T173B55B1BFC7018BAD06AA1318966A151BA717C442F316FCB2A90F7782FB37E09D78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092227, "uuid": "7223387a-f070-4744-8fcb-4fd7bd892f8d", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092227, "uuid": "38c104f6-c28c-4778-9b3c-50fd2e846f56", "value": "24576:fo+VQR7KX7KyHT0pIaQUkUHDloPZaYv6vOjROhV4jtwvC1q0Kos8ciD/QvUSgvsy:fo4gKGyHQGlejloP/tjtQc3VQ2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092227, "uuid": "117e303a-26fb-4395-b66e-dcb896edcd04", "value": 2432616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092227, "uuid": "031fbad6-e700-42b3-b7a0-ab183ec1b174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092227, "uuid": "4bc5416e-0fba-44bd-9798-55b5362b55ac", "value": "SecuriteInfo.com.FileRepMalware.25343221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946c2935-253f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774109042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109042, "uuid": "6289f060-68ac-4a66-a746-3afdea747f10", "comment": "Malware payload", "value": "f0393a5e1279c00e329bc4d8416859de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109042, "uuid": "ce6637ef-bb59-4c75-bace-ec91eecfbe93", "comment": "Malware payload", "value": "727b2c2d60942731cc9cd69cb1905482977778dc4fc64eb72406436db41c8d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109042, "uuid": "ed04f7fe-da6b-4e8a-b0ee-732b23c20c2f", "comment": "Malware payload", "value": "7315c5d6d31af9821e3056848f5856e8967d4ef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109042, "uuid": "7f0f9e35-b929-4bd1-b897-9ce52df8ef35", "comment": "Malware payload", "value": "b03923e80bb75798a9aae13ec87e098468f90b4c665e35037ceffdc73a956d06db6aabe1380310f25c2bed9c29d9157b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109042, "uuid": "3c8b4386-7150-4463-b454-2a5037d4c8ea", "value": "T13DB1C60F7A684632CC8C57B4468341C10277724783AA9F970FCFE89C9B5A7791265FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109042, "uuid": "87d967b6-1371-4c7a-8405-83b721b5d1c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109042, "uuid": "0f79f692-73bb-479b-b8a9-7483f47a0bbe", "value": "96:doui4PKFs045e2miigLXs6xu6cE2UHQUmu:Ws045AVgLXV3H37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774109042, "uuid": "01c3e17d-17ec-49ec-b865-180231bb30be", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774109042, "uuid": "40095f46-c95f-4cd6-b929-4d3cb96d6159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109042, "uuid": "7396709a-a607-4231-848b-351d337a0ed4", "value": "Crack Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3bf632-2507-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774085168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085168, "uuid": "2b8c42b4-afb4-4910-b711-a239ecae90fe", "comment": "Malware payload", "value": "05cd5938d138f77e2488a1a2f2acb1c2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085168, "uuid": "9037ce30-1c1c-4cbb-92fe-e3d3297f1600", "comment": "Malware payload", "value": "73d2c1402899b5568b993fd0ffc641391ce4e4299d7c90bf0fff97621b35e308", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085168, "uuid": "9ee25492-f09e-461d-bcf1-acf915e043c5", "comment": "Malware payload", "value": "a712fc9ac0eb5407472d54cce5b8cb88a3a60816", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085168, "uuid": "8cad0bd8-5ba4-4c42-b161-178a25ad5caf", "comment": "Malware payload", "value": "141a1b4dd5e5400f8a7a22370517d516b205c26c80d1b21ee48d9f733c0b3ce850880cb2d7cde43ba93f3652287bc294", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085168, "uuid": "8b618eb5-0736-4ba0-a919-a9852f4b4b1b", "value": "T160E4C787F1208AC7F44FDE7F14504210AEF0E4704607F2562B6E895A6FEB9C89E653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085168, "uuid": "1fa194d1-4025-4fce-abfd-ef2dacab8dab", "value": "6144:S1eMX5Uh/W94gpr2T0PjhMoMa/lB9eUwqq/8DBuF4kUluaGL/1Fp3x1ZFcI:SlLEq3o95/1n8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085168, "uuid": "7748efcc-604b-45f8-8f9d-26c32cc71f44", "value": 702532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085168, "uuid": "82df33c2-22f8-4a07-af7b-939096c08720", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085168, "uuid": "079ee1e3-2edb-428c-85e1-0f04fcada77f", "value": "donutsmpdupe-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7d3128-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053867, "uuid": "c408e44b-2393-49ec-8e3e-1ab8b1616673", "comment": "Malware payload (PEASS-NG)", "value": "f9563547a071ce28d638c02284d8168d", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053867, "uuid": "af23d1c9-6563-4b65-92d4-8f09ccac131a", "comment": "Malware payload (PEASS-NG)", "value": "740ba132020a6da830165ccae735eac97faf04d74c3ab747e02f535fd827ccaf", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053867, "uuid": "1bd109da-4136-42e0-a47c-f5ecaefdd376", "comment": "Malware payload (PEASS-NG)", "value": "7174d9b963714fa31feea87637b0ef7022403d8b", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053867, "uuid": "5e004d46-ca16-4740-995b-b5701c53def9", "comment": "Malware payload (PEASS-NG)", "value": "5f3c7da49d0b5fe89838c2e57e0d0d3a20e39d11ec9ca5c28086a8d56c41642afd3bad2ddd568d734cf64dcb84992a01", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053867, "uuid": "8ef9afa3-07b7-4972-bc59-5bfe6d131766", "value": "T11A06BE4B7DE03954C626523B89EA69C26B7CFD472B3117C73E40736E2A726C618F9324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053867, "uuid": "087f23d6-e91d-4e6f-a205-f4f4aa0f2e27", "value": "49152:voruXVED9DU1xR+wArBFHw9q5IQK2DDk48dSQ+A:v3VT+CqZKY6dSQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053867, "uuid": "601ceb48-690e-419b-9a7e-d9c32777b1f7", "value": 3931744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053867, "uuid": "d7b15974-b569-4392-ac95-49843f893f8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053867, "uuid": "58c34b84-add1-4e19-9dd1-dbd7dd5473a3", "value": "linpeas_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ebee92-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054207, "uuid": "46155e2d-37bc-4970-8e48-45891d1e38ea", "comment": "Malware payload (PEASS-NG)", "value": "c98770a45b52eeb7772e376cb16091e6", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054207, "uuid": "55733ff9-f0e7-41cc-a270-1bbef0aa7410", "comment": "Malware payload (PEASS-NG)", "value": "757fab47afb89ab13052ce31a1f86c4d74397acf375654f763266e67dae319f4", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054207, "uuid": "8e8bb62f-b6fa-43b5-a128-5c00ded5f164", "comment": "Malware payload (PEASS-NG)", "value": "f23f3fdac20c505e0328154c7b304872046bfb00", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054207, "uuid": "a08a5b39-f1eb-4ef7-9d8d-9db063a00d1c", "comment": "Malware payload (PEASS-NG)", "value": "433a519b42a3c7c0255fac057a888a49d086bb7a4e1bf3edd30aac34e5c60ca45eadf82d32e1867f9baf5a277ce0da7c", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054207, "uuid": "34cf7fef-d3f8-45df-bff8-370531360336", "value": "T138069D4B7CD12A45C5D5263BACEE45C4376AAFBB2B9253063D04FA7936BF08E08B5314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054207, "uuid": "628965ed-67b0-441e-96ed-c3b7c5722a7e", "value": "49152:++BrG1RvwrFxuv/pyC+GghWI3UioF0XpmFA:VBrGxghWSUJGpm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054207, "uuid": "6acd1352-7add-408a-a923-75414be18f17", "value": 3790937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054207, "uuid": "fdd2cc6c-a463-4f29-b44d-c0c3e85073fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054207, "uuid": "1033e8e3-994a-4d1e-9d49-9e4b49cd92a0", "value": "linpeas_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550f2f62-252b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774100346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100346, "uuid": "e71e58dd-db7a-45b3-99c3-a73c4d6131c8", "comment": "Malware payload", "value": "f4509e1609a7bdf1111678125bc38c12", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100346, "uuid": "080e265a-170b-4f6f-bd9c-59319e4ad4d8", "comment": "Malware payload", "value": "765ba6cf07d49108348654db1592625d83508bf938ac6e48c29e11f5a5d09cc5", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100346, "uuid": "1d376968-7907-4e0c-b9be-d4bd36544821", "comment": "Malware payload", "value": "4d147886a6effa3c1dd07a86fee3b3b77f6fbe7b", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100346, "uuid": "02a9727b-89ad-4247-9cc9-9a77508b7784", "comment": "Malware payload", "value": "381e4e7aae592f19f25be53adff763fce6bbbe379788c98cdfc7aef67279b40813e0db7b4f795312501a2f58ee40b4d4", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100346, "uuid": "f025b674-fa0e-4caa-b716-257a7407d423", "value": "T1EC36E031927278D9EA3753BFA4AC4FD58114B4F0B519EA6B337C2FB58E9024661B2D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100346, "uuid": "3efd8350-9a11-49a5-acf4-f9ff220ea14b", "value": "49152:eYLYBMV3eVougTSA94vLNgmUESIEjPMN2lv+oBW5jF1wyeDIKT1ak7Lq:NYBMV39MA94veHjPMNaKpF1feDx157", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100346, "uuid": "b091e397-22d2-421c-a153-8a50cb3066ca", "value": 4913152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100346, "uuid": "ae6499f7-c177-46d3-8c2c-e6f9c126ea9d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100346, "uuid": "72d9e4ab-5280-4434-833d-6523ad643a68", "value": "765ba6cf07d49108348654db1592625d83508bf938ac6e48c29e11f5a5d09cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63b32be-251a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774093261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093261, "uuid": "d21e660c-531b-4fad-a354-a25981fc9996", "comment": "Malware payload", "value": "e03b1c6501bd30f2367eafa709662c20", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093261, "uuid": "c82f9bd2-c167-412f-b7a8-b646a7e9a835", "comment": "Malware payload", "value": "7763c0136718763ecc30b82d987cf8806d53d3bb1a6cae6e6bfbc8632604f4b8", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093261, "uuid": "470964fc-e7e1-49ab-880e-6b84843d6db6", "comment": "Malware payload", "value": "df83f7333924b0fbea21f5c91fa30839a8e61b6f", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774093261, "uuid": "e557aba0-e964-4fe1-b560-41415ed8ec19", "comment": "Malware payload", "value": "4fcfbc58eaf357cc35efe88142b2e91080cccb42092772be8b73378024912deee9c491f123ab6ce109b77d49947a6826", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093261, "uuid": "60e1f0a0-9611-421a-ba7f-e6128c75b1d4", "value": "T11634A3DC768F71410E777CBB6A276111F62ACC852648D268F6A175EFBC6431F8822B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093261, "uuid": "b125692a-88de-4c9b-a0a3-fd2199bb2cd9", "value": "3072:BqR/lv8hJ1vjl246MO+YhcYKDXmEkrGuUTFBpXn+eTYbw2Sv:BkN8hJ15246MO+YhcNDXkrtUhsbw2Sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774093261, "uuid": "e064fbc6-aeef-4272-98cf-8f602614b51c", "value": 236730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774093261, "uuid": "59299efc-1069-440f-b836-47f5b6109b51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774093261, "uuid": "27c599a0-122e-471d-a419-de684d3169ff", "value": "Co6uaJOdLVcIK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e01f490-2567-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774126104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126104, "uuid": "c57d9f1b-a9f3-4da8-b808-78c55b5b23e2", "comment": "Malware payload (Mirai)", "value": "534fee99bec4d3ab6226492056c9a439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126104, "uuid": "5c08b1a2-0315-4257-84fc-79f836f7616b", "comment": "Malware payload (Mirai)", "value": "77d820cc5f0aa6d8b0564991fe42f705bd42ba8bc57c5c1177142534f2239c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126104, "uuid": "39fe74c8-0ee5-453e-82a7-8f427e78db72", "comment": "Malware payload (Mirai)", "value": "9fd4f7936466c512f489a9c7ca1bb6d8372dbf2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126104, "uuid": "a3f5ee6b-5d92-4d35-8c3a-882f197facdd", "comment": "Malware payload (Mirai)", "value": "5f55434587e1a1fe0a5b6f1d0caa6d367ed25fd3818114ac084a9d1f2ca369bc224cf9bf4277a5c23ca699d1b71eab16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126104, "uuid": "ddd1be72-9b17-428d-87af-0e77c6090385", "value": "T12304F946EB414F03C4D727B9F6DF424533239BA4D3EB7306A5286FB43A8279A0F26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126104, "uuid": "0fd7d82e-ef65-4a70-917c-6eea4629ef37", "value": "3072:oWmbBEePj/UjgmPEatQ1CMs+pG0wH13D+bhkouM/Ryndy:oWE/U8OEatQ1CMsES13D+tpuM/RynI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774126104, "uuid": "51d15300-a66a-4e87-8dca-8a14a16e4ca4", "value": 177895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774126104, "uuid": "9b76b994-dda1-45f8-ab1b-e58e3891949e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126104, "uuid": "93bbc2ce-4a06-4fe4-9c31-87fcaafad0df", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41034bdf-2514-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774090434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090434, "uuid": "b8a86cef-574e-4814-a403-50dc54321d63", "comment": "Malware payload", "value": "1409b0bebe07b40b2599699e4b3c8b5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090434, "uuid": "af39604e-ff8c-43d9-8c3e-4c8d83120abb", "comment": "Malware payload", "value": "7862b6bf0dcf721c094fd2ef4054ef0abf5918972287eba712bcff4c5e618527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090434, "uuid": "b5e7c12f-9d46-4ea8-9276-ffb65bd0d81b", "comment": "Malware payload", "value": "a0f1279fa22b91c03e8c6a76803a10b49e16aa91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090434, "uuid": "c46ddb00-21bc-4719-81c5-86d1df3d1267", "comment": "Malware payload", "value": "bdb2a97cb8c8349a40e68903714f72a2268c9d6c4d3d9429f44beaeffcafd1b87e83e0abdb49ba23722e6b2e80b848e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090434, "uuid": "ab2f40ab-d976-4828-a0ab-1e68dfe47abd", "value": "T18D13D74AFD80AF00D4D521BAFF4E124973535B6CE3FE7111AE116B2567CA96B0F3A806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090434, "uuid": "271a058e-e732-46d0-8ad7-fb62f738787a", "value": "768:TVn33LEA8b4pcMXWkOdNKmMdlNcihpRNRUD9S8t8ZHblXdeppw:TVn37EA8b4pcsWneHdlNciNNy9M1dOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774090434, "uuid": "136fcfed-bbc6-4996-89ce-e1e1593c34ad", "value": 44204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774090434, "uuid": "62dc60ae-554c-4d85-a041-3e6e006c537e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090434, "uuid": "5b3924e2-c562-43fa-84a3-1e3b06511c71", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c99e12-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053883, "uuid": "58f4fe0d-3718-4438-9242-6ab628f252ac", "comment": "Malware payload (PEASS-NG)", "value": "c955e7251d9029691ffba33b39348818", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053883, "uuid": "756ebece-6a62-4c89-8319-e91705c0631d", "comment": "Malware payload (PEASS-NG)", "value": "793663819dfdf5baf435ecccd2a4110953cf045dacafe2dba309b45b9f3a8490", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053883, "uuid": "826c0119-3d3c-406d-953d-19b24d66621e", "comment": "Malware payload (PEASS-NG)", "value": "6fa85ae541c959e9541a9d3764427480e85dc85f", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053883, "uuid": "2d27e8c4-9af1-4ade-aa6c-dfcde35afa7d", "comment": "Malware payload (PEASS-NG)", "value": "b11a05b828295041e8dadef1fa2a16ca3201fa452e959e5c394be4bbfc8eb73bb127b809bd302c5699275680fa3833d7", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053883, "uuid": "519ab5b7-ac97-4d56-9835-0b28fe41b874", "value": "T113B6D04062DD046DD6AF0E79906202324B35761A579A8BC7FBCCC0980F5BFE29F76726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053883, "uuid": "a837b46a-de16-4303-8d39-8cd5797de88e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053883, "uuid": "f2731968-5a14-40de-a136-1a7e7e51d97e", "value": "98304:BoKcJJHhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qj:uPzHVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053883, "uuid": "8d03ed2b-027d-4599-8e16-c070aee41797", "value": 10961920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053883, "uuid": "075bdeac-e138-40cb-8989-f8472378d752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053883, "uuid": "a98a9bbb-af1e-45c9-ae06-cde12831a04d", "value": "winPEASany_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af063a4-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057353, "uuid": "e8d988d6-47fd-4001-81b0-28ce8199b3fd", "comment": "Malware payload (PEASS-NG)", "value": "2efae60c76c1f7eca23a3a8ee3dc5449", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057353, "uuid": "954bdc49-496d-47f1-a492-a6225c6771ae", "comment": "Malware payload (PEASS-NG)", "value": "7a93df75904d890d02b798ddeb1a3f50456c299f3b37586d6a1b72798f1b4284", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057353, "uuid": "f46eb3a9-5c9d-449f-9f44-8c05ab19b851", "comment": "Malware payload (PEASS-NG)", "value": "14ff0989bb9cca06db4a2c72506e342a7c70a0b8", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057353, "uuid": "cf94b87b-2eab-44c0-aca5-24c46aa75749", "comment": "Malware payload (PEASS-NG)", "value": "0310671ca1273b126a7ce38b3c34154df46f885232bedeabec67dd54deac5f304f53a788a7ed39eeddd5bac8ca902b0a", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057353, "uuid": "22cd805c-fdab-4e7c-9f62-3647393afbe0", "value": "T1F0F6CF770687BCF93E650C95980129490C5D7B4F2229524AFACC31BE73EE5A8CE3C979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057353, "uuid": "3aa91145-0012-4401-b5e7-6a6cdd6812b6", "value": "49152:Sf5WGQHvJxvTSg7Oq6EE+GFbvC84ko2ACfjIjvRoIjPMcIxDFG72HwgSPEUMWS6x:SzDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057353, "uuid": "a7c918f5-22d4-480c-8f13-1ef578653740", "value": 16550048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057353, "uuid": "659fd78f-c167-4dbe-92a7-da106ce8596b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057353, "uuid": "24bebbfb-43a5-4e46-a1a5-508df01fe8e9", "value": "linpeas_fat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696e3126-2511-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1774089213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089213, "uuid": "23a9cd8d-5364-42d9-b014-2ab761f202a3", "comment": "Malware payload (SnakeKeylogger)", "value": "0243cdc4fc22294a11cb2d5339a5003c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089213, "uuid": "3dd92d0e-9bc7-49c6-b2c3-38d3257b60d9", "comment": "Malware payload (SnakeKeylogger)", "value": "7c40815633530147ad907fdc252aad2761fe35088020db35c4325dcc0f4d3329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089213, "uuid": "285442b8-f189-4b71-917f-52aca092a28d", "comment": "Malware payload (SnakeKeylogger)", "value": "b105ac3b88258aded482a52a507c9143126f57dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089213, "uuid": "dd017bc5-e33f-4527-bd7d-498eef7a75ca", "comment": "Malware payload (SnakeKeylogger)", "value": "1e3cbb2345c38026732652ac193095068de2eaf4aebc971f0f3d1c3d98d38f40632e44f2240d99d3914a341304f9a4fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089213, "uuid": "9a550e8d-fbbf-43a3-b986-f55668afde65", "value": "T18B2501147698DB02D8BB1BF85961E13913B96E9DA832D346CFED3EDB39367001909393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089213, "uuid": "258da594-283b-42be-a091-4c254cc217c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089213, "uuid": "86308b6d-59c1-4bac-bf62-38963b87f214", "value": "12288:xMYLbmCxMhvXuHPub6HG9sb6tWDNII/MA22sgnTZU3/V2XVqBy17J0dCGq0qIR8p:rvMJ9b6HG4fZ22X2P6n11O6Iyua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089213, "uuid": "4738859f-9e18-4497-b03f-6355132042e4", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089213, "uuid": "7162d8a7-519f-4961-aaa8-be20b8e680fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089213, "uuid": "60c5c480-3176-4768-a8fb-3dfede92649b", "value": "RFQ - 00453-6HARADH & WUDAYHI PROJECT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b6cdb4-2510-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774088769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088769, "uuid": "d1a0b139-31c5-42e6-b62b-eb2d6a2cf12e", "comment": "Malware payload", "value": "0183eb60d3aa37372f014ffcd7a7e13b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088769, "uuid": "4c0c7f99-065b-4725-a784-a54bd9016bb5", "comment": "Malware payload", "value": "7dcb596825fdd541a1115a66b4b9e86d340d4817277b688e7b6a1cf15800898a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088769, "uuid": "b6b61d9a-aca8-406e-b069-75df50e0200c", "comment": "Malware payload", "value": "20270fb5d5a06ab8c177b8f27809fda2e1a0c05c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088769, "uuid": "f30d7a16-a25a-4063-8356-b2352eb7f8c1", "comment": "Malware payload", "value": "de8eb0016b0e81c012182b8c71d8ab98d59867f33d0cc8e0c11a34c841109c0341d52350dab726ca80dbdd29a258ffda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088769, "uuid": "602c818f-2ae9-4f1c-8647-026d974497b3", "value": "T114B3190573E94A15F1FF9F78A87542160B36FDA79D32E34E1C9824991E367C0A920BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088769, "uuid": "9126aa0c-e427-4323-b555-52a36e6a5c45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088769, "uuid": "8ceb4afb-254c-4e54-bf67-d8b79c7e4b30", "value": "3072:pAWkXU2Bgw23n9R0hrkm3/AbYAwwHp9LyIXJFl1:s/BgwSf4AOIbvJxlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774088769, "uuid": "bfd89c54-76d9-4972-8a3e-b3939ebbb1e5", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774088769, "uuid": "8e60e303-e383-4b18-841c-ed3e6636eb14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088769, "uuid": "14666806-d45a-4613-bcd6-35a0116a3f56", "value": "0183eb60d3aa37372f014ffcd7a7e13b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2028ad26-24d0-11f1-a769-42010a9c0008", "comment": "Malware payload (FRP)", "timestamp": 1774061173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061173, "uuid": "0bc18a51-2f8e-43c2-bfa5-b2d8675f0d4d", "comment": "Malware payload (FRP)", "value": "e98310ce4e5a79b2859f089ddf490524", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061173, "uuid": "86917240-a0d8-44d1-ac0f-5324277f9bd2", "comment": "Malware payload (FRP)", "value": "7de3df7d279686adf7a3f9a3160dbbd35be0024cd3de2a22cae911efb61fef8c", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061173, "uuid": "500278e7-80bc-4e74-8da5-16fe0de8fbc4", "comment": "Malware payload (FRP)", "value": "d3d0ee6f00327dd153f683381beb9b9570eaae7b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061173, "uuid": "35571768-c514-41bd-8f2b-5504b4cf291b", "comment": "Malware payload (FRP)", "value": "f8dc12df4855ffa6e846ce154d72f5d24b445c19a47f45b95ac891df316001d1468e45a1e722e75ddc2b61625b715fd6", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061173, "uuid": "bebe265c-060e-4a40-af49-d78cc5f48b6b", "value": "T1ED275B43F9A500E8C1A9D674C6629223BF717C495B3163D72B60F6243F76BD0AEBA350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061173, "uuid": "19b138e6-b1d0-4160-8b39-cb1158ee3d23", "value": "b196866f0bf37f1f128fa153413b744f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061173, "uuid": "88b1d954-3cc4-45e1-a260-3a3213cc54fc", "value": "196608:5lewIxTNLNlGa/QkTEtenTiW6ykY3znbFL+vjllCAqkTWIkUK5AvW:5lNyLNlGaC+nrnbFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774061173, "uuid": "5e0fd24c-ca28-4994-b6c9-dba9864fe6c9", "value": 20709376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774061173, "uuid": "e8225795-17e2-4b48-b59a-2cd90623f7ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061173, "uuid": "37c3f837-d87e-4ec1-b9ff-e07db42595ca", "value": "frps.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67df05df-2539-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774106391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106391, "uuid": "9ab5c438-07db-4efa-8886-8a9e6dec3188", "comment": "Malware payload", "value": "3ee4948bce9fa4b1796496d600f898d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106391, "uuid": "08a05d55-0ec1-4e3b-8ee7-379d8238d7b5", "comment": "Malware payload", "value": "7f233a41dac37c030a45122be157023f9c30f7afbc04ea6db127a9c845a3f8e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106391, "uuid": "a175a82f-3acc-4e35-b365-9a1cdebfb533", "comment": "Malware payload", "value": "740acfd5979f727d303253c37993c4a902402923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106391, "uuid": "548f31b9-4cca-4de6-acca-526ae5d822d1", "comment": "Malware payload", "value": "f3bf78d0821faea1ff96e079ea30f5227fd1080e6a3b8aabeb92a44d0538dfbfba4eed324545d849567e790f52a45329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106391, "uuid": "e4d07a5b-ad9e-4a4d-8e7d-ceb58098534b", "value": "T1AA7633E60298F4C4CA28357824A1DE8E0275F9EE3F2F57B6483A56DC1A7771F344A943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106391, "uuid": "8a00d5eb-ef5d-4a7c-baaf-18287846f47e", "value": "60559adcf3698c3eb3c69577ebf28413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106391, "uuid": "2501f76d-b680-43e6-bc97-3afd312e5f87", "value": "24576:0Cwi3TXC9sISBvKLv75IU3blSjY8v/Q8j6c5jR:R3Tw5LDd3b0D/Q8Oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774106391, "uuid": "b57dfd62-1136-4fd4-8f09-74bfbf9f2f97", "value": 7134208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774106391, "uuid": "9dc5135a-5280-4f39-abf2-49bdb7c8b798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106391, "uuid": "89bbd573-7773-44fa-94a1-fb950c8f0306", "value": "BootstrapperNew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0de82bc-2567-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1774126243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126243, "uuid": "3972ce7e-fc2d-4faa-94da-e44c8c4518e9", "comment": "Malware payload (SpyNote)", "value": "f6e5b0295cd87069e7c519cb28f9d495", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126243, "uuid": "a54459a9-6e5d-4993-99fa-52a76f5b891a", "comment": "Malware payload (SpyNote)", "value": "814cd115a30c5b4bfbb276524774a3ad2396e7f346c9f083983131b3e08200d2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126243, "uuid": "6636303d-22be-4d1d-8233-4c31f7b022dc", "comment": "Malware payload (SpyNote)", "value": "93a4f600802a7ebbdb3942d5dece330647ee4bd0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126243, "uuid": "f298f34e-634a-408d-9d8a-7f057e645809", "comment": "Malware payload (SpyNote)", "value": "c281b0872bd2e0a34b860526cb18970a94d46d2fc47faed8f1f3b30976b180d23d5eed098b131bf0810eecd766330e0a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126243, "uuid": "05b937ae-6e9f-4458-b869-26af262c3a2c", "value": "T14EF48C86F70AB863C9F7C7368275866AC9160D654B53E3871985723C1DBBBC08B85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126243, "uuid": "889afc51-7c08-492e-a9fe-96393e915f75", "value": "12288:iYJ6sgRMLzXHGrfgVKR9ubWZlxi2odwvi/RwncvOXyX:9J6s9LzXHGrYVKR9ubsPgw6ucvOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774126243, "uuid": "f1f1590c-3118-4336-86fa-07025873896e", "value": 782638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774126243, "uuid": "0993202d-97a4-49fa-821c-665e579e7094", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126243, "uuid": "da5a330e-1aae-4540-8224-3ebbe6ade11e", "value": "Zenin.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27701a3-2507-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774085148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085148, "uuid": "c362c962-fcd8-4f5d-b41d-68a7819f7082", "comment": "Malware payload (RemcosRAT)", "value": "d76f59c13a372ca84e911832990bc523", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085148, "uuid": "18b82c5d-4f8b-409f-841b-950642ef36ed", "comment": "Malware payload (RemcosRAT)", "value": "82ad4935906066cb036d76c6a97d240da7db4922118607da5aebf6de59df3aa6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085148, "uuid": "faaebcb6-9c56-4c0b-a6c9-1e75d27286f3", "comment": "Malware payload (RemcosRAT)", "value": "e88ab16404e82cd157c9c243f1e63cf42b590319", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085148, "uuid": "f23b0344-caf5-4a3e-982f-f44105ee158d", "comment": "Malware payload (RemcosRAT)", "value": "1f36f910739ace66e0569531a591e1a0c4dfd44d1c9c6cfe265e920f74429f31ecb21e8a20d1f2d200bb703d8262d573", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085148, "uuid": "7b2d3ce2-a902-4c1d-bdab-b4caea5223bd", "value": "T1D6C5338EAE839F8AC2D2545F1DCA4A6E39B453BFA6020747503AF8E79DF0043F459356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085148, "uuid": "38e8be16-9039-4704-a230-e43fbd936383", "value": "49152:w2VupEbUCf/8/MFmrsknwlC0m6JEgruivolMAbAFSAXtuLemb+c/hgbbEM:w2VWEbBJorsnjTrutqAscNJObh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085148, "uuid": "1157f19a-84cf-4c92-ba81-bafdecd5f42e", "value": 2688695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085148, "uuid": "12e4744b-1aae-4e71-b975-a37ae69c53a5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085148, "uuid": "f2deee8c-8c6a-4f46-9867-32ba24b3b7d1", "value": "32c91fa59dce3485c44bc97704bdb0448ab2f3aa49f550170ed0511680ea79f5.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd0155e-2511-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1774089090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089090, "uuid": "ad91e97c-9535-4820-b42f-89ffd6b8e75e", "comment": "Malware payload (Loda)", "value": "5ac9d7a907794189370881512a0a5807", "object_relation": "md5", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089090, "uuid": "5f85b0f4-03dd-489f-a7c3-6d51765e3c7a", "comment": "Malware payload (Loda)", "value": "855635fad9f8a232885fb9be704e4a10fd3a24a498b934ce12f9a90b43fad4ff", "object_relation": "sha256", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089090, "uuid": "fd674e11-bec6-4bfd-9123-483fbfe2834a", "comment": "Malware payload (Loda)", "value": "0c8925828c864623d3d2201abc89aaad7bb81921", "object_relation": "sha1", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089090, "uuid": "c379cabb-c4c4-4c25-9022-9125ccb774b1", "comment": "Malware payload (Loda)", "value": "8c7671008a4ca33743fa23b0d1d4a20202ee7f150953dc48cb3447ac43aa47985453e425c963fe538886294bddbd396a", "object_relation": "sha3-384", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089090, "uuid": "9d62528e-d470-49be-ae4e-5586e1ece486", "value": "T111A512A27CD3CB07CA9686B8886A5EF4567EDD440F2456247301B72DFD368760B93F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089090, "uuid": "4444e64d-646b-459c-b412-51da1ebc4264", "value": "49152:9Ygt2TKyQO+VR15iG7bpiXbhntC0Ehnkekz:XJlB79Sb60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089090, "uuid": "dd10ef06-e379-4ec9-ab6b-860cd8950ea8", "value": 2152960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089090, "uuid": "5cd8a1a3-c000-4ec8-a244-970fe7c43a52", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089090, "uuid": "3bcd9a04-bbe9-444c-8f36-41161aff8aa4", "value": "5ac9d7a907794189370881512a0a5807.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffef5fd-24ec-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774073467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774073467, "uuid": "490f0f6f-fb9c-46d6-8304-c785f8cd6e1a", "comment": "Malware payload (ConnectWise)", "value": "f7cbbd02bdd87e955ea87af352656dbf", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774073467, "uuid": "a5f36204-a106-4872-8637-6d79b9a145d0", "comment": "Malware payload (ConnectWise)", "value": "8693092fdf1af07ccab47819f5d7f3b8a7662720a3d81a8342b70dcc89059410", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774073467, "uuid": "7f4982ab-da72-4713-b0fd-1a3730765cb8", "comment": "Malware payload (ConnectWise)", "value": "9b839898659489b343de5852cccf72269b86e06a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774073467, "uuid": "acb6c28c-1cf7-4166-9baf-4f6f9eed15ea", "comment": "Malware payload (ConnectWise)", "value": "690cb33c231b9623a0a43c26d564f934b131416f56e40dd7abef7719beb91abad40803073757a00121d2b9f802a71296", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774073467, "uuid": "eb53d6cb-5115-4a74-aa37-fc3814ab6be3", "value": "T1A7C61201B3DA4979D5BF0A78E47A81689B35BC049B12C7AF53947D6D2D32BC089323B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774073467, "uuid": "d5ccfda0-2d0c-468c-b028-612a8cc932e2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774073467, "uuid": "ce0f70c8-e822-4119-b8df-9f523c980a76", "value": "98304:oRDRs6efPwvvvpiTBNxNBWHoGS0h72769piTBNxNBWHbpiTBNxNBWHhpiTBNxNB2:oRdfefPwv3K5NqyoK5sK5GK5WK5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774073467, "uuid": "eafb3091-b1f8-4ecc-b39b-9c33d5ee8bbd", "value": 11751080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774073467, "uuid": "764db56d-eba6-4b49-be48-5715d4986c41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774073467, "uuid": "2584f230-602c-4350-9aeb-67b7a6ab72f3", "value": "ScreenConnect.ClientSetup (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec7ab3c-2518-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774092068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092068, "uuid": "639e6acf-734b-4095-b38f-2a9163a27da1", "comment": "Malware payload", "value": "d1ac9cf3b167ad633cd0d7ef77562111", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092068, "uuid": "eac77562-5e5a-4fee-ac6d-61e774e93bcd", "comment": "Malware payload", "value": "86b432c844e60e3dcf11f037b166919b932a2af79422f7172727775cf4985d1f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092068, "uuid": "744cf8d9-bdbf-4643-a7d4-c7474d340b48", "comment": "Malware payload", "value": "dd76543cea648099b4d26685daf0f91103863d50", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092068, "uuid": "d3b4b04f-33a6-4e4b-9b9c-c12ea09c4996", "comment": "Malware payload", "value": "f884d77aacffef4278450c16a70ff33820ce8ba3b78bcb289bcbcf147c0a3326aed764b01ea23449ada20883c1fa708b", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092068, "uuid": "008e6747-680a-4413-805f-8dfdc0049175", "value": "T13072D1025C6357A3CB0B05F0E839C162523EF92D7D5DBA09543E6368B534EA1D2973C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092068, "uuid": "4dc71d3d-af9f-4c1c-8126-43c97f88e3d1", "value": "384:Oh/xB/bEIpjMQ9u1RCOVf9plcCt+EbY8pNkfUE5QFIEULSc4ypQJV:sZJYUHK9s8pNkfU2QCEULSc4hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092068, "uuid": "af958cb9-1596-4341-a14f-05818aa0171d", "value": 17129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092068, "uuid": "bfde77db-df3c-41d4-81d4-6f0532dfe6bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092068, "uuid": "07ff1be2-f84d-4390-b2fe-fc7bc0bc449d", "value": "photo-680157746.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c83ec13-256e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774129081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129081, "uuid": "ce7c05ae-89a9-47d2-8bca-d85273f0790d", "comment": "Malware payload", "value": "d982dc817991c5b655f37221781b1450", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129081, "uuid": "1f2ac051-0080-403e-816a-bcc94ea67e7f", "comment": "Malware payload", "value": "879534cf1ae4c7e159ec35c4880f67d91eec5b0dbd62d45e325eedcac2393658", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129081, "uuid": "9f8ceade-5ac4-49fa-bfe7-694211da8d9a", "comment": "Malware payload", "value": "72bd1b6a90548e67623f3172ea87d3883a34b15c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129081, "uuid": "1d964b19-c17f-432c-aba3-d25e4e5c88ee", "comment": "Malware payload", "value": "38ed8d61b105ec1b3afbdc00f66a75d1a8468d2d88fb54b2e024411b3c736e24a79fa1f7096e44c292811974fdc453c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129081, "uuid": "35d22bcf-f75a-4570-8758-8e56bdc38445", "value": "T13C14D719AB510FBBDC6FDE3702EA070539CCA51722A43B3A3674D528F54A54F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129081, "uuid": "20201078-93c0-4f59-ac0b-0107afbf0e6b", "value": "3072:ENhfQgkNIimubzfeKgRmllVP0Nd1bewT/:ENhfQ1NI4vfe4TEd1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774129081, "uuid": "cb302cf5-c719-4906-aa24-4f3d56d7b216", "value": 203464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774129081, "uuid": "cc625e97-b337-4fb7-b0bb-c7953a85ba19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129081, "uuid": "f251c5e9-c273-4f8f-8557-57a0c98dc2ca", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f146592d-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054223, "uuid": "2ab2a58a-e59c-4b01-849f-6d9d5d36b94e", "comment": "Malware payload (PEASS-NG)", "value": "4608be8b83ad65b6f1052220716f8ee4", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054223, "uuid": "1fc18c65-c49d-42fe-8e76-49c64a6b86ee", "comment": "Malware payload (PEASS-NG)", "value": "88316009a12024f2bad2ebae81947c224fcc90179c98a8d4807d834d853149e2", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054223, "uuid": "d4b63cff-4d3b-4465-9eb6-05395287c3f6", "comment": "Malware payload (PEASS-NG)", "value": "b1f99bb3cb5680b7fff63e0223b910c8f661e323", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054223, "uuid": "82b945f2-52fd-4cb1-aa05-a4007972cb24", "comment": "Malware payload (PEASS-NG)", "value": "515ef9b83981bcb9c9a3168a03b49abb76221421eb2af1fc554942791fe680c4c7cb1d3bf3cb31e75d83ae3b5f34919e", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054223, "uuid": "587be72a-d4d5-4f0a-9fdc-b7bead7db49c", "value": "T152A6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054223, "uuid": "08eef0b3-7f9e-4715-9d88-3e749c922827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054223, "uuid": "3b680d54-fc07-4d15-9b8f-0f94b26803dc", "value": "196608:JPxdtVBFUcwti7TQlyVN8iNISRTRmW5Q/:VZHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054223, "uuid": "163083f7-431a-4c8f-9f92-912de9ae1c12", "value": 10171904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054223, "uuid": "97d6d3cf-051e-4188-8519-fbe350db62f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054223, "uuid": "fde27887-6960-456f-baa6-1e12cb5d5276", "value": "winPEASany.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c3ec0c-253f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774109092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109092, "uuid": "1a6333c8-a921-4089-8275-7dd59edf18aa", "comment": "Malware payload (SalatStealer)", "value": "07924e93ad71d67ed9da528b2bd94c57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109092, "uuid": "907aaab5-8527-4f11-ad9e-fdccaa590d87", "comment": "Malware payload (SalatStealer)", "value": "88c1c143c1a66cb69e2c47fe89d17cc147fcdcfa06a8c481886a6abf4d86426f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109092, "uuid": "18228fb2-9755-4fdb-a586-bd993a61d38d", "comment": "Malware payload (SalatStealer)", "value": "14b2f6128b71e655fd220f918807da9cb3fedfe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774109092, "uuid": "2e63de31-e8e4-4052-970f-66c9985b86fa", "comment": "Malware payload (SalatStealer)", "value": "93e923754f368544cdf9f16a295f6a41bfb9e01184e47b51711783dd88aa59fdb5661f7cf8730cb7308bf7b6bfe57e1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109092, "uuid": "b431596a-d771-4641-a413-7c9df1f4dea6", "value": "T1A967331344C851EDC0C25630895E03AE32E0A67A8A7E5D1B3ECB7D027D66EF7258E776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109092, "uuid": "0f0377d3-7cf3-4fb0-92bf-017f621eaf2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109092, "uuid": "468f0bf8-7ed4-480e-87d0-ec7d9edd575d", "value": "786432:Ei+0pX76n7oLmlP6MM2EtjudJFD9OzMSKhI57:pDpX7fLmliMM2E5ud5SMSKc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774109092, "uuid": "a5d932b2-b6e6-414a-9325-0773b8e2109b", "value": 31799906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774109092, "uuid": "62e39833-58e9-4cb6-868e-ec2139599911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774109092, "uuid": "34fbe6cb-16c8-46a8-9a56-b8d4b8548511", "value": "2A3C5A03BD9A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f679e58-2570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774129945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129945, "uuid": "56ec7b8c-8dca-4962-88c5-20acae3ac5e7", "comment": "Malware payload (Mirai)", "value": "553de0ea408e2b4f5ea1fe4313100920", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129945, "uuid": "89cad2c7-f8d0-4ee0-ae75-311706ee8ed0", "comment": "Malware payload (Mirai)", "value": "8987183a0b6dfcf38e2912be81991dc6ae8fdc108309e1b1e1802e7f070378bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129945, "uuid": "dc348a4d-9f2b-4e17-b1a6-76ea54c8fbf3", "comment": "Malware payload (Mirai)", "value": "bc559476cb8e966e8019b519a2b2af0c19aa948e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129945, "uuid": "226c9ca4-a475-44da-8711-ad193b808087", "comment": "Malware payload (Mirai)", "value": "d4108bbe057c381d9a015766d7690a6e2fb368d20de2180dcebb20037cd64961db9604df49b6a15ec88b2d0a8b6b3933", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129945, "uuid": "71702dc3-e2fd-452b-92b2-f6c0cf067009", "value": "T1D5E47D9DFE4E3C42E2D7E27C9E4D87E1722771E4D32391A23982434CD5CA9E9CBA1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129945, "uuid": "29150e10-2349-41be-b166-a1a07f0aeff7", "value": "12288:DnoJsCu9Bw++wGtnMSSi/1VOu+4hpfwOewzTi7dxjPm5uW7w5dWMSYSe:cKBKwGtl4u+4hpoOem+ODFTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774129945, "uuid": "47dbcd14-0072-4bf9-a7ee-c0ff528a774f", "value": 705808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774129945, "uuid": "6a1f49e9-58d2-4dc1-8e29-e409e6b78da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129945, "uuid": "458fc3d4-71db-4058-8e0d-9e420e4a1ca7", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a760bed7-255b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774121100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121100, "uuid": "855743b4-7c80-4495-a1c8-d17d9667138c", "comment": "Malware payload", "value": "346dc6d26dc431a1538e785b9b9bafe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121100, "uuid": "a56209ff-4997-4678-9cce-ce0ad42fea33", "comment": "Malware payload", "value": "8b251d3db2a5b963ba447b51ec2c67b2ffb3c908ea77d24fc2cea89cdbf35000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121100, "uuid": "f6f267b3-25a2-4e03-b514-eb81c528a8fc", "comment": "Malware payload", "value": "d66782443d494839a5d7dd08ab356b4f8fdf7d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121100, "uuid": "78573da8-ef6c-42bf-99c3-3fb361b97bfd", "comment": "Malware payload", "value": "efb03323c92a19accc8f8a9dd51f2ed832528061fc83d8530bb58b136e2889c0ea8b2d52fce56da08e5d69971557da71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121100, "uuid": "2558c322-e7dd-424f-815e-63ce92c94a84", "value": "T13E657E47B3B800E8D457C279C5165B17E7B2B40113749BEF56A0CA6A2F23EE21B7E364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121100, "uuid": "fed6d624-14aa-47e0-b48a-180a315618c6", "value": "9247bf9f8e58f8310005b9f84b0b2ad7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121100, "uuid": "e7c36543-d639-436d-9768-c7cd624a34a2", "value": "24576:bhSMC9asBJANwy/3qTTD11Kjz0A2w7IWn2dRRmUuNnfww2Aq:faL8wy/3qh1Kv0C7qlmUuNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774121100, "uuid": "6ba25548-d47b-420d-bf9a-02aee90c657c", "value": 1456640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774121100, "uuid": "db773a67-35ff-4c04-8c82-c7429c11a568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121100, "uuid": "2490de39-bc39-4328-9e15-66daf48983c2", "value": "WinCloudSync.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b09145f-24c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774058185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774058185, "uuid": "38260e7a-ed0b-4952-b507-289beacffb85", "comment": "Malware payload", "value": "8942262b461b29edc81925bc723fea20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774058185, "uuid": "1d98a831-57fb-444b-9dc5-0a04c29fd60d", "comment": "Malware payload", "value": "8f6015c8cedda99de6ee8e11ac39ce4ada2dbb722f6ed3349a95c5d2c05a7944", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774058185, "uuid": "30f1e011-49da-404c-b835-49422a1e5c1c", "comment": "Malware payload", "value": "5abd6c2cd12e6f61525cacdd8ea583cb9dba3fa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774058185, "uuid": "e1b40dde-3b8f-4af6-9500-5ec277f60c32", "comment": "Malware payload", "value": "d810f879faa3454756e4e37ba7ab20250f8342468c9cb29fc9991bd668de1a916d7c458dee09ec115cff89b1d1e246e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774058185, "uuid": "bb3ba0c7-0666-42f4-ac08-5acbb2b62d67", "value": "T1C685334339BE0F80B924DD3629C686FD964447BB208CD65FC6F4A32BDF8E4D64A25931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774058185, "uuid": "a7366497-7a58-45f3-9d10-ae70cd9130bc", "value": "24576:MLKN2Qctv4/zQIxbkFRCu3DvDd92kgbUpSKBY+3dgEdfSAfR+3iwZggple1nMcE5:bNh744uzDKkTSWY+dvSAf2hJfeVMbbUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774058185, "uuid": "0355fb7e-4e5c-4480-9d66-8dcd7a7b62aa", "value": 1708032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774058185, "uuid": "db183ad8-2c9c-4b3d-b321-cc5872d4dbfb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774058185, "uuid": "f3c58645-38d7-453b-96ef-70967e6e96c0", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f6a5d0-2567-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774126168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126168, "uuid": "644a47e2-b755-477b-b5b9-71a4d63f15f7", "comment": "Malware payload", "value": "757fb63ae3a13393bf90f06185f1be6c", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126168, "uuid": "372cfae8-c1e1-4dcf-b074-e5960876676f", "comment": "Malware payload", "value": "8fd9985e68144b33d6eaac664c02decf24120356c724285ea2f65b26cacb454f", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126168, "uuid": "22a5dd00-8aba-47c5-82a1-f6f889eeb726", "comment": "Malware payload", "value": "2a508cdcb672e81223bdc5eaebc83631e837572b", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126168, "uuid": "4daec5ed-ce6f-4be9-833f-d21adb97ec02", "comment": "Malware payload", "value": "7689206c419b201c49d711c582f153d18890f320562b155da44f63a70888fdea3751c7dce73ba0e4356025ae60d017b0", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126168, "uuid": "e138f887-4e3f-44e3-b820-0c0d3bf5a25f", "value": "T183B3DD98498EC8648B1F70A8060F5E478BCDE5570A2DD484BADEBF463F139F871A95E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126168, "uuid": "a0c23604-2f71-40c4-8f2c-86bf076f71e5", "value": "1536:PJ3rpaFwyCWoc0HxDRr8ItmrZv3inK3oKCKJ:zWoxHxDRr8ItmrZv3inK3oKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774126168, "uuid": "a5f4aea7-4614-4cc0-95c3-39567d9f994a", "value": 114240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774126168, "uuid": "9d43eda7-d259-443b-a9ac-4c8257e33de2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126168, "uuid": "6784a6d1-2491-417d-b3ee-98acd2dd3381", "value": "Build_Tokyo__96.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679b631f-253c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774107679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107679, "uuid": "2984c42c-e85d-49b4-a626-f8cac170003d", "comment": "Malware payload", "value": "bfb4749a87d28d924c32fccbaeab3093", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107679, "uuid": "4bbfa24e-b99e-408d-9081-508225ee8fb2", "comment": "Malware payload", "value": "8fe03f304e765f1172b0ee497b16567e5baa90cca5b15fbb8b31bfd233d4dfdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107679, "uuid": "85203c36-fe98-46de-b299-45ea98eeef29", "comment": "Malware payload", "value": "3bf1a9b2e6bdb4a963425752c0b110fb5bc2c1fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107679, "uuid": "af71ab92-f230-4f31-9f24-adcfbf89d19c", "comment": "Malware payload", "value": "28723615456969d938da3db891dfd36bc0b6c6c46e027dddca06c6d6688f020d144369a17b4e9789d1bb4e46ffb73a57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107679, "uuid": "4f494756-b072-48aa-bc8a-b8dfa316d4b1", "value": "T175B3975E2E228F6EF668873447B78A35976C33DA2AE1D644D59CC1041F2028E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107679, "uuid": "521f53a0-1f38-4751-af08-cb6d433d6f03", "value": "1536:DblBjVqrIb/P5QW6lDoN/NdFAcFy2V7kVL7Eqceer:fl+quvEVTAcFvV7kVnEtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774107679, "uuid": "9660e8fb-f2fd-400b-ab2a-c1a4027b6fbe", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774107679, "uuid": "cb9f75fc-b76c-4b85-b5bf-6a8a12a4cb22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107679, "uuid": "c2224c0d-5dda-4900-a3ff-7edafb2713ce", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b94dfa8-2571-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774130502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130502, "uuid": "77c81fe4-0014-41ca-90e2-e77e21f3e213", "comment": "Malware payload (Mirai)", "value": "1447987257ff7f27610d2e5d704cda82", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130502, "uuid": "a06bf9ec-2c64-4f77-9dcb-521bdc30308a", "comment": "Malware payload (Mirai)", "value": "9226e3a274bf29a99d67fcb029fa8f54be16d2fbef99be51ff4a9bfb7e75ed9c", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130502, "uuid": "e206693d-d742-46c2-8c02-e0a52cefe679", "comment": "Malware payload (Mirai)", "value": "56375f3ea84aed773c45230649746426c027cbc4", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130502, "uuid": "0fca706b-57e5-40e1-8785-c983adaf9d79", "comment": "Malware payload (Mirai)", "value": "a92955594b563da30962c55b6d288dd1f4c1406559171ba96100e559544e6ad28cd25b58d3c67277a8c819e5ec1fd19f", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774130502, "uuid": "86c66ce7-2ad7-4925-974e-978a04c4e3ba", "value": "T1C6C32802B71D0F43D1632CF02B7B1BE1879AFE9118B4F584A11EBEC99274DB62146ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774130502, "uuid": "93dad750-9332-4ada-97a2-15e0deabaa64", "value": "1536:3AyhZYUyGfnV+SffIAW2dPAAa7BO7XAIKolInfRk0pxNfDVKToU6/2zoo08pfnT+:3AuGUlZwcFQIhAS0ZDV0oQMa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774130502, "uuid": "e7b8ec23-326d-490c-a016-726419f6c629", "value": 121340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774130502, "uuid": "e7e9bfc5-02e2-4a67-88d3-cccedfdd153f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774130502, "uuid": "69c759ec-de32-45bd-8382-7192dee6d31e", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a7de9f-2526-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774098260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774098260, "uuid": "2c9e6730-af23-4a98-92d2-214238269377", "comment": "Malware payload", "value": "d4d557ce6947342203380d3e2a8f8610", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774098260, "uuid": "7f9a131f-7f18-4e30-9953-59dfc5f46b5a", "comment": "Malware payload", "value": "92dd67a673bcd7bc0b5bf9a9015fafc158a33d1dba66f0bb09bda80128574ccd", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774098260, "uuid": "5be9af7f-a7d5-4188-8004-afef4e9fd23d", "comment": "Malware payload", "value": "f9e3e0c3fa9369557d3f2eaadd8102d6892b0a30", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774098260, "uuid": "923577a1-5d0f-4060-84d0-a419a9a4affa", "comment": "Malware payload", "value": "d0bf9c2da8bb15398d59c3961661fd83d427d22477b52d9501887fff729b693e3497fc7df5ea234b1871880178d2397d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "scan-aquasecurtiy-org", "colour": "#9E7B5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774098260, "uuid": "91558372-40e2-476c-b751-b420118057f3", "value": "T15757333E98CD78005540D2E8D84267A52B935F25BAFEF2B5304D063FBF6CAD7CA9A051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774098260, "uuid": "dee26aa2-d04d-407a-8774-7bd8b82d27ef", "value": "786432:76C3Op/ZCtQHnFgB5dP3izCwDk+S9o5ewIJEv5:7vo/Zs0neJaCmlEwIqv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774098260, "uuid": "cc39ab79-dd62-4093-9342-13280ff96f70", "value": 28296650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774098260, "uuid": "711b7b69-f564-403b-a244-1131626223a1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774098260, "uuid": "94651b96-e342-4d57-b4eb-c178bf2f2bf4", "value": "f7084b0229dce605ccc5506b14acd4d954a496da4b6134a294844ca8d601970d.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3f2fb6-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054134, "uuid": "1561ef24-bec5-478b-bf77-71c55a49ee3f", "comment": "Malware payload (PEASS-NG)", "value": "d6423766cea46f10c47cb133cc6a8bf9", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054134, "uuid": "d97a3218-bad8-4e88-ab76-ebb6201708d5", "comment": "Malware payload (PEASS-NG)", "value": "932457d3eedfaedb7f2a2ccdcbacb9a15c5833fd72737ff31dfb015b3b20b15e", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054134, "uuid": "918ebc14-182e-46b0-b7c2-4c1d285c474d", "comment": "Malware payload (PEASS-NG)", "value": "03ce09904057a63f117df8668ac8565bd20fc6bd", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054134, "uuid": "0dea23c3-1010-468e-be11-f05f84c2be73", "comment": "Malware payload (PEASS-NG)", "value": "121330e6dbf09163e39511f3e854abee52dd1731063a6906e97c185456f5b4b2168e4e2e7b89780994b032353d312717", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054134, "uuid": "ebb2568b-e8e6-456e-b4c7-928684fba36f", "value": "T121A6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054134, "uuid": "816df012-be3a-4d56-bd7a-6f0aa26d934e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054134, "uuid": "db8e92da-4789-4073-b714-3141554058b2", "value": "196608:JPxdtVBFUcwti7TQlyVN8iNISRTRmW5Q/:VZHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054134, "uuid": "d07ca872-c816-4a2f-84d7-decc72e2a1b2", "value": 10171904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054134, "uuid": "57cf942b-eda6-4057-a812-b0637ed84804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054134, "uuid": "f4c6aa4d-dd31-493d-be58-f2ebb09234a4", "value": "winPEASx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4b4d6a-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057414, "uuid": "81021660-0aa0-404d-b5bd-540c879036a2", "comment": "Malware payload (PEASS-NG)", "value": "02ecc927d169d3cdf40b8337fa03e4eb", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057414, "uuid": "0a18a6d3-7846-4348-b339-da741cc9ce39", "comment": "Malware payload (PEASS-NG)", "value": "93a2fe494017319e1b6ecd78a28db3d349f762e71e59a1a81bae5aea361f358b", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057414, "uuid": "1efbfe2f-bdc7-467f-8093-30a5dea374d0", "comment": "Malware payload (PEASS-NG)", "value": "168aa20a3689f3d44f78e33cc6c6c4be42c9220d", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057414, "uuid": "cbf8ba98-56ae-462d-b232-265a3c4b4975", "comment": "Malware payload (PEASS-NG)", "value": "7eb753d3c2a5ea540ed418d42f07a99c1253fa1b2b0653ae7d7139d658380bc6d4c7ebcfa8670330e92394a75a714f5b", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057414, "uuid": "b587fc44-ef67-40c9-8582-f2dfe31ee56f", "value": "T18BA6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057414, "uuid": "ea242098-d7e2-4ac2-9feb-e2d3ff03c434", "value": "196608:BPxdtVBFUcwti7TQlyVN8iNISRTRmW5QD:NZHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057414, "uuid": "9df0a1c8-bed2-4b84-97db-6bce559ad2dc", "value": 10170880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057414, "uuid": "b6b8e165-594a-42fb-a04f-2b6e44ae2205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057414, "uuid": "a6e0c92b-507f-41f4-8e19-a2530542d0a6", "value": "winPEASx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bb4426-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057324, "uuid": "2181ac4b-06d5-460a-a6e9-dcb04b2d909b", "comment": "Malware payload (PEASS-NG)", "value": "456837c7fbcff1cd705d99a9df32015a", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057324, "uuid": "939cb3cc-f4ed-4e56-b7dc-e6a658b17ef7", "comment": "Malware payload (PEASS-NG)", "value": "947eced255f6ae5d2db806b7eb9fe8829a6abf36531c618766874f00ab5892d2", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057324, "uuid": "135bf71c-cee5-46f6-b0e3-a5b02613dfaa", "comment": "Malware payload (PEASS-NG)", "value": "6e347b1377d3c8568a56cf101f75974d5a5e5636", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057324, "uuid": "07003a7c-4469-447c-910f-05c92faabbe5", "comment": "Malware payload (PEASS-NG)", "value": "cf89988ceaf8985eaf8353e3ba2af0190f18d3324df0cf5f516ad3eb29c71793cc8d6b8367154798ae1f7374aecd7b40", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057324, "uuid": "a5048170-a73c-4f29-89c2-acc164b560b2", "value": "T1D5B6D044A2D90929D5AF4E3D806212335739760A53DA8BCBFBCC82980F57FE6C776316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057324, "uuid": "6cd2f90e-655c-4cbd-be9c-e3e268a9c9ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057324, "uuid": "812e84f9-94b1-4ed8-ac8e-3ba9f48c390b", "value": "196608:3vyxUb9VBFUcwti7TQlyVN8iNISRTRmW5QN:acJHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057324, "uuid": "3ecbde08-b1b7-4e4b-8497-e3b4b9a8f617", "value": 11116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057324, "uuid": "a2403736-0bc3-4c80-b9a3-87448426d0c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057324, "uuid": "60feee92-d0f6-4642-93de-d90c115a56b5", "value": "winPEASany.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6ecb8d-2510-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774089007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089007, "uuid": "5b0739a3-d978-4d27-ab90-244d60fcf22a", "comment": "Malware payload", "value": "088ad6e10dace3937dbb0252681b9972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089007, "uuid": "26da0136-83e0-4748-ad05-3597f2dbc21a", "comment": "Malware payload", "value": "94cf77f61f8cd0a19c621418cdce59211c22e7f252c91611b1d7e21fcaad40c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089007, "uuid": "915db78a-2316-475b-9895-ade0d996a940", "comment": "Malware payload", "value": "531b8e383520d5783cb262e879790a8609ec24d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089007, "uuid": "57698e3a-7351-43b8-89d9-a375468f5f59", "comment": "Malware payload", "value": "c9d9801727be399006e29316e9222bbf237cfd9b584fccb39475d139dd037fcc8daa44f2ce23570a767479107f8c7988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089007, "uuid": "ec7a5251-df01-4e61-91db-16b6cb5c916d", "value": "T187D48D7776578E20C28A4373C1D74942D3F8978676A7F70E714123DA140A3EEEA1A2E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089007, "uuid": "d2fa6739-a722-47d6-b931-af7ae4289902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089007, "uuid": "f39dd90e-2c20-48fb-b978-2d41f191a695", "value": "12288:PksmhDZy4mkAR2gtHFZYXyo51XbgKjTcP1G1cPieDhRQ:gJs1My8MKjIPacPies", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089007, "uuid": "7842ca33-b298-480d-b5fd-aa43063c4b9f", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089007, "uuid": "9a963a92-9a99-473e-b89e-11c79a878e8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089007, "uuid": "18e733b9-f5d5-4168-990d-86479e695fbe", "value": "088ad6e10dace3937dbb0252681b9972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd3d93e-2512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774089890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089890, "uuid": "a7d485f5-adae-4ab7-9e57-9b47fec256a0", "comment": "Malware payload", "value": "a41a79429465128cb5ffaeb83d29368f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089890, "uuid": "aa0900f4-21ab-48d4-b2c7-20fd65df6bf5", "comment": "Malware payload", "value": "971a8904159ff7e9a092c73bd428d39cf2b0779ea056651f1ea7e8182ef30e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089890, "uuid": "26b82e98-6d00-4cf3-8fee-ef0c25cbed68", "comment": "Malware payload", "value": "d447ff8158b4e3e8d367878f562f537e2d7df29f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089890, "uuid": "6ab3b08f-5a60-41a3-b130-3d85f731245b", "comment": "Malware payload", "value": "d404488f5a51547f712cbc8a430468c3bdc132ff3cd3cb6470d3db03f1eedb44132ec7886bcf8a9ecf57f642eee4099e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089890, "uuid": "5172f48e-8cf9-4778-b659-8c9c070a3dde", "value": "T1ACF6AE02B3FC01A9E5BFC278C5624517EBB2B8551321E7DF15909AA92F33BD05E39362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089890, "uuid": "99dcd905-a56a-4938-a46c-aabc3c5ac73f", "value": "759a3c183e9207f0571ae8ae7b2a52e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089890, "uuid": "503be64c-e575-44e8-bede-00338bcbf641", "value": "196608:AWDqwpamFZxR4VsS3UbebqMTCj7/GV5rVTqcBxSeSiULGenNFz:Axw0MAs9PMTdPrVT3xSJiULGSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089890, "uuid": "568b1161-01d8-4696-bbe7-fc4403be1ddc", "value": 15450705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089890, "uuid": "801d2715-13b8-48e9-a143-a4ac4bf73708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089890, "uuid": "2b195952-36df-42f6-9530-d64cbcc5a578", "value": "a41a79429465128cb5ffaeb83d29368f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e7e2d0-256c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774128429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128429, "uuid": "0d8d4691-0cca-4284-b3c2-e1b0041f9df6", "comment": "Malware payload", "value": "170d91f279ad93a660ac6908689a4c14", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128429, "uuid": "78a692d9-aa91-41b6-9a6a-f5421ead463a", "comment": "Malware payload", "value": "97a903dd7e4325241c424037f5e3d47c5d73959495ad844a7ddacffc5ce0af6b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128429, "uuid": "17c62584-5389-4bb1-961f-125a9819eeae", "comment": "Malware payload", "value": "d88f60866228a3c0647a77f30a368db19c987518", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128429, "uuid": "af23a3e6-60ed-4181-9990-4a58fcfa48c9", "comment": "Malware payload", "value": "fb53437ce2de8ce7e44d1cfc379dbb94d956ac148cd97749aa3a03351a92611cca221ed6726e508e723a05bd46449ea7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128429, "uuid": "c3292cb6-2799-4db6-8f36-58d710ed07b4", "value": "T1CC925CB916496C79BBC0DE7D9F3C7F0CADE481C02218A39CBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128429, "uuid": "cfd44ec2-b4b8-4732-8589-69ec5120ccf0", "value": "384:8l0M3vgRjGlsaq7PzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:8dmjfTzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774128429, "uuid": "85e00a6d-3487-4465-9b22-9673eb98cae5", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774128429, "uuid": "98afc340-6f74-401d-9a95-2d8fcba0b0f5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128429, "uuid": "0dcc0c81-a704-4bdb-a9ce-8e6338edff37", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cda26b-24fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774079381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079381, "uuid": "f50f786e-44a0-43dd-a28a-18a2564de5b4", "comment": "Malware payload", "value": "c0c5289c250b938840977ef9938807d8", "object_relation": "md5", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079381, "uuid": "078a7e32-c8d8-4791-841f-c8e02d934405", "comment": "Malware payload", "value": "986a189954b6a7f4c61857cc861429c1d8d024dee42d81a45a3e086b02217fec", "object_relation": "sha256", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079381, "uuid": "74e2e8f4-4792-4366-aa1a-98e9ca75701d", "comment": "Malware payload", "value": "1154ae61a9b6f0e93f6173121d707380153c95f9", "object_relation": "sha1", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079381, "uuid": "71a60379-86e1-4826-b447-f2fd68edb6b8", "comment": "Malware payload", "value": "f80b422e60af72b647f5ee5abe7eb61c180f39ce59c9fcfff6a4daa535fa37a2608cfd50c246bfdb7084e7aa4ee21322", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079381, "uuid": "6d50c22f-9d0a-4eb6-a8b7-36e53ea00ab4", "value": "T123C0927863881F4F857642119C34D90689FC11AA43AE54DAB327720081102EE87A8268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079381, "uuid": "07d15e10-30c7-4367-8516-261d47e7cc87", "value": "3:VSJJFIShFeoAC1eZo7Z5n2Qj0OaXtIQwQVVSswN5jKVPOb0e:s8SDBn1ey7ZxT1cVaZrjLbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774079381, "uuid": "19922a7f-90d9-4b2f-bf18-654953c266fb", "value": 141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774079381, "uuid": "792c195b-acd0-414b-8f57-9f449538c590", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079381, "uuid": "8c1baa6f-b735-4d4b-9622-7a95f9a7cf8e", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f9beb9-24c0-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054262, "uuid": "f549f4e5-b519-4998-b984-0c52054f1bd0", "comment": "Malware payload (PEASS-NG)", "value": "11cbdf045aab4d645a6628f1a616d0de", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054262, "uuid": "c312842a-c803-4f5b-8e24-e14b2acb740c", "comment": "Malware payload (PEASS-NG)", "value": "9999540a29b95ff1cd7b59c446e6d697ea646a7cc95ec075e8546d5e36082329", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054262, "uuid": "6422616d-6a83-4637-9adb-c259708f94c7", "comment": "Malware payload (PEASS-NG)", "value": "e5e98f0c419f2b7c643cf06f448a6b6f0bd2ae9e", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054262, "uuid": "e2d761d1-f038-4ee0-834f-adcde4172088", "comment": "Malware payload (PEASS-NG)", "value": "ed4f53829db0bb070f90dc975c94d799a6c16f814fb280ada6e2c7d6006166f3f76f3ea8190ad263a2cb34a75122d06c", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054262, "uuid": "178abac5-c00c-47b1-8166-527fb1123bbd", "value": "T106A6EF02F3E401D6EABB527891B61612D672B42A4330ABCF338C94695F337D16E76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054262, "uuid": "23726f33-e80d-4d82-b8a7-e6bdbfcda67b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054262, "uuid": "4072bd11-4669-4963-bd94-adf74c5664d4", "value": "98304:x4KAANhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qr:xtNVBFUcwti7TQlyVN8iNISRTRmW5Qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054262, "uuid": "8a4e6ad2-69c4-40d3-8aaa-e748c850bce0", "value": 10026496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054262, "uuid": "b0cf5f0b-4961-4ca5-bcb6-05f272d75801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054262, "uuid": "4042ba03-1964-4e27-9d2e-298e0a014e6d", "value": "winPEASx86_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99fa56f-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054102, "uuid": "ff6b82de-d666-45c2-bdfc-63daf2474640", "comment": "Malware payload (PEASS-NG)", "value": "e640a2a45962631b01ac84691335b7f4", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054102, "uuid": "6f0305cc-ba98-484f-ad20-c22f366d8cfd", "comment": "Malware payload (PEASS-NG)", "value": "9ba875f142e171176a023a347352f121b312bca832251b0d725285a7c0242596", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054102, "uuid": "b692efb7-b645-490b-a2d5-bc630ddfa696", "comment": "Malware payload (PEASS-NG)", "value": "16c002f2b40166ce0abab29b0aa230cc89fd4ca0", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054102, "uuid": "eee7952c-ac79-4a29-80e8-748743f42385", "comment": "Malware payload (PEASS-NG)", "value": "861d9d06d610ec65f165273a7e64e3ad8e9a67e020378e9c18f1a2028d65bf7e23b50dd29b72a132989f05e0bf86fd2b", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054102, "uuid": "640890fe-3347-45ca-bf06-b79b346a8ef2", "value": "T191A6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054102, "uuid": "00ad26f3-cd65-4362-b660-aa7c0575dc2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054102, "uuid": "93bac7f3-cf0d-4d2f-b92f-0e21af802723", "value": "196608:JPxdtVBFUcwti7TQlyVN8iNISRTRmW5Q/:VZHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054102, "uuid": "2f2090f2-dcbc-4fdd-a6e9-600fcfa63a02", "value": 10171904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054102, "uuid": "9ad6b95a-32c0-4419-9300-e0c5053f4a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054102, "uuid": "b2c26750-7afc-415f-811d-775fd9dc1e12", "value": "winPEASany.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac5c3cc-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054238, "uuid": "97172075-ba87-44cb-8509-34ce1460889a", "comment": "Malware payload (PEASS-NG)", "value": "a5efd709753415a84520fb14cdac6fc8", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054238, "uuid": "624cb765-3673-4f3b-b891-19cdd319f32d", "comment": "Malware payload (PEASS-NG)", "value": "9d51fc2674f67edb37ea029977a9ac097f84c06007f8f40e9f556098ef1f5bf0", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054238, "uuid": "1fea1717-e949-449c-a7af-c01a5cfbdd6f", "comment": "Malware payload (PEASS-NG)", "value": "15468cd54332b306680d7171ea6d93f035aff34f", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054238, "uuid": "af1a77da-3500-422b-a839-a8e8b6b5c157", "comment": "Malware payload (PEASS-NG)", "value": "c995079f18bf504f25cf5ffc193b18803c54308c5eb4e720190009a093c96ccd677059bd710dd644c7d70b55b4a0608d", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054238, "uuid": "dd6c16e8-f9e1-498b-aecc-12d7c7a946b6", "value": "T10AA6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054238, "uuid": "fca04c90-950a-4a3a-b8af-9f4f750a3dd3", "value": "196608:BPxdtVBFUcwti7TQlyVN8iNISRTRmW5QD:NZHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054238, "uuid": "06d20859-490d-4b92-9102-2ab90e949142", "value": 10170880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054238, "uuid": "64e6bd65-b1cd-48a9-bb63-298bc210d42d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054238, "uuid": "4a899e9a-b90f-4cef-9ac5-04e10900e308", "value": "winPEASx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7faa58-2572-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774130823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130823, "uuid": "e3ce6df0-d6e1-4c13-aad2-c4df59a79403", "comment": "Malware payload", "value": "d9e42ab319a6057710230d2dc6182f7a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130823, "uuid": "9fba04a5-d3c9-4801-aa03-0a21eb976e74", "comment": "Malware payload", "value": "9e9ac6a52a0ff41795b3c1780d97517ccfd44c9f7a6e31677dc17e1737ca409e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130823, "uuid": "1d3da3af-c18f-4774-b6ff-7adeab2f3abc", "comment": "Malware payload", "value": "82cb4ba4c2ba9949a30dc60c0f45bd103f27d767", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130823, "uuid": "00c07cef-3bb6-45f0-9c49-e40457b2cdcf", "comment": "Malware payload", "value": "5e94c888dcd5badad68762a488223c0a7b7610958448e76dffbb30449c9ef3f3be751444c0388cfc537c82698537c58e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774130823, "uuid": "6f435247-512c-4f80-8cbb-cefa7229e518", "value": "T130925DB512896C79FBD0CE39AF3C7F4CADE8C2C42124A3ACBA0F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774130823, "uuid": "0e66808e-b5aa-4548-920c-325927e35995", "value": "384:PrFcuQpWx+BL0SWL0gPzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:zF8i+BL0SI0IzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774130823, "uuid": "514eb6d1-d2a9-41d3-9478-045c5128ddf6", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774130823, "uuid": "407cc2af-ba13-4370-8de9-7f077cf6a8b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774130823, "uuid": "1defe866-f018-4a50-bacc-bdc7f7254441", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fd6818-2529-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774099596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099596, "uuid": "b996ab35-c554-4102-885f-beaa7ce901a8", "comment": "Malware payload", "value": "1d0b27c8cd1f54970bebbbacfff6f8b0", "object_relation": "md5", "Tag": [ { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099596, "uuid": "18353b8c-6dea-48d1-afd1-47e402112f91", "comment": "Malware payload", "value": "a045c59a6a2b310b9dd7cd07cf16044a65dc736b3c514a4c4c5084a89684b80c", "object_relation": "sha256", "Tag": [ { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099596, "uuid": "c0a6bd19-a6ca-4399-8792-211617e60391", "comment": "Malware payload", "value": "2d0278d3b62eb21016a12508285c2651eb560263", "object_relation": "sha1", "Tag": [ { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099596, "uuid": "34081ced-bc02-4f96-a625-324cf1858038", "comment": "Malware payload", "value": "fef60807279e20634a93704653d5c3847591cf497f64011f7be196035bf44f0c57c1ab2fca4fa41639001e1c3446d8ad", "object_relation": "sha3-384", "Tag": [ { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099596, "uuid": "e909e4a5-3202-480c-91fe-71bd0b047148", "value": "T179F433C22027DCB588E054D3A4A6E6B5B7D436B14B460173B48C1E321BEFCD8D3EA5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099596, "uuid": "97033310-0299-4ff9-966c-7b606528ff22", "value": "12288:bbSbQxj7mbhVX7W4a96RG6pEKwJG/zHjgxx2QSyccTCEmY4bpTVqEOYS/+6CYzyH:bbSTb7Xa4R1+fEzHVQPcwCEEpTVqYJIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774099596, "uuid": "2c8670de-44e0-47cf-a9e9-447805fad242", "value": 768162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774099596, "uuid": "5c66ac4f-bac7-4156-ad47-f465ebe48b0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099596, "uuid": "63ddffa3-fac4-4f88-9af4-f8c6c707a913", "value": "new30h.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c613cee-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057301, "uuid": "d0629c95-8cfc-4508-a39c-8ad15f7a7696", "comment": "Malware payload (PEASS-NG)", "value": "08e7bbacdf9c2e37ad798660b288864c", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057301, "uuid": "67f44966-4eef-4ab4-b234-7f3cbddd5393", "comment": "Malware payload (PEASS-NG)", "value": "a0cb0407356787b9e7bbb6b466a7f077dd1fe647e5cec0cbc85ede372a76c249", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057301, "uuid": "9eb274a9-391d-4085-8ac3-31586b1fee27", "comment": "Malware payload (PEASS-NG)", "value": "2f527ac2e0a3d929553a994b3ea06971a0f281cc", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057301, "uuid": "aed195f1-3f12-4e34-8d4e-b836e70e9199", "comment": "Malware payload (PEASS-NG)", "value": "960bac0a7fc76d630a459e50170cbe404d4a338e0630108d5a1e05c6ed0071397c759a397562e575fd75a1abeb0d15f4", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057301, "uuid": "cb95dd4b-2c5d-43d6-94a5-25e4a30c06a4", "value": "T11B25FA5C640CEFB25025C97C1C950F7E19A3AF1F2665182870ECB61C7FDCCAE60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057301, "uuid": "c8aee374-8707-4528-89f6-985f7300b3c7", "value": "6144:hYcSrftrtHrtJrt3rt5rtlrtkrtDrgbrtXrgfrt/rtDrt7rxjrtJrgokOKPHpMsQ:jxlihTi+FQ3nNLztjYDqX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057301, "uuid": "e62ceb72-6fa9-4573-b736-ea5f93234a80", "value": 1023141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057301, "uuid": "d062e145-6789-4a73-aa05-4f8ec4a248c2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057301, "uuid": "2497cab6-de7a-42ae-ad81-0e0208ecd3f4", "value": "linpeas.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1487c8a1-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053852, "uuid": "a2cc6d96-2cd0-4cde-a968-e8efe10e9e02", "comment": "Malware payload (PEASS-NG)", "value": "896df59cf7e70194523d4d4ab33cd43c", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053852, "uuid": "02ecc8cb-6c05-4061-b94b-fcdb4901727c", "comment": "Malware payload (PEASS-NG)", "value": "a1621c554eb1057135657003fe6b6757b741c4f68ca492a00093eb6e31871ba0", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053852, "uuid": "2df1c930-064a-4a01-b8d0-b8d09b480d6f", "comment": "Malware payload (PEASS-NG)", "value": "4ffd1c1bf01113072ac6bd90c2cca4ea729c144d", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053852, "uuid": "536f7b0d-42c1-409f-a435-93d47a349033", "comment": "Malware payload (PEASS-NG)", "value": "b05e2711c203573b675e2b3e3e464e0dfa599ff88328783f834b2ec241f4b4eea384c48b94c862bd916657372ebc0507", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053852, "uuid": "86efdaff-78a3-4d56-8793-b9c935fb6690", "value": "T1FC06AF9ABD683900DA49263E5FED47C11B3DFF4B2F5287173904B7AE1EF22164AD1224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053852, "uuid": "ac966ffb-0b41-4fa4-b018-7ef4fd1d2d0e", "value": "98304:vLnntKKNdXKPns1AyeOO/NyTK8G/bu75RsxEBk4N7hvdYelTjYfdmo4ijDVIx+zp:b45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053852, "uuid": "219b54ee-148c-4d34-93e3-3a45444148dd", "value": 3877506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053852, "uuid": "bbe0cb00-ce66-41cf-801c-cbe84fc2a9c5", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053852, "uuid": "578864c5-3e31-4fa6-8b03-71c16fece993", "value": "linpeas_darwin_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325e587c-24d0-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1774061204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061204, "uuid": "448eff71-7873-4367-b6c5-a35fc0928b12", "comment": "Malware payload (CountLoader)", "value": "58cead12a7fee8adf88ed0abc21464b6", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061204, "uuid": "2a4ba49b-ace5-436e-922b-d12a362b51b9", "comment": "Malware payload (CountLoader)", "value": "a3688d896f3b237d49f5e0d9584a48ef63320ef38b3c7a14a3d257c1fd8deddc", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061204, "uuid": "2e681a84-187c-488d-9198-eb795267c453", "comment": "Malware payload (CountLoader)", "value": "944b5268476ea3679c4121888655e9d02877fc8a", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061204, "uuid": "1ad32533-ff84-4758-ab83-caa2a82a6b07", "comment": "Malware payload (CountLoader)", "value": "59cd75449970593018de0e5c29b89f625ed9a6d29a68b632ea109a3a01dafeaabe244a03433bdb7089b0f01a9e69f786", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061204, "uuid": "c66b35e3-27b5-4a39-9f32-4356e77593b9", "value": "T12CB332860A9E8075D37AF465869F9D03DAD9C60E260EC5427E8F9710AF2387CD2797F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061204, "uuid": "eafb74a3-b03e-4867-8f99-6ebdeaefac7d", "value": "3072:GWN5gVmpKtKmw7joXVrFL84XLKO/k+muVWhWhaXnCPQtwVr1HvIzYMbl9q6EMRv7:Ftrj3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774061204, "uuid": "fe9b6a55-8cdb-4dfe-807f-d5aaa2be9f2b", "value": 108055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774061204, "uuid": "eaa78462-e36a-4221-9daf-7968d85421c2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061204, "uuid": "4e654eda-541f-419f-9fe3-3cbec957a5d3", "value": "Client_Video_Updated_6090.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f2eac9-24c0-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054282, "uuid": "f73afe41-a42a-4c38-a76b-5d0e6fe6979c", "comment": "Malware payload (PEASS-NG)", "value": "d80e59602e4c825e603856a56956743d", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054282, "uuid": "c53acb97-7545-40a6-8746-648c601caf1a", "comment": "Malware payload (PEASS-NG)", "value": "a4904fb5c97b3b784b94adc86b2882ac18a87720783c48fda93db57cd7782a84", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054282, "uuid": "51d42284-bc3b-449e-ab6b-9093d66ff58d", "comment": "Malware payload (PEASS-NG)", "value": "5704044414bab8140fa02d671c9f90da565fea90", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054282, "uuid": "a248791b-c877-446a-b352-28eb49908935", "comment": "Malware payload (PEASS-NG)", "value": "e529402c528e46da0ae1f69069642c0ba6d112f3ef2f0cb3165cdf5618b1dbded0ab87b70fdc4469b7e0373ec2bbd76b", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054282, "uuid": "40214fc3-1339-45d1-acd2-90392cdda96a", "value": "T1D6251B5CB80CEFB25025C97C1C951E7919A77F0F2962181874ECB70C77EC8AE60F66A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054282, "uuid": "8ad0db39-7200-41e6-ae6f-f8d09dcd14b0", "value": "6144:ucDA8NLuTLu7LunLuRTujLUWLuDAuLLuLAuuLurLuzLu2Au9LUTAu1uVggHpIztL:XcPijGS3a+DgVu9DDTYvDnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054282, "uuid": "07da0970-8a12-420d-865d-ac5bea916c2c", "value": 975442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054282, "uuid": "cc7e34b6-8a8a-4581-8fc9-6bbe0b7bbb78", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054282, "uuid": "13e4f244-41dc-4b40-ad18-1680d64bce28", "value": "linpeas.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22060a32-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053875, "uuid": "8a3e9517-9f1c-49b5-8acb-cdf4ee2f9221", "comment": "Malware payload (PEASS-NG)", "value": "e6ddc459e8e718ebbc90fbd00455e787", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053875, "uuid": "037aaa75-b43a-47f7-a077-38cb751d09e2", "comment": "Malware payload (PEASS-NG)", "value": "a490bc07bf8dd4ffcf4c5ace3936db086da90db2f5ab03cfa7064e98eb463683", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053875, "uuid": "5cc32774-bdeb-4d82-b222-cdc058bf263f", "comment": "Malware payload (PEASS-NG)", "value": "060fa6b4d0bed596dfba6547aa347f524691f8dc", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053875, "uuid": "b8ca6f8b-cf1e-4c1c-b677-aedc7628174d", "comment": "Malware payload (PEASS-NG)", "value": "65f8403f94d761677802f3af26b6462d7ed67f14e1ee314588596c5bfd4b63f14458a8e529915b721ae4d8bd60a5020a", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053875, "uuid": "a3a7aaa3-4542-4c88-be48-a9c108a89621", "value": "T14A06A089BDAD3940DA896A3A5FF906C5272DFE4F2F528717391073AF25F22094E91334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053875, "uuid": "5e7ee5dc-e8f7-4f3f-ae84-8ba8e1fa1547", "value": "49152:nbRcK9vR+wArnz0hnDVpx3T89TH8ImKims:bRcKTr/3yHj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053875, "uuid": "2235bceb-c396-482e-80e9-a5f22ce00c42", "value": 3989257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053875, "uuid": "51dd9481-249a-402a-9c8e-cc23d657eacf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053875, "uuid": "63599836-4964-432f-bbca-ab0aaad3a322", "value": "linpeas_linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb18eb0-251c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774094027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774094027, "uuid": "c32dbd12-ef59-48c9-a6db-513943be4134", "comment": "Malware payload", "value": "ad324b309dea0fd8d6b36783b50f32a6", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Elisa-Olea", "colour": "#D6B795", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774094027, "uuid": "8b0d9330-2456-447a-bd24-8c100ecf2010", "comment": "Malware payload", "value": "a4da16b96abba3e940c2cdfdb6f206b3fad6e0d33134f6f3ec987cbcad9ed83b", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Elisa-Olea", "colour": "#D6B795", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774094027, "uuid": "376f0243-c6b2-4b28-913f-a3b27c86aeec", "comment": "Malware payload", "value": "1892ed0a4d171843d0383875d89dcbff8ad4b234", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Elisa-Olea", "colour": "#D6B795", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774094027, "uuid": "176718ca-35c5-4b05-9d39-b3ef4421fd3a", "comment": "Malware payload", "value": "4537e2d52c20376ccd4f172b18fae1acb0819b32c01cc0a6e8af63483df51ddeb270ddbbdaee287dd3c8f16f400fc128", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Elisa-Olea", "colour": "#D6B795", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "main45-b-cdn-net", "colour": "#8C8AA9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774094027, "uuid": "1524f6c6-5c04-4601-a5f1-c11cbb31b67f", "value": "T1EAD6F131768AC13BD56F07B02A2CC6AF51797EA12F7744C753D81E6E19B48C29232E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774094027, "uuid": "290b273a-9b89-4ded-80ca-f7714ecfcdaa", "value": "2565cbd2a560c6b3554de2985322d883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774094027, "uuid": "67d3c906-e813-42d0-90f9-ffa6890a5f0d", "value": "196608:J/Z0Y+EjeH9L+eWM+VkgLh9yPNhthh7n5stG2tNF7Od0oYxhOd2t2TR:J/2Y+E6FPjmkgLIduMc02t2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774094027, "uuid": "26843534-32a4-4456-bdaf-c477c44514b0", "value": 13589616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774094027, "uuid": "c9ed9af0-7cf7-4d75-8243-2b594cf909a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774094027, "uuid": "69bb7db8-0fb0-4f0e-9e9f-dc2210563afc", "value": "rufus-4.13p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32a9c2f-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054199, "uuid": "046388b8-dcee-4437-92f5-83d19f5e97c2", "comment": "Malware payload (PEASS-NG)", "value": "17bb2da7784a67f9dd2433fdd2ad1cde", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054199, "uuid": "58e22e84-f855-48eb-8b8d-4dc24747c2d3", "comment": "Malware payload (PEASS-NG)", "value": "a8082abbfa3f053a9d78a7655fd071ac0bd34cbcee4f0ad7bbad4df6dda10f62", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054199, "uuid": "f72e25f7-338c-4b89-87e1-69d91562cd84", "comment": "Malware payload (PEASS-NG)", "value": "029d524a4db2a65267c04a8ae4bed8f54cb44a24", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054199, "uuid": "78a04d5c-cbac-4c35-a9b2-74a8881b273d", "comment": "Malware payload (PEASS-NG)", "value": "3f424c41033c45f9c0c84554ad55716a4a8bf160fcfa15499d44ce443cb7bdf775ecc19c384ecf72e9685f31de437eb7", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054199, "uuid": "0d987fa2-49e5-412e-ba1e-c11dbf42f877", "value": "T16C06BE4BBDE03994C55A523B89EA59C22F79FD072B3113C73E40736A2B726C658F9324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054199, "uuid": "0d46c352-4d6d-4010-8fec-bbfaff6c9cd9", "value": "49152:HZoJeU6Qv7qtrFxuv/pyvFHw9slbgOj7RtlDk48dSXiA:HDptCslbrj7DAdSXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054199, "uuid": "9302807c-ac20-4713-bec9-ec247f38235d", "value": 3870280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054199, "uuid": "d8e5d8f6-5b2b-4075-988a-9562f0529480", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054199, "uuid": "75df08dc-39b5-4626-b394-087217392d84", "value": "linpeas_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd3bb73-2509-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774085842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085842, "uuid": "a90fd724-f994-4e28-8cfe-20ecafa93686", "comment": "Malware payload", "value": "a317f3ebd29ef843d0282faea8c97e26", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085842, "uuid": "7faf7c03-1950-4ba9-a5c2-edee63358fb4", "comment": "Malware payload", "value": "a81ba29e550beae21fff69bfe0478249eb7078b173f9cf2040d74df299fc9d5b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085842, "uuid": "6c3c77a2-65c1-4e1c-aac4-d23a7b375d62", "comment": "Malware payload", "value": "4491a27f5f1ee3c3b2183cbf9e8d0afbdb741587", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085842, "uuid": "749fe251-d8ab-48d9-91cd-50834936c302", "comment": "Malware payload", "value": "2ecf7e4bc871e53e3ebb42d4bda1227b1ac840aa266a21ebe8e101f7d9c290c78f78663fe3a2e99b69390564ec2d5a2b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085842, "uuid": "4d761adb-4029-460e-832c-ff0e88eacf3a", "value": "T184F5E06A7D85D929D44770B11691C037A42933CEE04AF8179EA00E893C73F9DA717EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085842, "uuid": "cfa3c5a8-a6e0-424a-bd22-386d6d8d3a95", "value": "98304:8OJselujReaOKfqOfbAPJD57Izwwh0kRfZeQdFD+0X6:JlujRXVf3TVxh0EUsFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085842, "uuid": "cc49e916-8594-4bb1-9bac-91f0091dbc5f", "value": 3351360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085842, "uuid": "1908685d-9d8a-4def-b77e-0937d65d61e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085842, "uuid": "69306a55-be26-4c08-8503-01960dd30a1f", "value": "Component.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a91295-2575-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774132162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774132162, "uuid": "159e8e5a-051f-4aaf-9d9a-57a09f05c13b", "comment": "Malware payload", "value": "2f2371bb845a32a76042e06170c46767", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774132162, "uuid": "d9dd3e0d-5be0-4b7d-a4f1-31d4a289bfb6", "comment": "Malware payload", "value": "a84ec7e5bb992a2187ca2e26748be869c70e0a8267bc93356eb096781bc5f52e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774132162, "uuid": "7a7ac23b-db90-4770-a978-9e72efbdbd02", "comment": "Malware payload", "value": "e2b1ce7143e302ad3e2f693a1feb2a27c460abc8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774132162, "uuid": "82ab32dc-481c-4a58-8276-a0e311b26ebd", "comment": "Malware payload", "value": "521c3113817545a65ff366d5e61d6a95998438d6f41b8d25c1df34b77a26fe455836d48a7bbf03e27573d06b5898b8e3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774132162, "uuid": "4d5bb609-410d-479d-8eba-7e0f35582b4a", "value": "T1535733DAD8090B95FD37C5346BA8FB0D96A53D708E439867369A731A2BF639031FC019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774132162, "uuid": "3e3d9fe9-0772-4550-8d21-26d1f482a358", "value": "786432:a5FZinxqH50tTR/ppHnVS6JM3GawUuKXzWwbzlc8sZM:a5nN5Ulp9tJS5HbzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774132162, "uuid": "786b03bb-0b82-46a0-b16e-6fdda8925172", "value": 29458432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774132162, "uuid": "a7e3b067-4153-4dd5-b60c-9dfb89a1c8ca", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774132162, "uuid": "a9e3a252-e44d-4aff-bef1-cb8bea3dbd35", "value": "RivalMods.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daef77e3-24fd-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774080814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080814, "uuid": "25ef9693-88d8-48e7-aee6-9f7864c42bec", "comment": "Malware payload (NetSupport)", "value": "ce3709b80d2404647ee4021d35749485", "object_relation": "md5", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080814, "uuid": "895a8732-eeb7-4872-b965-62f4a56f693b", "comment": "Malware payload (NetSupport)", "value": "a85e96598f735e6e77458980426898a6f607db57e3283b1707db8ca6b519c36b", "object_relation": "sha256", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080814, "uuid": "dfa21d8f-c3da-4543-93f4-d4cd1b44a393", "comment": "Malware payload (NetSupport)", "value": "1def9340532e4564bc10c4e76c4d1ec5415b23ca", "object_relation": "sha1", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774080814, "uuid": "4af2ec35-502c-45c7-b987-64f9e0f3fd18", "comment": "Malware payload (NetSupport)", "value": "3099a5810cde2c845181678e9f8772d90c3614a5066c07458645f845211ae7f6b0a138ef1592472efcb9729d9a926bd8", "object_relation": "sha3-384", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "fc-denmap-cfd", "colour": "#2D193C", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080814, "uuid": "44366f4b-2b55-48a9-912c-455a8b8fb898", "value": "T1923694D97AC457E06929DBDC824775DE1394B13E6FBB180D02E048BA381EE1766E0CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080814, "uuid": "b1d6d448-9155-466f-bce5-1e5b14f87d8b", "value": "24576:HvMxUBFAz9A8VcbKGl+C9Jw6SII8oIV4KU5PBlvsHWbNIbWyzoPB3lCL:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774080814, "uuid": "1d7a58d2-167c-4f38-aa21-27d044ef03b6", "value": 4970402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774080814, "uuid": "84202bf2-c4c4-416c-b1dc-9d5d04984470", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774080814, "uuid": "5702525c-5d3a-427e-8f37-d0faec4fc68a", "value": "avoidsynthetic.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7761a1cd-2566-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774125744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125744, "uuid": "b4b1fe53-2d1b-423c-a74e-7e228ce92b39", "comment": "Malware payload (Mirai)", "value": "0ca389626d1fe214ded12be1dab3b49e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125744, "uuid": "218976a7-5b3a-4668-82d3-205fe1ee508e", "comment": "Malware payload (Mirai)", "value": "a8db6dde2a30a96ffb85a3775dfd3f49e09532b006ea7040f5daf386283c0925", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125744, "uuid": "e6bfbc8b-6dc8-4fe1-a79f-303ec8c814df", "comment": "Malware payload (Mirai)", "value": "e40d4b00a7a47eb389c57c5183e58f725445b92b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125744, "uuid": "42b96f1b-dff6-4c78-be36-a716fc1ad6e9", "comment": "Malware payload (Mirai)", "value": "b952472101c68def3ca2942ec8f495c3fb1ee2842b70b2529aac944948949ae1dfe34f081ca95b82b40ea00ff0f2edb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125744, "uuid": "9fbadfe7-da0b-4fcc-925b-028ef7b32b58", "value": "T135C31952BE528F13C5C322F6B7AE42883B136B78D7EA7102ED247F6127874DA0E27511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125744, "uuid": "810fdb52-3ccb-48d9-9c75-5015ef1934e3", "value": "3072:vsa/8DbduCImPyf0ooEHifl31KavExTTmX:yDbdu1mKf0+HiflBymX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774125744, "uuid": "a31931fc-3c3f-48a8-94d6-96ceb8cf0f05", "value": 121244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774125744, "uuid": "b337608d-1a3f-4545-90e6-d7d3de50bead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125744, "uuid": "048eb6d8-0713-466f-9cc1-f185581b5d23", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0054b275-2535-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774104499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104499, "uuid": "295a1c05-2810-4e33-a214-5083d8ae8798", "comment": "Malware payload", "value": "f58aef1df52a45f88cba3e4fb604db97", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104499, "uuid": "547214ed-9697-46ec-b9b2-ae44c27f6b47", "comment": "Malware payload", "value": "aa3d20f2b427a72b1176598cdab27fbffc504e257c8358cbaf31cdc2dd1aa70f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104499, "uuid": "b145e97f-7fdd-4fc8-a380-26cc62e775a6", "comment": "Malware payload", "value": "f9a5e217db12a39a6e61ca9f5810d622cf8817ce", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104499, "uuid": "3402c6e9-a81e-4259-ade9-7f069b3be500", "comment": "Malware payload", "value": "ef316667069d1ce92acbcdfcc2073218786a6c417001c58d7453027cc7a79e69b17903d6afa90cb5dbdbd8885c41e515", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774104499, "uuid": "8b9f3d34-3711-4205-9aef-6592a3c4145b", "value": "T1C1B375DE6D6E07B9C2DE6828B09F9D4BEECCA146170DC011B61FDC003F7AEA950695E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774104499, "uuid": "66cf2a53-41f4-4816-950d-147dba3f6029", "value": "1536:dShLsiCVgUrn1oRJRJeAO16tcSLAiA3ZoxqvMZGLY1/69gbGtpcnimrs5KPwNuzU:V5WAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774104499, "uuid": "a7fe2715-4974-49b2-9228-06805e4678d1", "value": 115183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774104499, "uuid": "c3d6d4b6-2844-4446-bad7-4ef51a15bef3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774104499, "uuid": "0d314398-2c87-4145-a16e-e0ba02cff2ae", "value": "User_Backup_Draft_540.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100e23b4-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053845, "uuid": "c520befd-4ec4-4ed6-bfe1-d2ef75f5dee2", "comment": "Malware payload (PEASS-NG)", "value": "21f9c8782eb6ba54205006af6517a969", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053845, "uuid": "0f25128b-cdd1-43d8-aba7-0826413de706", "comment": "Malware payload (PEASS-NG)", "value": "aa594e90a88687010a00fa07bd055454b89e07929b21623cc5b3f0bc0108548f", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053845, "uuid": "b2c8bf17-5ad5-4dd3-ad60-148f95e1fa26", "comment": "Malware payload (PEASS-NG)", "value": "02c3310935be09d5f368d4e0c503bdc3146088b7", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053845, "uuid": "475cd55a-f6fb-4f08-93ed-63d87e078320", "comment": "Malware payload (PEASS-NG)", "value": "3b59fbe87fc0d285b033fa9089af8bc89cec5e3dcc7ccd95f3dca27da61d887e143b1a7da7f66d75887ae51feae53a64", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053845, "uuid": "5061b07f-c3e8-42a6-886f-0dcfc4d0d8fc", "value": "T1BF06AE1BACA02550D626523A89EA59C62F7CFD4B2F3117C73E50B3BA2F725D618F8314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053845, "uuid": "a0592ba4-534c-45a6-b4f4-fcfa2dbe74e5", "value": "49152:X2euZd3xHeaHR+wArff9Anl8l96nxPqOQdkHap4tE34NSfh:X2FtH1M9A+SnxM7+VYfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053845, "uuid": "66bfd60d-fda8-4ec8-be94-a06578bacc3b", "value": 3859968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053845, "uuid": "81685eef-6887-4754-9d5b-cd097f8fbbfc", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053845, "uuid": "dc22ffbd-9179-43e0-9e1a-1f521bbb8c2c", "value": "linpeas_darwin_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c863d52b-2507-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774085078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085078, "uuid": "6ad56fd5-68a4-4477-b95b-4c7cf8a95788", "comment": "Malware payload", "value": "775a24abe5e053d655c83209aaa36c54", "object_relation": "md5", "Tag": [ { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085078, "uuid": "dbc7639f-3a88-4cd0-bfa1-ee1427f883ce", "comment": "Malware payload", "value": "aa711f28766c197669778c993b08b38dc1e594c750214b4f0cd8c078f07569cd", "object_relation": "sha256", "Tag": [ { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085078, "uuid": "f29b207f-50ae-4042-ab5a-c2900c4f7a3a", "comment": "Malware payload", "value": "eec7e4ff9cbe9cca6d915e5c981ed811f1a36f4e", "object_relation": "sha1", "Tag": [ { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085078, "uuid": "6575a630-6e67-414e-9a4f-9673c99b7adf", "comment": "Malware payload", "value": "b1e82a0308462d1f0e05ba5919b6e133b6fcd75137fcb02b19cbe471cd22bf880d5149a65c18f45d6f0611c03f7aa930", "object_relation": "sha3-384", "Tag": [ { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085078, "uuid": "6853447d-eb0a-4499-8023-2e6ce2d5da31", "value": "T1A4B57C17E69180B9C0BFC1B4D38B9A72A631BC8D0530B65B17D4E6603F36FA06B5E758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085078, "uuid": "37938008-1feb-4581-9842-e7f30512be73", "value": "49152:+PbCsmOAZPLWLljwaFVJfqhkIU6iyqqDPj:eAOAlK5O+RqDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085078, "uuid": "662ae54c-4e3f-4a1f-b459-a07c0ab2dc2e", "value": 2412544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085078, "uuid": "92e96db2-80f6-4092-a5e3-4c3b2668ca45", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085078, "uuid": "903be1d6-f902-4769-9bd8-3b31e5729a85", "value": "aa711f28766c197669778c993b08b38dc1e594c750214b4f0cd8c078f07569cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ace506-255d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774122010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774122010, "uuid": "6c7aee2c-6126-4d68-803b-5e5ec7dc4739", "comment": "Malware payload", "value": "0f2f3186e4b266009657cbe635ab10a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774122010, "uuid": "61519e44-8edc-4cc5-a77d-b3ca8583abb7", "comment": "Malware payload", "value": "ab963326934c83493ca82375a989ac54ec0f381a67542506254dde0b8c2801f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774122010, "uuid": "1f080188-16b7-412b-a836-55da5e59cfe1", "comment": "Malware payload", "value": "aeab4ad9785d6eaa572659d589ff006db7c5cd60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774122010, "uuid": "d27d8243-dad7-4d95-88bd-eb0d677fd7a7", "comment": "Malware payload", "value": "ce0c7a3631513f4a27375c55802bf5ff8665494952aa486cf4b7b94cd93112bda717a8a54c92c783534cfe0dbc55c1ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774122010, "uuid": "cb758af0-b38c-4067-891d-250c2100deb4", "value": "T143A58D477C9144FAC46A973689B762A27A35BC0C0B3333D32E916BB92F727D05A39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774122010, "uuid": "52738365-4e84-4a3c-8253-a7f6ffba9c34", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774122010, "uuid": "c398b57b-f95b-4ad6-8ab3-8c7f9b68253e", "value": "24576:eVLph791Q8HDbca+Ndoo+1u++yb4cIbozw035QrFzlpgvy97PmuGiWPKNcoaeT:eVVh73QO7+N2ru+n1Iuw036rkm7mJ7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774122010, "uuid": "a359c1ae-5ddb-4cb6-9828-a0613c9c0310", "value": 2202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774122010, "uuid": "c8445aba-3c6d-42cb-bdcc-3032b1b0e46d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774122010, "uuid": "14edf073-32bf-4f3a-8e59-9d3e662ab95a", "value": "V\u0435l\u043es\u0443s v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fbb409-250a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774086443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086443, "uuid": "1d15caf4-42f9-44d9-b6b1-6c1c02dc1e78", "comment": "Malware payload", "value": "a41551f95301740f8b5f61c1df38900b", "object_relation": "md5", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086443, "uuid": "98889136-7658-4114-897c-fc96d7c43223", "comment": "Malware payload", "value": "ac9dbfab0e0e276aea64e3975e615e827464e1ac05cca1fed654b5b480961051", "object_relation": "sha256", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086443, "uuid": "7febda8f-f0cc-49e2-bd57-a748d9c8875c", "comment": "Malware payload", "value": "e1bfdb73bad1fae606f2fd60c613cebb8754482c", "object_relation": "sha1", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086443, "uuid": "dbb1f851-0ae1-4566-bb2b-eaa975e969cf", "comment": "Malware payload", "value": "b4f5f782b92cd2e66a1686f1d1227cf6e7ee42a165219c51a12c6e6aaee78c8627c36b658af80a0034f6e01b46e808e6", "object_relation": "sha3-384", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086443, "uuid": "c9b4d3f8-aa23-45cf-8319-cd1d9849d0ea", "value": "T17352B67B91F43151424353B1962A421A7FB6A017E71A8F1C76AD8BC04FCBDC6CEEB048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086443, "uuid": "97aa23ae-05e5-447e-8b96-65bda0a64321", "value": "192:j+XNOBN2icFJnYddQ+WWNOJH8X0CbmHJyu81YLn68X0CbmHJyNxu7aimggMHC:GOEpEF1fEemgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774086443, "uuid": "7948202d-8779-494c-a06a-a9828e1013b5", "value": 14167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774086443, "uuid": "831004de-03a4-4ecb-a13a-82faa69baa65", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086443, "uuid": "d510545d-36de-444e-85b3-647873170431", "value": "vote\u0435tor.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04326ba7-24c0-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054254, "uuid": "c1a0baa1-5fa3-4fef-851c-897b519369cd", "comment": "Malware payload (PEASS-NG)", "value": "28e264ee5225e97bce5ac7514a07aeaa", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054254, "uuid": "d497f7cf-176f-4306-a8ca-c967ee43e827", "comment": "Malware payload (PEASS-NG)", "value": "adab26ceda1cfd7e69acb81318147d19948826020b52c0107d2d96b6d3d89b4e", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054254, "uuid": "e5455254-358c-43a1-9b00-5af237f8748c", "comment": "Malware payload (PEASS-NG)", "value": "c6a497ca8e11e915c5fbf810a936484f0be7373c", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054254, "uuid": "5d284a86-d477-4023-8d72-71c704b52993", "comment": "Malware payload (PEASS-NG)", "value": "5f111d6b11b6c4813a42d91f43661c859b1c3947193c3f023ca31e3aedb995ba39df6a288ff5cce09c717218c28b3d49", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054254, "uuid": "227e70e8-b246-4dd6-aa46-48e93ea81243", "value": "T1B2A6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054254, "uuid": "86a6b2b4-b04c-4355-b469-e37ff2f1d417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054254, "uuid": "631600b0-3173-4697-8639-bdb16a8a0c2b", "value": "196608:JPxdtVBFUcwti7TQlyVN8iNISRTRmW5Q/:VZHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054254, "uuid": "71c0d880-6793-44a7-ba0a-f711a19d3907", "value": 10171904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054254, "uuid": "fe0b2300-f675-40df-aa7e-0745ba3573cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054254, "uuid": "66337e1d-a11a-4201-840d-ce6ade5c541e", "value": "winPEASx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5822554-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054176, "uuid": "8a9b49a2-cf91-4ca5-b9d4-1962246ea257", "comment": "Malware payload (PEASS-NG)", "value": "490f769c09831f8032228eec6b274516", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054176, "uuid": "8488c7ad-6249-4231-8a2a-229432caa6b0", "comment": "Malware payload (PEASS-NG)", "value": "adc270036761c17e5811273aee7648c70e46d9e0e6bc127ccbfbc256c811429d", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054176, "uuid": "a5b6356a-175d-490d-b4ab-751d93150704", "comment": "Malware payload (PEASS-NG)", "value": "2437f0b69cd3bcfc375e18eeec8f73e84859e1d8", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054176, "uuid": "be8184e3-032d-4d26-8ab5-4a40971e9a15", "comment": "Malware payload (PEASS-NG)", "value": "98b90f4da50862dcc8f1c1d94fa19e7233326e560065d4362d58e903df404bdf8cfcdf7b80fb15c313fe12d5f4c699d9", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054176, "uuid": "b01e4993-02ab-4410-9e79-b94b6c0c51fc", "value": "T15D06BF9ABD6C3940D649263E5BED07C1177DFF4B2F1297173944B7AE1EF220A8A91230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054176, "uuid": "4b155c75-41df-4bf4-beb7-56896984432a", "value": "98304:tpBEHzKKNdXKPns1AyeOO/NyTK8G/bu75RsxEBk4N7hvdYelTjYfdmo4ijDVIx+L:8U/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054176, "uuid": "f96a55d5-b0c9-416c-82e3-6c183b477436", "value": 3811458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054176, "uuid": "b3731ca1-8b08-4475-ac2b-9c8f3a49239c", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054176, "uuid": "21f5cad3-6102-4b74-ac52-c22ea38d2f61", "value": "linpeas_darwin_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b83b04-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053992, "uuid": "85f26348-97a2-4bbd-9bce-148b3b64f15d", "comment": "Malware payload (PEASS-NG)", "value": "44dfb8830f9ef76f994938dafed0340f", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053992, "uuid": "aa56aee6-4c1d-4391-a83f-06485eb69e5c", "comment": "Malware payload (PEASS-NG)", "value": "ae48ba4f97a345b03c1724d3725cc67b5a344e69c2ba55caa508dcd626149d39", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053992, "uuid": "e7062d0a-5465-4d7c-874d-41224d4d4abc", "comment": "Malware payload (PEASS-NG)", "value": "d98e120a53760c33835a914516120fb92a241458", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053992, "uuid": "9988e091-dbe9-4c9e-b945-8ad5e36eee59", "comment": "Malware payload (PEASS-NG)", "value": "61d7e3be87fa7c1529879e59156d7d23457fb3b0c0b62cb231247e461b04773b2d8f6f8bfdfd036c34bc8809e6407636", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053992, "uuid": "6ac3acad-7174-44e4-9e79-6fa09842a616", "value": "T137B6D14062DD046DD6AF0E79906202324B75761A175A8BC7FBCC81AC0F5BFE29F76326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053992, "uuid": "2dd6256b-ac01-4f8d-a9f7-7abd410b5047", "value": "98304:tpy9jhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5QH:T4jVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053992, "uuid": "af528066-b749-4ca5-8250-32f59e511dcf", "value": 10930176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053992, "uuid": "21680b98-a4f1-4cd1-99bc-2f76aeeecfaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053992, "uuid": "913e0c90-01bc-4956-acf2-1910e4a09d34", "value": "winPEASx64_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a085305f-255b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774121089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121089, "uuid": "9fe8b81c-8a77-4336-bfd5-fecf0006f903", "comment": "Malware payload", "value": "1fd95cc2e40e74514d7a1dc188b66268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121089, "uuid": "d20fc4ec-4e70-4d0a-9a96-8c7d6989b768", "comment": "Malware payload", "value": "ae9e9325f8e8c491356f4855b444aed5958feb4060982d37a06b6e8844abd04d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121089, "uuid": "bd84027f-3878-4cc6-aa52-863db80c8c1a", "comment": "Malware payload", "value": "5f76df0d70f69ea223615101f0a3d82575aeb397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121089, "uuid": "33b1cb84-ba5c-4885-83ed-976eec09cd0c", "comment": "Malware payload", "value": "4625198318ed37c0d882ad15d57cc8c2a9cda8a8418d331bc19a4a77a739eb30f51a3da1b1092224971a6910b5bb66b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121089, "uuid": "3e21c046-c888-4151-b5b2-14482d6eecdc", "value": "T192C3020552B2A5BEC167643297D95BB1F334EA018B254EBE07E1D1716F80E207F6F82A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121089, "uuid": "496a1804-82de-437f-a9c7-73225e8146ca", "value": "c1f4358211a66fe3d457f3e6f5983347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121089, "uuid": "474f619a-6c58-49b9-83a6-15935cbd67e4", "value": "3072:9VJxf+BG0fuj2RR26G5NgLnNSWwXEetYj0y:9FRQS2qIM5XdtYwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774121089, "uuid": "e6bbc931-faa3-4a5c-87fa-5fae8a3d1a89", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774121089, "uuid": "cd774364-fb39-4e5c-ac59-b5d5e06e6ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121089, "uuid": "54331d29-68e5-4477-92dd-00279ed001c3", "value": "toogood.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b71ec06-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053891, "uuid": "45c18948-0a22-410e-9828-f434358e655f", "comment": "Malware payload (PEASS-NG)", "value": "36d07a374590684e47c2e82b80993b13", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053891, "uuid": "be234a22-532e-4bc8-b965-77eaa3be653c", "comment": "Malware payload (PEASS-NG)", "value": "b0749eccd6b4f8c8b40ee3236b3f9abe91802209fbb1c8c9f21b86f53766eaea", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053891, "uuid": "490a1de4-4a40-4474-b267-2d22ac975127", "comment": "Malware payload (PEASS-NG)", "value": "2e4dbe1020618d2528530a60af42f0cc8b304f09", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053891, "uuid": "68f37cb0-a8dd-46c7-80e7-7d11424ba958", "comment": "Malware payload (PEASS-NG)", "value": "1b8994bbacb9cc21e8ae0a81ac91b6240c96c6443539ce440592d849dd6af19e4e8a50bfe6fedbc8a0de5fcb363afd12", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053891, "uuid": "c75e6fa6-9447-472b-ba43-d043a508abe7", "value": "T1E9B6D044A2D90929D5AF4E3D806212335739760A53DA8BCBFBCC82980F57FE6C776316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053891, "uuid": "d6cd3267-4282-41d9-b13f-54a7b9f899f1", "value": "196608:vvyxUb9VBFUcwti7TQlyVN8iNISRTRmW5Qn:ycJHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053891, "uuid": "ff6d8c2b-b13f-4cbf-802d-058493294031", "value": 11115520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053891, "uuid": "dac2465a-109f-4d8d-aa3b-3a30252239a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053891, "uuid": "b3971042-fc81-447c-a6f9-b5f36e7e64e9", "value": "winPEASx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c2d050-2539-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774106630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106630, "uuid": "e83f0f08-916c-42f3-9a3c-8702d3a32242", "comment": "Malware payload", "value": "85870d9889492e3df9fbec630bbb5fde", "object_relation": "md5", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106630, "uuid": "68cdf72e-253a-4b68-874f-654fd35642e0", "comment": "Malware payload", "value": "b0cd860f18b0136e063d7ef9a3c84d138a1a21dbea019605ce66a3a1fad91db4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106630, "uuid": "dbb2e54e-372c-42df-876f-06c9fde226e8", "comment": "Malware payload", "value": "a549035a4c72ae3cd091767d90457314a623ddd0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106630, "uuid": "636b2f4d-1fbb-406e-bb8e-966c9718a2a9", "comment": "Malware payload", "value": "cf1549026fbf4d378b875135d0195de528023d6211187bb70d58caf095836309f7b6efaddf04f100a45bf183f03008cb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106630, "uuid": "ff11d436-b326-4685-bba2-b48cf420620a", "value": "T18B577C87F8997955C5DE82389E3A539BB7213C080B6463DB2650B7785F327E0AB33790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106630, "uuid": "abbabdab-35c0-44a2-8b17-7888dac1c829", "value": "393216:D1tJCH8iiq51rGJ4TFa46P4R8KAzjlNjo2ZbMM4p4wZ:D1zCciiq5BTAZzUUOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774106630, "uuid": "f0c61cce-ab0b-44cf-9d04-1aea84b1f1ea", "value": 29091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774106630, "uuid": "dc4699df-0684-4de1-a14a-8b319c5bcb47", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106630, "uuid": "a169fb7f-80b5-4fbd-b07e-65a76188ce9c", "value": "b0cd860f18b0136e063d7ef9a3c84d138a1a21dbea019605ce66a3a1fad91db4.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55c9c2a-252a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774100159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100159, "uuid": "0c1dea01-e626-44fc-89ea-f89bed617a49", "comment": "Malware payload (RustyStealer)", "value": "89a4a088164d8bdf6b01657847da452b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100159, "uuid": "67be9630-61a8-49db-b65b-e68931cd80dc", "comment": "Malware payload (RustyStealer)", "value": "b11edd3a24a964f69149b91de17ca089c6b013865493b8955a045475e6805b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100159, "uuid": "276ca56f-2150-44cb-9395-f5422780fb24", "comment": "Malware payload (RustyStealer)", "value": "544f4f24ee45e9459d93cecea5091765d1ad09c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100159, "uuid": "69959d51-fb3a-46ba-a0fb-85f3b428d8cc", "comment": "Malware payload (RustyStealer)", "value": "cca039720409ddf3a876c9fbb7b503fed0dd4141b2415188756293e8d0c2f729ffb0e2360006fdb0827bb0b6049dfc2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100159, "uuid": "a90389a6-2f13-4fa1-b5f3-5b44cc456c3d", "value": "T129D67B2420D86607FD7ADFBE89DC76540F7AB2913723FE28974149ED0FD1B49CA025A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100159, "uuid": "1f759ffe-a0e8-44aa-9e1e-631e4e3078ae", "value": "196608:PpDbxf9rAuqZapSIf2Ey4ccLcrUBxPzyMm3EIg+f9mDBz6nMNNzlk65c:hAhapSHEGAp+Jd9m9+SNRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100159, "uuid": "379dfc73-8a39-4179-ac02-7953ddf068bb", "value": 13598720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100159, "uuid": "cdc6ef77-c2b9-44fb-9cca-1843f6f92c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100159, "uuid": "3bcaad25-fed9-43d3-8856-3e116f95c876", "value": "KIDDIONS MENU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6303be-2560-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774123040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774123040, "uuid": "397d21bf-c4be-4a3f-9794-a90142d66b0d", "comment": "Malware payload", "value": "95232312b2ee934ddd027a419ea4a194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774123040, "uuid": "91f21259-7898-47e8-94a3-b3b07f8bd733", "comment": "Malware payload", "value": "b168ace6e561ef4e7e7b27841ee569b9eeee715ccc4607677f6df8367516d665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774123040, "uuid": "aee63f0d-84cf-4532-959c-3f4bdeb8f6b8", "comment": "Malware payload", "value": "7859d6a688364e8cb3508099183d3239d35eecdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774123040, "uuid": "34ac0a7c-4f2b-47fb-b271-53645449f8c4", "comment": "Malware payload", "value": "24c89d84185cdd296c70b968ec6b36b1bcc312f0fafa4eb923fa77d35fa89adcee9f30bd45e21ed079718b248a70c9e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774123040, "uuid": "6efbd78a-6273-4467-b69d-d6e62c99b08b", "value": "T10A753A0BBC90A0A6C4AAD2328A6692827B707C450F3167D73F50B6BD1F77BE45E79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774123040, "uuid": "1ab7f764-270b-4dfb-bf34-a539f626de98", "value": "49152:HKorb/TcvO90dL3BmAFd4A64nsfJvTTi28gBuqoID1:Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774123040, "uuid": "a9226121-e378-471d-bcd0-6a38828088bb", "value": 1634304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774123040, "uuid": "348312dd-e76e-46f1-90f8-4a87c65ebdfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774123040, "uuid": "e64c7766-e2e3-4a6c-a90f-62455233a997", "value": "rev", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61d168b-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054231, "uuid": "2d35c2e1-c3d6-4a21-924d-88d572c6049f", "comment": "Malware payload (PEASS-NG)", "value": "bbabb1032bdafa2eac3eef65d7be8ebe", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054231, "uuid": "faa66461-4cf4-43fb-b6a0-910908a79f7b", "comment": "Malware payload (PEASS-NG)", "value": "b196cdf4419c33f447de80c424e94eb2b2128dbc29e3c4eb58b1943cd2045bde", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054231, "uuid": "60e0cd05-3a98-426e-9366-11152fef4c8c", "comment": "Malware payload (PEASS-NG)", "value": "6611c3d539b6d8b0c01b76887c26e35c4d415524", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054231, "uuid": "271b7902-252f-4b66-8d51-507a48ad4219", "comment": "Malware payload (PEASS-NG)", "value": "f0ff7add650ab7e670debdb47499d0daa89d7f555031e185e1704a7e1955c1683e20d403507bef6b15666279e29172b5", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054231, "uuid": "790c92c3-d996-4bea-8127-37a60d27e0f1", "value": "T1D2A6EF02F3E401D6EABB527891B61612D672B42A4330ABCF338C94695F337D16E76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054231, "uuid": "08b5e6e5-15ec-49c2-87ee-fe88f7f521e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054231, "uuid": "052d510b-2421-4181-8e37-7f87961f6648", "value": "98304:14KAANhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qr:1tNVBFUcwti7TQlyVN8iNISRTRmW5Qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054231, "uuid": "29ca403f-21c3-4230-bf7a-db6b36e661b8", "value": 10026496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054231, "uuid": "db69e645-fa78-40a7-9e34-829cc578861e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054231, "uuid": "2bc7573a-780f-4606-a999-f303163c2036", "value": "winPEASany_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c269631-2566-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774125564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125564, "uuid": "93a8b407-5302-470e-a29d-fe3ae43e321f", "comment": "Malware payload (Mirai)", "value": "9f1cb8b01aabef2df6e064272bc4b7fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125564, "uuid": "e15ae0fb-611c-4bad-bc32-9b46bfcaf151", "comment": "Malware payload (Mirai)", "value": "b1d86d54963c570d9d9cf61ae25e06823721812762062ad0d057b0fde64e015f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125564, "uuid": "0196c9e9-934c-4141-937a-e52b0906b592", "comment": "Malware payload (Mirai)", "value": "904627a428f5df9b995bc732d598eab8c871a7db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125564, "uuid": "068d7dff-9009-4f20-89b9-6bded6beb18f", "comment": "Malware payload (Mirai)", "value": "b55d296ce548409ed097ecb4cc118b902de95d9ddd2369acb7309d4bb310142b25d1d576b9f2d856051d4f50012c06c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125564, "uuid": "022c90b3-e065-4447-b5fe-6d772bec9eb8", "value": "T166145A43FE890EDFC86BCDB086BF835B1AE355AB48D1F1F4543C8C0C799929A4693648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125564, "uuid": "b0ac90ff-bf2d-4ac7-ba99-634b10924834", "value": "6144:WDVgAaa2nYHRznCF2NZWJfsG/OWjbnbFaq:Q7aa2YHRzCF2NLqZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774125564, "uuid": "52ff7dcf-49d6-42f8-b52f-887fc2cfa2b6", "value": 205244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774125564, "uuid": "90cacecf-72c5-4039-aee6-dae128f3f966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125564, "uuid": "83e9c59a-4255-4391-b10e-913e8e8ac021", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a70d35-2525-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774097879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097879, "uuid": "e0312d9d-a4fb-467d-b2fd-0e7558a56ebf", "comment": "Malware payload (Stealc)", "value": "2a27d4451c7cc45ded70062251e53952", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097879, "uuid": "be702699-497d-401f-925f-a33b22e0a6b4", "comment": "Malware payload (Stealc)", "value": "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097879, "uuid": "e1329394-7569-4c4f-a4a2-643538647b24", "comment": "Malware payload (Stealc)", "value": "9b3de366ef7d5bdff1ba70def078b9d2079b4df1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774097879, "uuid": "19bdd91f-2095-4718-93f4-6d61c18a2a6e", "comment": "Malware payload (Stealc)", "value": "7a27a55e83133490948575d61195e2515ed36ab8b64636328d6515b635db51965120d2ac6dfef561feb06acdb915d01b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097879, "uuid": "799d1cb1-d892-4fd2-bf00-b4aa846a53a7", "value": "T1D8B4235563D98125DBFC0A3874B3D53B8DB06ED2482ABACE61CC7C4B3F82B4825635B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097879, "uuid": "5437af2f-5fd5-41df-9728-6a66bc0104e5", "value": "12288:he3im7Sb5xv5OWz8KR5hAtv8XQE3XVC0I1XK5mcAlz:2Ax45NC3X3II5Glz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774097879, "uuid": "c78368e9-3d48-47c3-8d87-938b5ca5bd1e", "value": 519904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774097879, "uuid": "f9ce7f6d-a4e8-4a57-a917-f8921a522794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774097879, "uuid": "1cfcec76-93ef-4987-ab22-3931067f4937", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205ce4d0-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057308, "uuid": "de4cb381-de0e-4196-bcd8-976fdfc697d0", "comment": "Malware payload (PEASS-NG)", "value": "4290b3d82d5acbaa83913d8ae24822fe", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057308, "uuid": "a3edd6d9-2b06-472e-a166-7e6eca5b06de", "comment": "Malware payload (PEASS-NG)", "value": "b22e3494d9651749233b501584eddea122cea47dc25acc5e0c7361f91bc7eb73", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057308, "uuid": "832732d6-e134-48ee-ad65-a5f5a3412405", "comment": "Malware payload (PEASS-NG)", "value": "6157bdfb3c72d54e3a8c4874c4f7f79c96dc2189", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057308, "uuid": "d1998b91-f103-4cd0-8a14-ca92bb0ba46b", "comment": "Malware payload (PEASS-NG)", "value": "aed23d9747ad8719a19fbf31788d9afbdf693626bfe1a87c0d7a1e7075f683d9eb3226792bcfd48894c28b0258e3abbb", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057308, "uuid": "251f0cf1-066c-4350-8b50-18a54f50fc9c", "value": "T1C025FA5C640CEFB25025C97C1C951F7E19A3AF0F2665182870ECB61C7FDCCAE60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057308, "uuid": "2c65b69f-06c1-4c41-84a4-50903b3ee1d5", "value": "6144:hYczvgHVPNVPnVP9VP3VEmvPiVPpVKZVPNVKbVPdVPJVP1VdvvPVVKoOOERHp+4M:jR5ihTiWb83nNLztjYDqX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057308, "uuid": "1ec3b635-8f50-43b6-aa92-f9fc79107dfd", "value": 1023141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057308, "uuid": "d53a7511-9a42-4eec-920a-19dfb9fcc78f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057308, "uuid": "20ffbf8e-002d-47de-b64f-51499bec1126", "value": "linpeas_fat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e92aff3-2510-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774088685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088685, "uuid": "da930330-a7d3-47c6-8de9-11cdacfeccb8", "comment": "Malware payload", "value": "0fe89e4dac2efa9d63bae6c76af99aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088685, "uuid": "7c2e6199-a971-4770-9351-4f45bb12d588", "comment": "Malware payload", "value": "b26d7a0d21d26eb4f4fad0089e0ce5be473cd26af719a95eb5405603b58cf4a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088685, "uuid": "51b16b06-6429-42a6-af82-4e0ffe3f2ed9", "comment": "Malware payload", "value": "4c32f99256b6e5becfe76d12f4287ddc48661f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774088685, "uuid": "97491b86-f6fe-4ee1-a26a-c58e59027b8a", "comment": "Malware payload", "value": "39fa3122e55b6d57d08ab4ef017d750b31433448bfee1ed6e95e1384b6e5373d1c960c28424de28ec8940396d3c83d03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088685, "uuid": "46d03a10-25d2-43c7-bf74-986b4dddaab8", "value": "T14828332651928637D540AFF897C3BD7BDA3AA5932FA648C6687B20C517DC1134EFE302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088685, "uuid": "7dd8f8f1-758d-43b3-b399-488d0e14604d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088685, "uuid": "f42adcf0-343c-4b15-8899-679777bb8dcc", "value": "1572864:JyoAUOLNwhzHEnEapUerY85GURMiOXn2nz119rnZJDIkg8Phf+cWDNy0tsDt6L:JeVpEapjrYmPRMiOX2nz1nrnZ9Ikg8PE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774088685, "uuid": "2ab35bd8-b0d4-4500-bf21-8cf9eaa903dc", "value": 94903070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774088685, "uuid": "72ebd072-949f-40cd-ac76-71bcd0bfd945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774088685, "uuid": "e477ac74-9db7-4f60-b071-1cbb1273f844", "value": "Chilloutvrmod_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51011c28-2508-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774085307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085307, "uuid": "df5069d7-f4fb-4efa-9dbd-48375ac9b403", "comment": "Malware payload (ConnectWise)", "value": "a29bd3ec8afce5471ac8394e4a8ad198", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZHEJIANG-WILLING-FOREIGN", "colour": "#A35D70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085307, "uuid": "ba7ce89e-a99a-4335-ab6d-248c345b5b2a", "comment": "Malware payload (ConnectWise)", "value": "b3a129f57bd99fc3226e7b469a2bce90d48495b1e5d2d7441bcec177c9d0702a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZHEJIANG-WILLING-FOREIGN", "colour": "#A35D70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085307, "uuid": "78b42088-a3d2-4069-8c4e-2eceefbc746b", "comment": "Malware payload (ConnectWise)", "value": "934eca97b0795b376cd76f89c010d6c5459e6227", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZHEJIANG-WILLING-FOREIGN", "colour": "#A35D70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085307, "uuid": "f1d4384d-bcb8-4532-aaf8-c94c3eccc847", "comment": "Malware payload (ConnectWise)", "value": "e229aa0755b2939765b9c2dfca03cd2811da63b8573d254dcc6cb0b0b007acbfcaaa712bebd087067f02b685af6e56b8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZHEJIANG-WILLING-FOREIGN", "colour": "#A35D70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085307, "uuid": "ff0efca5-3f4d-4520-a63a-93acbc280426", "value": "T1E476CF06B9E159FAC0BF5635887652917B70BC051B2297EB2B90BA3C2F33BD05E31365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085307, "uuid": "3234d743-b70e-4be6-b14d-39e780b736e3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085307, "uuid": "8cfc8e2a-3214-4c34-87de-dec1f99aec93", "value": "98304:EQHbG3aWzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlo:EubqhfefPtHxcp9ym3nltDUJVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085307, "uuid": "8236a551-a6fe-4fd3-a2e1-4840a6eae6a4", "value": 7695696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085307, "uuid": "adeab00b-ca16-46c7-86cd-74ed3f30902d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085307, "uuid": "16c9085a-c23d-4bc1-9463-161401bfe1b2", "value": "b3a129f57bd99fc3226e7b469a2bce90d48495b1e5d2d7441bcec177c9d0702a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42500a16-253c-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1774107616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107616, "uuid": "2092eb7a-58a4-46c8-a48c-3defd80fe865", "comment": "Malware payload (RatonRAT)", "value": "bc90d32d5f699b58558c99e11398a6ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107616, "uuid": "adfd4d26-ad63-4c23-8870-8edebfb527c2", "comment": "Malware payload (RatonRAT)", "value": "b3a3ce9e029720fb0dc11b3f4e6dfcb73a3920f37c33a59d856b9a9f03fe1cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107616, "uuid": "ff72c129-d3e8-4dfd-9df4-b6ee741936a0", "comment": "Malware payload (RatonRAT)", "value": "05b3569120bb57c43f4fd832c3a3ed946c15e03d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774107616, "uuid": "38eb65d5-3ef3-4dee-8175-9d80622ffff9", "comment": "Malware payload (RatonRAT)", "value": "0457395c485c88e16dc8085e98cea34d5a3d6841fe87652205652bb0bb934cce31e0bcc851ed7f02e20d96071b3c3684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107616, "uuid": "e3cecc58-54f9-4b0a-bb39-049299b52f98", "value": "T122936B0433FC292AF6BF8B7C58B424414B7279676D32E64E9C86509C2A71785DE20F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107616, "uuid": "6742a434-cc5a-4f68-8ea7-54960565ff13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107616, "uuid": "ff5b112f-ad3d-4454-9c2a-badd2a552f8b", "value": "1536:/OiJJaCZwPYTuNHWTsqa4tsi54HelbSKpKC3tbszx/:/9JNhhAX4tnWelbSKX3tb2x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774107616, "uuid": "44f5fcb5-9a9e-4eb0-bece-5027708ae12c", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774107616, "uuid": "5acbf018-99f5-47f7-94a7-8aa407271146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774107616, "uuid": "cee75af9-d7bc-4d41-8c56-ce6c37893403", "value": "Java.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf134f0-2515-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774090936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090936, "uuid": "c496d6a6-bc0c-47b0-a0c4-aaecbcd33253", "comment": "Malware payload", "value": "4b972d7d765ee4d4378e4f16be71405b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sergio-Villafane", "colour": "#D1B35F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090936, "uuid": "e8f67106-971a-48ae-860e-4aeb544f17eb", "comment": "Malware payload", "value": "b3d22961a7a4783fa58d8c8fd6f3651c91ae623b4b082a0e8a3b3addc5bfb575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sergio-Villafane", "colour": "#D1B35F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090936, "uuid": "d2675c6d-b4ae-4e23-8cb8-bc530f6fa847", "comment": "Malware payload", "value": "505fe0424acbddc554e0aabe26174f8a2b62dedf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sergio-Villafane", "colour": "#D1B35F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090936, "uuid": "77c489d8-b138-454e-9dd2-592339355bda", "comment": "Malware payload", "value": "8bdb9c941f86f5f23692ac7a7dce1610cce9f1482f12879d32efa2e83f65d5c067195cc8b0e271c9144dc7428d5995d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sergio-Villafane", "colour": "#D1B35F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090936, "uuid": "a690b677-2cc4-425b-be48-9e2dad3e2040", "value": "T17AD7333BA54A253AE1FA427E3B769A54B87B7D6224438C5515F0CA0CCF260312F3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090936, "uuid": "4b1ba7dc-5449-4d55-bdb8-6a200759910f", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090936, "uuid": "5656ee6c-b234-4154-bb87-15f2b2c460dd", "value": "1572864:lBmK2KvUGsux4FvBe1XSZ6ajk6zznAFMfm6:uK2ksXlBe13aw0sGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774090936, "uuid": "382eb8fd-ef31-423c-bd5e-da23272c2a0f", "value": 62941944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774090936, "uuid": "c27fc5af-947a-44fa-9565-70d3a0e108da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090936, "uuid": "bcafe2d5-748e-48dc-b26c-c26833b0ddd8", "value": "b3d22961a7a4783fa58d8c8fd6f3651c91ae623b4b082a0e8a3b3addc5bfb575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6718f0e2-2515-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774090927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090927, "uuid": "8ce0651d-cb42-4a1c-8ba5-20f9231c8095", "comment": "Malware payload", "value": "d3d52e3b121cea45b19d1774389c5924", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Sergio-Villafane", "colour": "#D1B35F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090927, "uuid": "e1fa8556-8254-43dc-abfd-cb5c36d09f9c", "comment": "Malware payload", "value": "b40f5ba66686797e3bb726660c4cb9a8e063d403b80e0e7449772a446427e106", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Sergio-Villafane", "colour": "#D1B35F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090927, "uuid": "54140a30-0d7b-4b15-965f-1fd0093009b9", "comment": "Malware payload", "value": "6d3e12ad29d9bc77c4fb575ccaab3dd8985104ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Sergio-Villafane", "colour": "#D1B35F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774090927, "uuid": "8e10d2e6-eb90-4ce9-9178-697e6d35e1c6", "comment": "Malware payload", "value": "c41502c33b499f586948adae88a95da0cc7edc828c05cd919fdf28151999964dc02043b06ffa1e935ea2d6899b9b16d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Sergio-Villafane", "colour": "#D1B35F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090927, "uuid": "1fc9c5ce-5f85-4b4f-977e-d19c42b4ad22", "value": "T1F9D5AE82F7838161E8D7003911BAA77FCD3A99389B25DAD3DBD048B60D349D1267E39D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090927, "uuid": "e24e5498-ab26-40a7-9a9b-6d0ec0410a4f", "value": "d4a561eaf1c91b44a9a1fa4b67fcd6b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090927, "uuid": "07c15a74-b610-4d1e-85b5-9c49e79bf633", "value": "49152:x3RN+rk/rstkm3BD/YPAMZFkDpqtSPz2os34ZWOp27:x3RNIAWkm3BD/YPAMz6qt42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774090927, "uuid": "1c202888-a6c9-4fa2-81dd-e9cd269b7c8d", "value": 2827264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774090927, "uuid": "070de04d-fbb7-4428-818e-952d3dea1ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774090927, "uuid": "2b347e14-7e3d-4586-a501-67e493e70625", "value": "b40f5ba66686797e3bb726660c4cb9a8e063d403b80e0e7449772a446427e106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da57f80c-24cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774061056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061056, "uuid": "027b24de-cc48-4b62-bb44-e812ada28ecf", "comment": "Malware payload", "value": "213d5fe21aef6f1c1c773b31fa813029", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061056, "uuid": "961254c7-eb5a-4f61-acbe-0f1c28e8f7fe", "comment": "Malware payload", "value": "b4c2778d2cde572267f03ca25a1a3362e17c0798a4fa58a0827336486ae56e89", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061056, "uuid": "29327145-4e98-44a1-ab35-8c342368ccb3", "comment": "Malware payload", "value": "26fa9a8acd1670b5cf1dae743bb3e605f056c3e4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061056, "uuid": "566a65b7-93e5-495b-914a-580f27c6bbc3", "comment": "Malware payload", "value": "84d2aa10c9b981234080cad5c9f4990514988f7d84eedbcbeb0ed19fa56a9844c98d1a81f4dd278e6e0d2866830720dd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061056, "uuid": "a023168e-7910-4deb-956e-46374db4c697", "value": "T1BBB523126EC8543EC532C230DAEAFB6D30EB6FB74FB252E567F4F6898D12251192215C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061056, "uuid": "6aae9b46-41b3-4e9d-bdb6-a689a105221f", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061056, "uuid": "1a686487-543d-4a44-af3f-9729d72f556a", "value": "49152:laQuR/7TU8ip2tuxZLvffY8iU4pTWoWQKJJdcs9OYhRMW6:Ro/fi/7XYf7Jh4JnnhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774061056, "uuid": "57eb0b5b-fcd0-4f96-a314-13c033ed748a", "value": 2393088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774061056, "uuid": "227a353d-2e96-4276-974c-11d94a0a3f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061056, "uuid": "0c1060cf-4657-4787-883c-19c642a52a57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95eef02-2581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774137505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137505, "uuid": "63421180-9d3c-41b6-89cf-1497675b6da2", "comment": "Malware payload (Mirai)", "value": "064da4431da5f1cd7d865fd0d92622a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137505, "uuid": "f0315924-55fa-4e75-880b-937b7034fb9a", "comment": "Malware payload (Mirai)", "value": "b5075b32c463ab733ad2eab71c6419d41638dd4243f2fe223c21e6249a476794", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137505, "uuid": "fa1a24da-3e39-418c-bba3-1c387667c85b", "comment": "Malware payload (Mirai)", "value": "c6e5adfc43f43fd3ba01e7570f1168cc6f72c57c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137505, "uuid": "233da91e-18a4-49f7-93e1-3db12d318675", "comment": "Malware payload (Mirai)", "value": "11f39287deaef2a32f541e2c395b3a631c21d48ccca92c4f8e751ac68c6a0132bc5b50eac4f62d0869fefb61f7474419", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137505, "uuid": "49e387ca-94a1-4ebf-8e2c-4439015a87f7", "value": "T1B4830985B8819A21C6C512BBFE1F018E3313576CE2DE73129D245F6477CB96B0D7BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137505, "uuid": "314af2af-74c0-4073-80e8-45b14af69430", "value": "1536:ponINLKq2jgaEPA2LyJczOyAMK19LrbnV37Mjii/Byhcya79QFt85oYZ:3Z2k/PrLysnXKXy/Byhcya7aH86C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774137505, "uuid": "a577f344-b794-4064-af8f-637ec77603c8", "value": 84348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774137505, "uuid": "e7e67e31-3739-49cc-9d67-2104a895a80e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137505, "uuid": "b0966c59-fb31-4378-ad42-7036e6e4d482", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d126a8d-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054081, "uuid": "c4a0fafb-5029-490f-bf9c-244d2c00f942", "comment": "Malware payload (PEASS-NG)", "value": "bd418c1d53e45d8c7def415d35997943", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054081, "uuid": "b4713184-6f76-4b3d-8888-c4361113f41d", "comment": "Malware payload (PEASS-NG)", "value": "b6515c15163a47c55309b9a7c1519bdd15448217c3464203b78347eeaf1aaaec", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054081, "uuid": "001e5ed3-4566-4ba2-b027-37b8a8253d83", "comment": "Malware payload (PEASS-NG)", "value": "03e01a469f08450661d2192510bd158394287bf3", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054081, "uuid": "19204444-0e6f-4ee9-99ad-5767ceace192", "comment": "Malware payload (PEASS-NG)", "value": "c1b5896ae431d589816ccc039d10c7b4063c417fdfe55b91f8d9ccfbc0faebbea51d6d9dd161260f5a8748f30aa15dcc", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054081, "uuid": "606181e0-2076-4b56-a106-973960e0495b", "value": "T16706BF99BD9C3D40DE896A3E5FF905C1272DFE4F2F428717391473AA26F22098E95234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054081, "uuid": "9fcf8762-abad-4d82-b0ad-cc4545179c03", "value": "49152:DZ1lK6gNrhWMv/pyJO0hnsVpx3/ZXPImKixHs:l1lK6ta/36R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054081, "uuid": "d686f554-02ce-45fb-b450-4be5601b6230", "value": 3923737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054081, "uuid": "a6a0f61f-3b97-4c19-87b6-b2149c2f3d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054081, "uuid": "a0aa2288-b985-4119-b364-ef1cd1b58b0b", "value": "linpeas_linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56280858-250c-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1774087034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087034, "uuid": "95bbc01b-5412-438f-8d11-2260be3066bf", "comment": "Malware payload (CountLoader)", "value": "1dbfd10e72524dc6e6e316d07b708d09", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087034, "uuid": "01fa28ce-fcd0-4738-aa25-eeb85adb6ae0", "comment": "Malware payload (CountLoader)", "value": "b9f1b9abb8eb356cd23a1c6dc0a393226d5bf368984f48f5794a35bfa77250a2", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087034, "uuid": "d57a781c-688f-4355-bb7d-a8125308830e", "comment": "Malware payload (CountLoader)", "value": "ae5a6d3459037e29f30173ce7e9edc02e90ff661", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087034, "uuid": "7cf0c2d0-b39a-4cc1-8c17-f2600717fb5e", "comment": "Malware payload (CountLoader)", "value": "f0a04d664aee383dfb079b902a3b574fa7f1ac7407cd06ddc843878e4f1692a2c7283d8f2c4e782dcce325a0cd999076", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087034, "uuid": "1f5b54bf-c612-4b3e-b293-d4c19b304a46", "value": "T1C8B3538A5D8EC1F88B4FB027995F5D8BDF996A032A1EC080B69F5D407F21CF8746A5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087034, "uuid": "5383ab43-05fe-4ced-bba6-14629ae1d5e5", "value": "3072:2AcCW6+P+qew93LklbXvlDNBvuCgA1yocVlIy3y77rU4d/TwIH2tYj3hFKkCFN3V:cqA8/TwIH2tYj3Ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774087034, "uuid": "6c78fd44-f995-42c7-9ea6-c348e655e1ec", "value": 112510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774087034, "uuid": "cc9bb81d-d269-4546-83e5-dbda53364551", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087034, "uuid": "68912d39-1af2-4627-8fe5-39c8b50646de", "value": "Work_Backup_Backup_6461.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2da7d20-2543-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774110785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774110785, "uuid": "fd9aaca1-ca1e-4e57-a12a-7c6f96a1aeda", "comment": "Malware payload", "value": "6f652deed6f96ca23fe0f4aeed084c18", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774110785, "uuid": "6278b6cf-9373-4dff-b6b4-9fefa8a94157", "comment": "Malware payload", "value": "ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774110785, "uuid": "d7bf13bf-251d-44b6-9c6d-c0ab1fef2ad4", "comment": "Malware payload", "value": "407a9172f0c96071b0f1f4b8f9956a630fa3ca1f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774110785, "uuid": "adfff9de-44de-4b19-bd84-0bedeb931c04", "comment": "Malware payload", "value": "64b8f167675bd985abf5f72bb37717b201a9838c560db6e772fe69ec4998d2aabb4b9409eb04576cd42ac66f9e5e268d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774110785, "uuid": "3ac0f82f-010b-43ab-a965-a1a33a90c0b8", "value": "T17E358F16A6A401BCD5B7C1B8CE668943E371784A0331AADF17D09E662F176F09A3FF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774110785, "uuid": "b63bc44d-f5b1-4cf9-933c-fa24ed228291", "value": "4e29cbd183417e9681b8a8d2108c3d5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774110785, "uuid": "e750d824-a7af-4a59-bf18-5f98ca513464", "value": "12288:kWhvoqZAH9XS1HEpjAERkUOfu2rBQafbdh9p/MCwxOZouYZ8T/geHlw8yF9nOkWP:9hTadS7gkUOfu+bXhiuC4vw8OOk8TAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774110785, "uuid": "e7f9fc63-6f4d-447b-b0ca-322c07d7ab5f", "value": 1072406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774110785, "uuid": "049ece1c-a1f7-4690-9991-3d5f67f408b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774110785, "uuid": "8a8c6b66-22c8-42a5-a8db-5f887276a68d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b512fed8-2529-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774099648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099648, "uuid": "3ee9bfe0-25aa-4f9e-9f70-02542b6d4896", "comment": "Malware payload (Vidar)", "value": "fd9c6a458bd6bb39838f6c421cb0be79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099648, "uuid": "21f51f6c-109c-4f4c-98c5-fc2e428a011b", "comment": "Malware payload (Vidar)", "value": "bb5ef7c60e6687d4175130216c0ea72f1d83e211d79c9c9e08882643419ea6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099648, "uuid": "e92a9c74-192e-48fc-9d66-6a4716f496bf", "comment": "Malware payload (Vidar)", "value": "8d25aa2a51e5f333175392cbec4e50a4d6d12ae8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099648, "uuid": "ba074cc8-8f12-4f9b-8a51-95fc58000b3c", "comment": "Malware payload (Vidar)", "value": "5b1948a474de38ecdc6538faa4fff79f01ccdef4bac42a70485ac1507dc774f502172d43f9cf92ebf7d0cc47b23da10c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099648, "uuid": "448748ad-7457-45a9-a375-6b2b7465992f", "value": "T1FCB56A0BBC9808EAC46A97B188B745923B71BC190F3223D75F91BA782F72BE45D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099648, "uuid": "af9021f5-87c6-4376-b98a-2ab53d008c43", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099648, "uuid": "22d34446-20aa-4a62-b392-598de4f68108", "value": "49152:z6vBnzZUo79U8+lO5MNJTx9fqB22vcz/SbBMli4Zi/Oa3:z6pNNglTxRqLiAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774099648, "uuid": "7e3e7a9e-9084-4dc8-b3fb-38ab8b61574f", "value": 2415792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774099648, "uuid": "7e454b3c-6c37-4c6c-be4b-8062af4f7417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099648, "uuid": "1f7ed4fe-df44-4dc5-8252-e7e8c0de97fe", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a041a69-2517-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774091657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774091657, "uuid": "2219383b-18c2-4cd7-81cf-fae914fab37b", "comment": "Malware payload", "value": "695330f61e6f14660037910713b70ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774091657, "uuid": "ba23fcda-2b1b-4436-9e5d-c1a4c0963ded", "comment": "Malware payload", "value": "bc8cb64c089415ccc2bfd9d29bf74fe06ae5e3b0493a336412184d20ac774604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774091657, "uuid": "da87ce47-5a2f-425d-b85e-8a0f4d5e46fc", "comment": "Malware payload", "value": "8e8dd64a340979572cee835cfc77671fe49334dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774091657, "uuid": "3011cb09-aa1f-4ec7-9099-3932a78a3c84", "comment": "Malware payload", "value": "27c4497cdde45250099b2d1b5bbf2d8c73ef92c5d19a26eaa09abf689fcce64f2c98fafef9b6279fcc2d8baadcf7674b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774091657, "uuid": "2852db45-8839-40b3-9e14-05ff849162b0", "value": "T1C6E733457B1047E1F0799331698D960712EBADF50748EC8963F17B1CA6C2FC2AAAC778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774091657, "uuid": "961c9707-aa75-4b67-95fd-8df7de92ff19", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774091657, "uuid": "85dbe412-7d25-45a3-8546-3000834b94a0", "value": "1572864:o/dz6elZ7+oMz5/RJx+E4Rw5eHJd4c4qinG:o16ttzx+E4i5eHJj4VG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774091657, "uuid": "07d64399-5110-4a25-aa07-f076787c23db", "value": 70059608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774091657, "uuid": "638f6b91-0563-4e61-936b-f556c7feeb48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774091657, "uuid": "9a7a5547-8dc1-4692-8061-9bd9a22f0329", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb2d7ab-24c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774057382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057382, "uuid": "602e906b-8237-449d-92b4-0bb52beb3993", "comment": "Malware payload (PEASS-NG)", "value": "7385052af1923788ca11bb807bd200a2", "object_relation": "md5", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057382, "uuid": "27d18d5e-7781-428e-971b-037dc980f74c", "comment": "Malware payload (PEASS-NG)", "value": "be7cddb3f5dc0aedcd2b4fd1607af7ddd86b6d2edac2394f30874cf5d3ea7da8", "object_relation": "sha256", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057382, "uuid": "b4809a12-fd18-4dc5-a7d9-699a721394c1", "comment": "Malware payload (PEASS-NG)", "value": "db3280b90d15de8cade18f5d1a46106617e47035", "object_relation": "sha1", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774057382, "uuid": "7f04aeab-8bd0-46a7-acd8-526ee9634481", "comment": "Malware payload (PEASS-NG)", "value": "a4b8097fc40339546f82d1dad617f9edb23525f17f869c45cdcf09cc0f093a94e5efb83b74a5f3a689d305b414569b98", "object_relation": "sha3-384", "Tag": [ { "name": "20251212-32615dcd", "colour": "#FF9359", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057382, "uuid": "fb38171a-1a7f-4688-9112-8ebe3a76a840", "value": "T12D06AF59BD9C3D44DE896A3E5FF505C1272DFE4F2F4287173A14B3AA25F22098E92234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057382, "uuid": "144ca663-2f74-4737-8ec8-14bb7ed28863", "value": "24576:RZ148KXKE+2ZuvszXL696o8SA0s5tEnyVu3jyV+6WYbqBs8U1hoO0+y3E2n96Vzy:RZ1lK6gNFVhmO0hnsVpx3/ZXPImKixHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774057382, "uuid": "5c0e19c7-c017-41a9-b0f4-2961e220bf77", "value": 3923737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774057382, "uuid": "92c67423-fd35-44b3-b4f2-ed18dd6095d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774057382, "uuid": "899bf199-96f9-4697-9c9d-f36d06fd9110", "value": "linpeas_linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b1cfda-257f-11f1-a769-42010a9c0008", "comment": "Malware payload (Fuery)", "timestamp": 1774136504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136504, "uuid": "560d9e16-a182-49d8-b120-13bc356d356b", "comment": "Malware payload (Fuery)", "value": "df57675a5d6cc317e216a9183035c080", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136504, "uuid": "2a1dea4e-1249-43a8-ab33-788089405857", "comment": "Malware payload (Fuery)", "value": "bef91f1e5dfeb2029ac4ec450cec86ef2208d41c3d7391e997873af5a7f56cc9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136504, "uuid": "fe1745b1-dc4f-42ad-a813-da30efb4e5c7", "comment": "Malware payload (Fuery)", "value": "512493f0b84103e63a4f48d07b343c90152f2b2f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136504, "uuid": "aeb177ba-9f24-4c98-84fe-3c5782c38b72", "comment": "Malware payload (Fuery)", "value": "21ef0a2db8090ec89c067311e937c5864d2194f11a27d027b3eb7ac7d121521509745c6b7aa62afc3cd6f2726969c17e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136504, "uuid": "68e30fc6-715f-459b-8cec-e0066c70754c", "value": "T15525F11933A9E942C5A16FF45D71E3B817B45E586811C303CEEAFDE7B929B0638442E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136504, "uuid": "821a4d8b-5bba-4c8d-b29d-6eb590fb6eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136504, "uuid": "bc63f630-f13f-479d-ae85-0c26d0e82a5e", "value": "12288:yiMBciNB6RJ+Y1I/iZ3xGh0Cn4ehcURnlQaa/u0l8knXzrpLOZNA19cuejZmkFww:BSciab+UI65CniUhlzZknXxOaeAix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774136504, "uuid": "f696f8b2-8737-4da5-b449-2697c6bec6c3", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774136504, "uuid": "1a77f4a4-f6d8-46c3-81e8-1bedcc628ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136504, "uuid": "f9fe04f6-eeef-4dac-a6ad-cf6938c7d2c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998a04bd-255b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774121077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121077, "uuid": "324ad5ea-980d-4f39-903d-11dccfaf4718", "comment": "Malware payload", "value": "230bb9bc6687bc4b0bc05e017d339a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121077, "uuid": "6bc9b891-8080-4837-8275-7dcbe148770c", "comment": "Malware payload", "value": "c1ad5175c7bab5034190059579712b2d38bd010fec191b00a3709b54cd446967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121077, "uuid": "b0ed5871-d089-4f7a-8c71-b3b03a29a9f9", "comment": "Malware payload", "value": "4af59348b12fe40250fb3f4c36ae3f71204b4ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121077, "uuid": "7ed4c84d-c5a2-4ad6-948b-3563973f3198", "comment": "Malware payload", "value": "56ff3d80923896e58c8e803b89f6331aeb1e034dc2bdc499662227385ffcd6a9d7c78197ae2034395401ef451630b6ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121077, "uuid": "d14ec26c-819e-49e6-87f5-a5beae1c2e1a", "value": "T1B5C3024666812DFED5436332C35A87F6F630958047720FBF8624C9396E108D8EEAF679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121077, "uuid": "dccce751-197a-4a47-b94f-9844d12b96f3", "value": "c1f4358211a66fe3d457f3e6f5983347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121077, "uuid": "8ec63c75-0b1c-4278-9238-c876159f1d28", "value": "3072:RVJxf4ZIk+bV1YvW8hMtYxLK5B2xS9aAHyYfP:RxoZv9MudK5ubAHfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774121077, "uuid": "795e5361-e36e-427f-94bd-fa8f12cb341e", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774121077, "uuid": "e0d2848c-dac0-4a3d-820a-b3f31d55ae17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121077, "uuid": "56df09bb-38a3-41ff-9fca-57781abeb738", "value": "old.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ce4acb-250d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774087536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087536, "uuid": "38c1597c-f980-4fbe-bd61-4384c684ac8a", "comment": "Malware payload", "value": "21aa6f7a687c2550c6c7695303fecc4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087536, "uuid": "68613d49-2981-44fb-9b84-b3eb77bbc448", "comment": "Malware payload", "value": "c2c6b9a14da43274860623f1048da9d377469950b219583f99d2dbfd1f232118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087536, "uuid": "ae455409-5d6d-461d-ae99-812cdf7496ca", "comment": "Malware payload", "value": "39b85b9a8cd5fe762e9cea679c038c4d096671b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087536, "uuid": "67234b78-d3db-491e-af5f-540b11ed7510", "comment": "Malware payload", "value": "eaf7595a0d3f2b6538117082222a807b656fa2cfa957a1dcdfaef28ff1eedcec21579142512589c284721b5d202bbf14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087536, "uuid": "ecd9fed6-9f6c-4a76-bf60-2ffa5bd7d063", "value": "T1C9579F76AFC82599D416C935B733A222C1727532FBF7A0CB365612073A76AD15B3AF00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087536, "uuid": "01e8c791-7b70-47d6-acbd-46bf1f0bd210", "value": "1f933ed263d09ad8837714c8a00e0a3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087536, "uuid": "e33f078c-a451-48e9-bccb-022669157b1f", "value": "98304:yiAfrq3hJhPQTUaG5InEP9tl8XZxnNqOoDsCF0C8:yIYdEVT+jngOoDsCKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774087536, "uuid": "7a91addc-c69a-4adf-976f-36bfb879829e", "value": 27228160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774087536, "uuid": "72dc03a8-e007-48fa-aa67-90055b7aaa77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087536, "uuid": "85379c0d-f62d-44bc-9d12-c144bad0aa39", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a86d68-250d-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774087335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087335, "uuid": "f532ea6c-323b-4e61-9b78-73e2adb9d495", "comment": "Malware payload (Stealc)", "value": "0fedb84e76d5583a07ddb44382efc399", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087335, "uuid": "93276d25-f73a-4eae-a332-a6c1d522c070", "comment": "Malware payload (Stealc)", "value": "c32b298386e0ba3eb82f90921e64fb9acbee3be9398a75f28bf0fd6302665a3d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087335, "uuid": "17e20b52-1727-4fce-b9fe-fbb488dbdd30", "comment": "Malware payload (Stealc)", "value": "e85506a0d4b5c65ac9a0ed3fa09c2a541f6ab2eb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087335, "uuid": "0f812544-1711-4ecb-9aac-135dbd635cf5", "comment": "Malware payload (Stealc)", "value": "ab4bd5f8cdd41b2f09081e56d05bd2ffb93cb86cdbf32e96517445493ccd235680d2cb4b2e56209ce5f0327ec2cd91b7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087335, "uuid": "9d925640-cf83-40e7-8cdf-87c9269956a4", "value": "T1FFB423108FC85909C56928367CE6DF77CFE2AF236844269D24C7EC473A67B84150ABF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087335, "uuid": "6c444c20-b9a4-4cd0-a2f8-0f9c03f60e37", "value": "12288:YJ8HD8qf8n6joicHgY5nmkIBtGMcoxmpxi+YCvYSHxz:1vR+AY5mbBtGMcoQA+YYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774087335, "uuid": "b983d738-ba2e-47b2-9ddc-bd5cb06d1408", "value": 518880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774087335, "uuid": "e33533bf-76a6-4e6b-9c63-64b2a71578ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087335, "uuid": "32c6ccb2-aa7d-443e-b35c-49aba3432dfa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ada6ace-2509-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774085860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085860, "uuid": "be222230-765f-4cb7-b2a2-a88e2935bf46", "comment": "Malware payload", "value": "24456588ab71d2c5af5ddaeb9816f01f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085860, "uuid": "2a239866-0b3b-44fa-832d-2a623a74e3f3", "comment": "Malware payload", "value": "c3bacca51fe3ed818e05d6f014310e3897027f03fd134e21a0c442831b97452c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085860, "uuid": "38a786ee-f2f8-44c1-8a3a-2258cdd3e870", "comment": "Malware payload", "value": "27ae4e17cdb3edf3cd2e5bc467d9811ee2b9c8c6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085860, "uuid": "8462829b-6cbd-4266-a03a-c9dfa7b72b64", "comment": "Malware payload", "value": "2e49342a25e48f6350c748294b69e2e70483fb1edca6b1f96fb5ecbbcd1cf3aeaecce503beb8985d99fc18909d4d5926", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085860, "uuid": "0c10babc-272b-4a5c-9326-ce7989040213", "value": "T12406E123AD9BE429ED7784F351C6D277742B15A4AC0B92BE03905EAA4B70C4B0351EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085860, "uuid": "41b1d9a6-c195-4096-bd21-5bd7a8b7c704", "value": "49152:wqDAkxrbtpwHbFQ37Q5u7JEBPuJgCS6hij5A0exH0mATQRgrEogxph+IPvUCV3:wqvwa7Q5Aqu20kl1exU+RoTEhxU83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085860, "uuid": "5b720aa7-15aa-488f-8b61-ce23f139a922", "value": 3776678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085860, "uuid": "c0193946-d847-407c-8d23-da52943c623e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085860, "uuid": "0b10475b-e4a4-4751-a06b-f70c9f0d1441", "value": "Module.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e12e59d-2567-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774126024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126024, "uuid": "eda79479-fffa-4f97-b148-f7aff8809a84", "comment": "Malware payload (Mirai)", "value": "4eb9b2f4fe095778a69041118ba5e418", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126024, "uuid": "d39dcae1-ebf7-4b83-971f-e2a5e54cd03e", "comment": "Malware payload (Mirai)", "value": "c464feec58877073da2b7e628448b1c469eb0bebd1d83aac51554a14db903a42", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126024, "uuid": "efb26533-b92f-46dc-8afc-cf25e7da2673", "comment": "Malware payload (Mirai)", "value": "6335c071600b1f758b860d9677904d750a4d16e3", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774126024, "uuid": "5ad218b2-2379-4ff7-8a42-bd040513f12c", "comment": "Malware payload (Mirai)", "value": "8991d43b5af70bbc1da5bdf88baea1cab1c295b741fec20633de705b42a942769276f50ccd66da9e43da6cf105a88e12", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126024, "uuid": "5d99faf8-5384-4720-8f5e-0d1f421f06ff", "value": "T1F3142B5377224FA0D366C5720BB78B5A59EB02811EE298D1936CCB107F207A9285FFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126024, "uuid": "58aa7e2e-ad7e-4b17-8e93-526e27fd5c13", "value": "3072:/CbyN0CLFHOKZFZgvxuxSZm/zr5T99SI03RHBnlbLzD7tBpa:62NVLdOKypuxS05T99z0hhlLztC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774126024, "uuid": "6e6636ef-4abf-4937-b263-2a1a50eb07f3", "value": 205240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774126024, "uuid": "77f0cd43-a153-4974-b3b9-1c9c3d7210d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774126024, "uuid": "79036411-a015-4063-9db6-2154b4ec06d1", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d04691d-2536-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1774105003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105003, "uuid": "15430e35-02e3-4631-b872-c7a04df82096", "comment": "Malware payload (Hajime)", "value": "1b481bce293e69c64615c3892bb8bf02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105003, "uuid": "4a7ec118-fc43-4cc4-8316-d0c3ca72ea43", "comment": "Malware payload (Hajime)", "value": "c60ebb9e82e45561076cd3724dc1789e6e82c7b6823ac52a0d1cc453d558021d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105003, "uuid": "e39a852d-3ea6-42c2-ab66-60a7ee751b63", "comment": "Malware payload (Hajime)", "value": "8e2a6efde07a116b61dda90eacd6d62c2c6fddb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774105003, "uuid": "a7093598-e7ce-421c-97dc-f0b6beb18814", "comment": "Malware payload (Hajime)", "value": "d86ec8d0c2bd4e71bd161a51d94b73888e10d17364e48cd597fe0d5e07678484ca973bd668010ccbaf66fdab6f427584", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105003, "uuid": "a76c27fd-3a38-46f6-8b93-e0591346a61d", "value": "T10C831229135924A6E62240F1E3FD1B84AE591F69CEE2EC046811BC99DE333AD2CD6618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105003, "uuid": "4a8a5ca7-435a-46fc-89d1-11b19e4e6935", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1Vb:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774105003, "uuid": "734ff7d8-cb11-4718-bbd9-a72864a34a34", "value": 80940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774105003, "uuid": "afcc67ae-713e-41f6-b9e9-53e8cada8b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774105003, "uuid": "fa661bad-cd76-4886-8549-fd3920d26898", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66972364-24da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774065586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774065586, "uuid": "10adc833-9512-4a0e-8dec-f536d29185f5", "comment": "Malware payload", "value": "392f7841ad82cf15196fcd7495ad3757", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774065586, "uuid": "2829ef35-73d0-49bb-8c7a-b64dd51ea365", "comment": "Malware payload", "value": "c65fec25ba99dafc58dbb0a42836950638da6b3bf535ff8b6d69187f0409ec87", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774065586, "uuid": "95631640-e98f-4a1b-8f63-2016ee2e16dd", "comment": "Malware payload", "value": "9d8711aaef5c756101667e95865c58542df961d0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774065586, "uuid": "436284b2-eaf8-4f6e-a111-3e707591ec6a", "comment": "Malware payload", "value": "fdae99f79fa2d712bfc9cd821a48ad670c80272ccf9e8cb61fe3a9ed5cc5177d3baf32effe5877feedddfbfa1862511c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774065586, "uuid": "c6c0f795-7613-4bcb-87a4-a74e4405341c", "value": "T1DE925CB512896C79FBD0DE399F3C7F4CADE8C2C42124A3ACBA4F39215A1166DC605349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774065586, "uuid": "b56349d1-3b2d-434c-ac8d-303fc8eadcaa", "value": "384:7FcuQpWx+BL0SWL0g5zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:7F8i+BL0SI0mzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774065586, "uuid": "1742a279-c33b-4883-93e9-6df7a505b29e", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774065586, "uuid": "a9fb82bf-1cbe-42e1-bae8-f51c4c4aa48e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774065586, "uuid": "7c6e223b-6ac3-4dce-9a5d-c3c739de3d8d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be71f816-2507-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774085061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085061, "uuid": "ca6d19dc-be60-4e6f-bc64-a385ab5b40ea", "comment": "Malware payload (RemcosRAT)", "value": "fe73058d9b3078e24b6c18583a36e0e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085061, "uuid": "cc120600-ce3d-4fcf-8c4d-2fdfc8ab76e1", "comment": "Malware payload (RemcosRAT)", "value": "c802568939fc9ef1bc415bab56245407e0d56756c6d20aaa6987cdccea0b6394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085061, "uuid": "eb14a775-9ff7-4c10-aa33-e412830a896c", "comment": "Malware payload (RemcosRAT)", "value": "8b74c48beffa1478cbbfb841bf3474abf84d1f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085061, "uuid": "edbc7ec1-f032-4d8a-a46b-ec3e279fe124", "comment": "Malware payload (RemcosRAT)", "value": "a3e5a0ccd52ea6675325bff55314e88f1c45dd038a50afd766704b5b6a614b968471ee79e60e93ea6947df56b10f4855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085061, "uuid": "0511ee32-20f4-4e66-9c79-f426f24516e3", "value": "T134667B0A62EA41E9D0B2D138CD5785ABD672BC554B3297CF0571BA0A6F3B2D0CE39731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085061, "uuid": "e17ace81-a683-4f3e-bf18-37abc992bbdd", "value": "257670f56ff8877f9177ae6446e88b54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085061, "uuid": "2163b499-0c94-417b-adce-84a9c07624d8", "value": "98304:HwHr+0rPe0NY/OansjNTkTFJ9Nyzp0BMD:QLlhNKOansjiTf9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085061, "uuid": "b9716fb7-bcb0-4400-ba7b-a22e9d9e3257", "value": 6870584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085061, "uuid": "485e8a97-2e9a-4fae-8c40-8331408dbc06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085061, "uuid": "421f9724-bc4b-4d99-a63a-335f1724d304", "value": "c802568939fc9ef1bc415bab56245407e0d56756c6d20aaa6987cdccea0b6394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22517c4d-2529-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774099402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099402, "uuid": "60891ea7-c7ee-4fd1-9161-b25503ed2978", "comment": "Malware payload", "value": "1f34933193b96860f75405b21da7d8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099402, "uuid": "fa412772-24e4-482e-ad47-cf168a2ee9e4", "comment": "Malware payload", "value": "c8f0a45aa747d9d1a3143883589a648cc8428431a57cc8f93a149c2fb45443b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099402, "uuid": "82833852-c127-425b-b9b5-d9a1b1ed8a21", "comment": "Malware payload", "value": "753a1100076d74269265f7a66f0e04132c6578b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774099402, "uuid": "dbd0b5fa-8dd1-4afc-822f-5252d2d30127", "comment": "Malware payload", "value": "8808a9a40f15b382f0f28245612246c24f17301bb2bf97eaf2fe91efa7de2d0708e72a18ab04891ca364defcb220db82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099402, "uuid": "9d89cba6-2bb9-457b-aa1e-19128f52a52b", "value": "T18D859EC2E926291CD8E7277F7C930BF726C84A8743BDED9065F5487E866D84D42ECA40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099402, "uuid": "077933b7-d312-44a9-a1e8-578fa55b5036", "value": "59cf6205f0d55e08de66f73ba4498e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099402, "uuid": "72231f38-a914-48ed-adea-69171d059893", "value": "24576:n5D4Jmidd3TI9NlAycMYfWSnbh0XUVstTSkNKj0qm7nRms1CLuGKdUbCjhXNBDk4:5DQoH0bnV5guSj/C8ibCmWkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774099402, "uuid": "494434b6-1fd9-418c-b2bb-72bbe9fb9656", "value": 1823564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774099402, "uuid": "31234a94-5e48-4f82-a783-7168b1ff5737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774099402, "uuid": "2095f9fa-d177-46f8-88d4-f1cfb2c6df67", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815182a6-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054035, "uuid": "21f7c470-887b-4027-9e96-163f4dcaf40a", "comment": "Malware payload (PEASS-NG)", "value": "69ae7a769598bb11692085a575c5eb78", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054035, "uuid": "4551d4cb-f760-4b07-9485-b0c5de19d5f4", "comment": "Malware payload (PEASS-NG)", "value": "c9e5baefd4916b4cbf73c45fa89d7458f00dee615a548d7f7a9c04bee6544ebf", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054035, "uuid": "819cdc42-e88e-4587-a909-76fe22cb84e3", "comment": "Malware payload (PEASS-NG)", "value": "fe16a1cc58b2b20324d994659f92afc8a7806094", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054035, "uuid": "350f3e82-b9f9-4fb2-b5de-6692d8173bc8", "comment": "Malware payload (PEASS-NG)", "value": "48d157846e8e56e2b91640b0a8d04be5eb5e39a47fd20ac27c2618c48a56055e4090cc12674a1121ecb1306c1c63b2d2", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054035, "uuid": "a20c285a-3453-4cb5-b2bd-dd838c342a25", "value": "T152069E0BBCA02590D52A533B49EA59C22F79FE4B2B3217D73A40B3B52F726D254F9314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054035, "uuid": "7ea9e06f-b519-4466-8ea9-d7da3a3f039b", "value": "49152:77x/ogdtO+aGrhWMv/py+f9Anl8lD6nxKl2Qfeap4tEX4gSfh:77ZHOpo9A+snx+tT+Ndfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054035, "uuid": "5e08c68c-3708-4e9f-806f-29e41a8beadc", "value": 3794432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054035, "uuid": "7aa18a19-43c8-4530-82c0-b5d25f332a72", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054035, "uuid": "f6d1850a-a41a-4745-a773-8fef76e7831a", "value": "linpeas_darwin_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52f0559-24d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774061504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061504, "uuid": "94bf8aec-348c-4c77-8dff-06e84f6aedf8", "comment": "Malware payload (Mirai)", "value": "546b1cbcb2ffb3f62e78e5f13991a962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061504, "uuid": "4db58e21-9bb0-4ef6-89a7-410012f59c6a", "comment": "Malware payload (Mirai)", "value": "ca5dfdcf9fc3bbe9e3e937e89870aa01f2354717561229b37b22bb41d125d9f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061504, "uuid": "f62f4848-9d69-484e-90d2-48c5656af247", "comment": "Malware payload (Mirai)", "value": "0f3f3e4a22abdcaf40e468fbe190fb0a824cf539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061504, "uuid": "d87db362-8df8-4532-ba41-d0850455002c", "comment": "Malware payload (Mirai)", "value": "eaaac9feeceabec3fe1796c2a9b5f21b0b757c3e378050fffe11346fb902f2da6496baddb1b3ad3ae3dc4837085a8b53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061504, "uuid": "c4aee16d-1515-4b73-a6e4-5a92b0f88f55", "value": "T17204A71A6E228F7EF668873447B74A259B6C33D627E1D644E1ACC1105F2029E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061504, "uuid": "1679cb73-a300-4942-8746-6984124c92f4", "value": "3072:fl+quvEVTAcFvV7kVnEtRA6T+Ig1oJGvw:QqfVTV7gD6TS1o4vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774061504, "uuid": "7098d2b7-55a6-412f-b7e0-246a6b93d10a", "value": 177895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774061504, "uuid": "80dff4ca-bb8f-491a-b063-6f8e8b2a7e58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061504, "uuid": "e3e90124-7e80-4177-af39-f9d564aa1646", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bdb46e-250c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774087040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087040, "uuid": "6ee9210c-7370-4cce-9dba-bbaee6be6349", "comment": "Malware payload (RemcosRAT)", "value": "c4139e62e626431e70d48e074003ab44", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087040, "uuid": "dbf96914-f137-4d3b-b152-c389cf9b6354", "comment": "Malware payload (RemcosRAT)", "value": "ccac0c0dbe55becd51595d6cdb334bbfde05be85c131515773046c83eb73d354", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087040, "uuid": "f1cd7eda-17fa-4c2f-9be3-e21b7fd66631", "comment": "Malware payload (RemcosRAT)", "value": "35fa1359a4a0840867acb4f31a7b8e074148cc8c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774087040, "uuid": "ac5691db-6754-4cef-907c-b482d41fb7a5", "comment": "Malware payload (RemcosRAT)", "value": "bde4a100f45da36b0be9ef163c5dabc133367fcaf01184b1ef47a8151150dc04e177362740b3beaf5dc9ab7942658aeb", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087040, "uuid": "21298992-239a-4e7f-9863-357565251d75", "value": "T11C667B0A62EA41E9D0B2D138CD5785ABD672BC554B3297CF0571BA0A6F3B2D0CE39731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087040, "uuid": "01d75c7f-3dff-4ab0-8485-7b3e909d3b2f", "value": "257670f56ff8877f9177ae6446e88b54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087040, "uuid": "3270c139-7c96-453e-b26e-8db7a59c47e2", "value": "98304:HwHr+0rPe0NY/OansjNTkTFJ9Nyzp0BMy:QLlhNKOansjiTf9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774087040, "uuid": "5f7b6e2b-e57c-4e42-9878-0a259de1e523", "value": 6859264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774087040, "uuid": "9a4d0cd9-5a1f-4a1e-ae88-34174cea81cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774087040, "uuid": "14d92f42-d563-472e-bb5d-25484397a94b", "value": "32c91fa59dce3485c44bc97704bdb0448ab2f3aa49f550170ed0511680ea79f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a879702-252b-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1774100328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100328, "uuid": "26813a82-687c-43fe-8630-90731425018e", "comment": "Malware payload (Arechclient2)", "value": "ba7d7d661005975a9ac98c3d8c372ed2", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100328, "uuid": "50ecaf30-894f-4b8a-8349-037011f4c446", "comment": "Malware payload (Arechclient2)", "value": "cce83a10dd72b220c9123d609d0bbd9cb0bf7af430b83e85c0fb10cad607aa30", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100328, "uuid": "b7fdb19f-7cfd-4973-b049-ca87b14af203", "comment": "Malware payload (Arechclient2)", "value": "c9ff08658de6d985bfe5641f4ab03d716dd77a86", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100328, "uuid": "f534b2cb-edf9-4393-9027-ed1c547bd7ed", "comment": "Malware payload (Arechclient2)", "value": "adf64890ed3c3f072f0a227363b48425c286cc2e7d18ccf0f7d80c7d1d23471e69b63f0c081d366b9421f50e18cb4411", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100328, "uuid": "76e90666-9d97-4f94-81d6-f835d738e3f1", "value": "T1B0155B6C377BA922DEDC7F7590FF5F0CD2A49EAB82825146158DA8D40FD9319A34CB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100328, "uuid": "94ab469a-0ecc-465f-a525-5d5170a0a544", "value": "12288:rrbT6W0Nwyer1yEm6+f1ucWF64bOPZL1cjz9DB7UNVKDSIKA01r:Fyw1yH/YU5RLOMNV43S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100328, "uuid": "7f1dfb68-834f-4c20-8a51-6c235d25abd1", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100328, "uuid": "74fe22a9-a4c0-49d6-ab1f-607e1cbf14c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100328, "uuid": "438a5498-3e71-49f6-91cb-9c27af697c2e", "value": "cce83a10dd72b220c9123d609d0bbd9cb0bf7af430b83e85c0fb10cad607aa30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08a2163-2506-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774084716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084716, "uuid": "e95fd2b9-b819-48e1-b851-4d1bf1381569", "comment": "Malware payload (Mirai)", "value": "ce20e346f26871b397b5d605a71930d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084716, "uuid": "8892125c-c89a-4fb4-b280-6a9c615928b9", "comment": "Malware payload (Mirai)", "value": "cda7bf0cf0d7fabe15cc22e32dee56ae3217e6c86176e3436a07c34f829fcd38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084716, "uuid": "96ab01d0-f693-4547-82d1-2a52a260669c", "comment": "Malware payload (Mirai)", "value": "e6730ec087f07dca99a96a803c5dea64655a6d5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084716, "uuid": "8e11c23e-a59e-4815-aac9-9fd42706374f", "comment": "Malware payload (Mirai)", "value": "5ce1d910986217f347bb17f83f4a7fb4042804120f300b29e944e2e46c6ea65631b190701610e72669fe8cf26b1c0a11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084716, "uuid": "22104e82-c11f-4ca1-891b-6efa1ec94741", "value": "T10504C70AAF510FBBDCAFDD3702E90A0139CCA55722A53B763674D528F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084716, "uuid": "1b9a85f8-272c-4953-bc00-8a860a65f9fd", "value": "1536:hR3ynCmOtuIjSdAR+B+1L6JePXxc20gw+nz+K5NbPHSxGZli/jCl0ByzIotQR5qi:6CmOtuIjgBqLrVNToGTuAzqR+db8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774084716, "uuid": "ef320b5e-63ca-418f-80e9-c847e698dabd", "value": 177895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774084716, "uuid": "5e1919d3-d2d1-4763-ac36-d8ec88110688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084716, "uuid": "eed4aa3a-13d2-4632-835c-feb9575afd49", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa5229b-250a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774086352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086352, "uuid": "e4242e59-e9d5-4e14-af95-af103bd0acf2", "comment": "Malware payload", "value": "4e91280fa755ec4a161da9cd6402c575", "object_relation": "md5", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086352, "uuid": "72c0142c-7661-496d-bef4-7ae52edb429b", "comment": "Malware payload", "value": "ced3004240d2263507959c0038c080a6763bdc1fda1b22024df45192a66493da", "object_relation": "sha256", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086352, "uuid": "bf445c2c-c7fa-4a03-82c0-4e89bc1cb388", "comment": "Malware payload", "value": "b2df06c1a96a870931fec8f8644a858c983de1a8", "object_relation": "sha1", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086352, "uuid": "5c096248-cc9a-4739-8096-f9827f154419", "comment": "Malware payload", "value": "5d38b55ef69452247de0c0d02cf96dddf9e732bae3c6ae6aa8751447ca66b3f2071382962dad92cc66f728d8fb84a106", "object_relation": "sha3-384", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086352, "uuid": "e071d314-8f94-437d-a20c-9f74e3641570", "value": "T14872DAB39F6C621BB11B50E41778FB99171E8147A4028E36BDED9978CFC56284BD831C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086352, "uuid": "831dce89-9d40-4144-9ac4-7c52ada1722f", "value": "384:xY6k/JHe/9ykJe6TuJO/HCk5N5wFK9dJ8SkszVw90z0z:xYT/JHQLJBaJO/15N5CK9dNv5Qa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774086352, "uuid": "fb3a2eca-6953-47f2-bc08-316ca71d443f", "value": 16093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774086352, "uuid": "aa197428-7828-4d19-9bf6-0160f8b2bb4c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086352, "uuid": "c68d62ce-de1a-47b2-a3ab-3bb519ddc1b1", "value": "ced3004240d2263507959c0038c080a6763bdc1fda1b22024df45192a66493da.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7042b1-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054246, "uuid": "d955fb66-0ab3-4bb5-a39d-3071dad00f28", "comment": "Malware payload (PEASS-NG)", "value": "70901be067464b978a01f31efe57527a", "object_relation": "md5", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054246, "uuid": "ef7086be-2470-4b7b-a0cb-9f38408c6b58", "comment": "Malware payload (PEASS-NG)", "value": "cf728670031730e33645077e6913193538cfd1c04ec3acf4c86b12ec99238ee0", "object_relation": "sha256", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054246, "uuid": "e8c90491-1288-4c38-9aba-8cbf32b86deb", "comment": "Malware payload (PEASS-NG)", "value": "be23b4871d8a55a84692334231d4dae8d07ef159", "object_relation": "sha1", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054246, "uuid": "c59d65b9-40fb-402a-9db5-2e554e9a9333", "comment": "Malware payload (PEASS-NG)", "value": "fddc3a4acf0820666381f97599f8a7165650b16a359b278ac538a245c41fcf81ef0454e16339d22179f960c529701c3e", "object_relation": "sha3-384", "Tag": [ { "name": "20251215-2904ebf1", "colour": "#090446", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054246, "uuid": "2b83bc3f-853e-4432-9262-a8963159d6ef", "value": "T1BAA6EF02F3E401D6EABB527891B61612D672B42A4330ABCF338C94795F337D16E76366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054246, "uuid": "df9a361a-62dd-43e7-943d-35d93bc6df75", "value": "98304:Z4KAANhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qf:ZtNVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054246, "uuid": "d84c5fe0-b665-41ae-85fc-d6e054fb773b", "value": 10025984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054246, "uuid": "58048e38-ab8b-46ca-b505-7502fb62e3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054246, "uuid": "fe6a730d-a0d6-424d-a294-577c9982be97", "value": "winPEASx64_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b89d002-2507-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1774084976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084976, "uuid": "c403a359-cf96-4418-8140-2d6d2f0e4376", "comment": "Malware payload (Hajime)", "value": "49a144fe80d60d7d1401188132806a39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084976, "uuid": "410c33df-9105-4153-a45f-ca13fc519ca0", "comment": "Malware payload (Hajime)", "value": "d018d375f8bbbb951295ee417c526d266bba9c5f4bf51a953a08395fb612ae3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084976, "uuid": "fa6317d5-38e8-40a7-a2ea-300f1ee9fa77", "comment": "Malware payload (Hajime)", "value": "0f49f32fead94599fdf8a32f71c902643ffc41cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774084976, "uuid": "a869707d-b51b-4786-928e-7a5b58932684", "comment": "Malware payload (Hajime)", "value": "bde26db43e0fefca18cb5c44483243dbbead68dc48ad0cbc50ee95266f86643bb622cc1cde6bc3ecb73a4ae714b3d294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084976, "uuid": "c65bbbc1-e7dd-444a-86ac-3ba49f5e6050", "value": "T1DD63124623692972967146F2E7FDAB8CE2092E688FF16C247C117D68A83236D4CC8919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084976, "uuid": "1b3cf94f-05be-40ba-96bf-e222d2949b01", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkpl:yYI0ARqw1qAEv7UIFM8oJorFquyjkRk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774084976, "uuid": "180d10e0-8036-4871-a051-957d797031e1", "value": 69580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774084976, "uuid": "f9fc91c6-9988-4299-99fb-4e77e0593006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774084976, "uuid": "91cd9f5c-da2a-43fb-9572-30bbfb8d7565", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b300d3e9-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054118, "uuid": "521a6e9c-4d66-45ed-9cb2-35808d8f8701", "comment": "Malware payload (PEASS-NG)", "value": "0c34b3b7785ae426136807489066bdda", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054118, "uuid": "23508782-d132-4a5b-a895-89e8eb01adcf", "comment": "Malware payload (PEASS-NG)", "value": "d08593a172263712637fd3e350db893948fafbd538a967ddb17e4197622993ba", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054118, "uuid": "353e8ade-d185-4bd8-a2f4-c436be866992", "comment": "Malware payload (PEASS-NG)", "value": "4ba3a08f0918ef384ba9106ade1e65c500e743ac", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054118, "uuid": "5acf9219-f6f0-4b39-8fb0-861f614d91b3", "comment": "Malware payload (PEASS-NG)", "value": "7d6048a2e6615755ae32790985cf85278ed5e63c5fd17a4d5e70c72c51c8698b48d8b2872c9febdcfa2cca71f0cb700c", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054118, "uuid": "cb3979f3-d5ba-45b4-85e2-9674139d1a23", "value": "T1F5A6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054118, "uuid": "a027826c-b862-4349-889b-5e3a61289f85", "value": "196608:BPxdtVBFUcwti7TQlyVN8iNISRTRmW5QD:NZHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054118, "uuid": "569e2637-81dc-4633-ab9e-ae2fb479c617", "value": 10170880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054118, "uuid": "c7cf9bb9-9170-44b6-b8d5-94404b15eca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054118, "uuid": "a834ee9c-0b19-4008-8fb6-b2d61b0b5a3d", "value": "winPEASx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918d88c5-2535-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774104743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104743, "uuid": "e446165e-55b9-438d-bf56-fb321c6f1668", "comment": "Malware payload", "value": "3bcc46d84bf7f62fb18e2e0e4f639fc4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104743, "uuid": "1aa18e5e-522d-48b6-9791-f387bf346acf", "comment": "Malware payload", "value": "d0b14324f22f568de2e20917597e61bf66824b2f5bfdb685d7c56fd67e091ae6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104743, "uuid": "0bde3f1e-c3f7-4762-8a86-f541185fadc2", "comment": "Malware payload", "value": "7855466f6343c7685b8c669397bcbc29986bd69e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774104743, "uuid": "160cb37d-4a43-4ac2-8682-f2e5f77a8cb0", "comment": "Malware payload", "value": "f70f2f5bffbfcda57ae778d50e487fad69228e5170777fa988a1996652acea1528d34cc88e121ca0ef413f864c7dc8fd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774104743, "uuid": "bb935474-b9de-4763-a443-5ecba77af3ef", "value": "T15B924CB512896C79FBD1CE39AF3C7F49ADE8C2C42124A3ACBA4F39205A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774104743, "uuid": "f90e4c44-858e-4cb7-b960-e0b5142a0ad2", "value": "384:nBcuQpWx+BL0SWL0g6zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:nB8i+BL0SI0VzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774104743, "uuid": "60bfa033-54e0-40a8-b5b7-e49d661514cd", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774104743, "uuid": "d8cc0047-c70a-4269-918e-721f98db6d87", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774104743, "uuid": "48a9b8ff-ce83-4b61-8787-4861c83134c2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10380b5-2565-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774125492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125492, "uuid": "fd591992-c7c1-432c-853e-6b5153475df9", "comment": "Malware payload (Mirai)", "value": "a3c2e83da6ffe1e1b1d82258465d34cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125492, "uuid": "01d4461a-a46f-4f84-acf9-2712b2d8f045", "comment": "Malware payload (Mirai)", "value": "d22644bc9418eb2338746d99f198ec3ed8d8a5aa9f20f4ebfc9072542292ab9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125492, "uuid": "c5356e65-e781-4350-959c-e7f319279388", "comment": "Malware payload (Mirai)", "value": "ec5059fb45808e49fbd146d168264a6c2bfadfc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125492, "uuid": "37fad724-02b7-4ae6-a127-1802fbd6c5c3", "comment": "Malware payload (Mirai)", "value": "c0dbde6a488e7dfc9c428eda7a5e0d45f28e5fb2d6c97e94b02955b250c5d5d846461fd6f733c67f219ac900055136c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125492, "uuid": "fc9b4ec0-be3a-4947-b289-3ccd25f6c8ea", "value": "T1A8D30846B9519B11D4C321FAFB9F918933136FB8E3E97102DD206F64278A9DB0E77602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125492, "uuid": "212fe884-6d60-420c-b2ad-ab086c0d5946", "value": "3072:i6NwPYQnxiNC519kxEaQa+x9NA0qddnQLQYxun/xO4knP:3sjnoG96xQa+vNA0qdFQLZu/xJknP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774125492, "uuid": "53413c63-dd98-495c-9db8-eb5e1323f3a8", "value": 142296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774125492, "uuid": "fe28b286-bed2-4567-850d-84b868433a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125492, "uuid": "ed624855-4672-4cf5-9f83-c0084b28605d", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c84d634-257d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774135604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774135604, "uuid": "7c14aace-cd28-4217-904b-370e909ae9db", "comment": "Malware payload (Vidar)", "value": "1c2f04ab85e3e76e1d43a5039d8610db", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774135604, "uuid": "44617389-940d-453b-b49d-729b1a4be501", "comment": "Malware payload (Vidar)", "value": "d31f50a42ef9a7629522f1a49c4ce12210d4f193b38cb122867c1038f69dc267", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774135604, "uuid": "16a83df3-06a7-4404-9b6f-2e28568ee7eb", "comment": "Malware payload (Vidar)", "value": "b5f0df21d6780412f9e8bc23036445085f2a0254", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774135604, "uuid": "fbfeca8f-12fd-405a-a0ff-d1129da9d278", "comment": "Malware payload (Vidar)", "value": "359f7aeebaf03f7678e9de1fc9468909a9e771617bc9e4573f7d959858ff10409972cc72fa6739ec813dc73fdc8e8c7f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774135604, "uuid": "c90cea62-a6c4-4470-be9d-e00f6972d1e0", "value": "T1FE95490BBC9418E6C46A97758CB712927B30BC090F3267D75E81BA782FB6BD06C75724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774135604, "uuid": "128d6c94-db8a-47eb-8dfb-d36a83c416e9", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774135604, "uuid": "4f10306f-7eb7-4388-ac8e-621119fd6022", "value": "24576:2T9eGXCtHpoVkdVgk8lpHyiiXosWIR3SUMKH0YZr1HXEXP56fB11rWtPdeMGBhj2:2T9eDHiVkdKkxiiXoOZH045HaarH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774135604, "uuid": "fa6f1347-b7d0-4743-b6b6-09e96d232b7b", "value": 2059440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774135604, "uuid": "f0840ba9-c62f-47df-a001-76372bfb1b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774135604, "uuid": "d31748af-9768-439c-88f5-3e1bc44b1855", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990ae784-2577-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774133102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774133102, "uuid": "fd5f0ecf-8003-4b52-b413-b8187a9cbd3a", "comment": "Malware payload (Mirai)", "value": "0f3823164eff8f538ab3d88c99e44352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774133102, "uuid": "3286de4f-39ad-4a15-a3de-af53a9511fdd", "comment": "Malware payload (Mirai)", "value": "d40bdb68a7dabbd34bdf1b7e35cd25f20a25d6f4808eabccb222339062e5bd21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774133102, "uuid": "ad5b4b66-fed9-45a6-9bac-00daa8e1bb00", "comment": "Malware payload (Mirai)", "value": "870f77fe2ae848b3ec80950f386755d01a728179", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774133102, "uuid": "b6fb713e-e326-4bd5-9fa1-065952bcdba3", "comment": "Malware payload (Mirai)", "value": "80160475e9519e44fbcf16bbd546a928517d6844e7c0f4bc5d4d08878fef0f0d6c848eca0de8ae8f357d9bce3ada2b47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774133102, "uuid": "2a28a36b-d55e-46b2-ad00-a998e2ef3fbd", "value": "T1B6E2D061E19A428EE9FFC23218D2E6CC237D0E1624E974E5D445F703065746E69876EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774133102, "uuid": "106cd235-829b-4379-ab86-71067d48f76a", "value": "768:OQX/3cWlUC+XMjGUd5aE3HeLohhrQUlM4uVcqgw09T:X3xOH8jG6LXrhhrQUi4u+qgw09T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774133102, "uuid": "853d6d95-6d1a-4bfd-85ab-eb2e9c40255d", "value": 32420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774133102, "uuid": "1a699aaa-9a4c-478f-b15b-0cc49346fbb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774133102, "uuid": "a9f67fdf-8e31-43af-ab01-99b623a5e7f3", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad73fea3-257f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774136572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136572, "uuid": "96cd767c-7ef1-4402-a8ec-c960908ad384", "comment": "Malware payload (Vidar)", "value": "892aac1614521bbeb7b06e8fe84ff4bc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136572, "uuid": "31e76b4a-65c9-4b9f-82c4-fd242e05a70c", "comment": "Malware payload (Vidar)", "value": "d6004a74d6a6a13bf680141e01999eb3635ebbacd50fa36d734fe3396afbe8e2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136572, "uuid": "71c90e7a-168c-4374-8f10-d90fa223e946", "comment": "Malware payload (Vidar)", "value": "bb1fb3fa4136476a399bef652d0a11a6b1d6c1b2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774136572, "uuid": "707668d5-53c5-4891-9796-a85146f96564", "comment": "Malware payload (Vidar)", "value": "27561a36b11e0c39706626cf5d4a2dcb83c8a04461a5e8ddca58e86081d563dc410a87a8e4454733a517983bcd9bf88e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136572, "uuid": "08b18056-a3d6-42b0-8a6d-e87b9b6d08c1", "value": "T15886086B2EA09179C179CD7EC0A28F0096F3F2752B33F2EB3551376D4A01AD15E3A664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136572, "uuid": "89c7b7b7-e4e4-4af6-b95b-6c05cdf03722", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136572, "uuid": "2a1a1f71-6b72-4dba-a594-a7e37d174b57", "value": "49152:XZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+98r9ATPDUihxPXo:XPOkz7Mx6PYihxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774136572, "uuid": "8daa25a4-cb12-4116-9904-d15ad9ef12bd", "value": 8524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774136572, "uuid": "c0e7a93b-8e13-48cd-8d9b-91d78f2c7fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774136572, "uuid": "a1926622-3263-4217-b15b-e6fa0fe41a56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8333e8-2565-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774125489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125489, "uuid": "4c0a4b93-65d4-4e9b-a474-239612d4b90b", "comment": "Malware payload", "value": "77f29e7b2a4ea144b545bf0a9c40c019", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125489, "uuid": "9cb502e9-16b3-46aa-930e-8e2028400757", "comment": "Malware payload", "value": "d80bd720ee3c2e7d9ebb188b6c8749df8276a18677b32627c93b5f2375bba439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125489, "uuid": "3b04ff8a-fe4b-46e2-bda2-1164d9ce075d", "comment": "Malware payload", "value": "47d79f724c21e40a7138f83ff28dc7f1c46779e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774125489, "uuid": "c2ae9089-bf8c-41ad-9827-76d0a2e4a3e7", "comment": "Malware payload", "value": "47497013ba732bf15a0023e2da655d44c1f439e3b45e89a481168277ed58ca199607750199eef262e9b785fc5731116b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125489, "uuid": "2340ae62-fb72-4045-966d-0d7864f787d5", "value": "T1C7C30845A9429F01D4D731FAFB9F429933536FA9D3F97202D9205F6123CA98B0FB2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125489, "uuid": "0d95bc1e-7eae-459c-afc8-3fc788f8ddf0", "value": "3072:0LeSTjv3DBhGmKpZqMVTzTax21troOdBEn6ARufN1H:0xj/ApZDVzTax21troOHrAsfN1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774125489, "uuid": "ec357908-09f5-40c0-abef-6772f870e6d5", "value": 126432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774125489, "uuid": "cf762720-64df-4603-91c9-af4a217ab5cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774125489, "uuid": "e7e19a4c-edb4-459c-b2d3-57aecf93ab83", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35119d0d-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774053907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053907, "uuid": "2a501e1d-3b16-47ea-bd93-21aefd9146d3", "comment": "Malware payload (PEASS-NG)", "value": "b4e7fbe9e622617e58fc257e4b9bab56", "object_relation": "md5", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053907, "uuid": "504b6b66-6750-41f0-a6b4-e4a5e7edb6bf", "comment": "Malware payload (PEASS-NG)", "value": "d9a2c69f0ff69b927c0df86253975c1d17dd1ed2fca5bea736a9f511be983e0b", "object_relation": "sha256", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053907, "uuid": "432c885f-01d1-48e0-a42a-962a2b457391", "comment": "Malware payload (PEASS-NG)", "value": "643bc021185e64611fb82464605d9ac05ad21fae", "object_relation": "sha1", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774053907, "uuid": "c606c093-6281-42a6-9310-14f7754ba786", "comment": "Malware payload (PEASS-NG)", "value": "bdc3e76afe577ebf4b9a1ca0585a2dd8147dc3770d6c74a10d6698d59bfd6e1b93617f57c07a4abbabb902f3040685d2", "object_relation": "sha3-384", "Tag": [ { "name": "20260320-6aabf6f8", "colour": "#290703", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053907, "uuid": "7eb4b420-751c-45f9-afb1-cb53f4ac2ced", "value": "T140B6D044A2D90929D5AF4E3D806212335739760A53DA8BCBFBCC82980F57FE6C776316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053907, "uuid": "72ba0ba4-a30d-422b-8926-b01bff3a512b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053907, "uuid": "55a8537f-2db7-4857-807b-c38f65485c5b", "value": "196608:3vyxUb9VBFUcwti7TQlyVN8iNISRTRmW5QN:acJHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774053907, "uuid": "cb113c8e-6a3d-4891-afa3-f79528835ecb", "value": 11116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774053907, "uuid": "a6df6b85-3070-4d2e-8e9d-d011cb53376b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774053907, "uuid": "bcb2037a-57f5-4243-8b55-542dd63d2469", "value": "winPEASx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e971fc63-2507-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774085133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085133, "uuid": "11deacda-0bd0-4c46-ad53-d7a8dc939767", "comment": "Malware payload (RemcosRAT)", "value": "571523dd3bd37d6e309e3636b7d5548f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085133, "uuid": "8f96e863-c58e-4aa4-a2a1-b8690fca6831", "comment": "Malware payload (RemcosRAT)", "value": "d9ff4010df8ee362357877397b010018b6fb21e10c9119d79b4e17583be1fd65", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085133, "uuid": "ed422ae9-b637-45ea-8df6-a9ab2e7dc347", "comment": "Malware payload (RemcosRAT)", "value": "4fc4aa57fdf164931f02a3f0013cef2b178aa9da", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774085133, "uuid": "a4c48707-9603-4fb8-a15d-42dd8914d1ff", "comment": "Malware payload (RemcosRAT)", "value": "f6ccad80f737953c930f796d39dff4c22d9c2754ab9396120dd522e46ee741fd0c7676657a509b0407ff7ca1102ee059", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085133, "uuid": "29ef491e-6e34-492b-85ba-cef9f882d610", "value": "T148C5331FF801AFD09315C4AE6A9924A13C5321EFFF94AE57B186205BEEC0B5238576CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085133, "uuid": "dd65a1a1-23ed-44a8-8c1e-8ac2e35ffffd", "value": "49152:pqVTIzvmlQqVC8J8CB5BcJNWlj9cGmcmf6+l9PUpvgScAIB0sgo11jBPR:pqhjl8QBc6F6GOtSpno1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774085133, "uuid": "ea4e5791-addd-4da3-bf4f-c19e2099c6bd", "value": 2701102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774085133, "uuid": "90129325-6f7b-4163-a989-3c085618bf08", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774085133, "uuid": "973012dc-5e2a-4804-8c63-584e83e09579", "value": "e34ef072b4ed69c4302cd9683fb9eeaf7e142059615d475df24930076a16406f.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b231c2-24bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774052197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774052197, "uuid": "155ea1a2-4bcd-4118-bae6-dc410b540101", "comment": "Malware payload", "value": "3d99082c46113acec75452c6e30b091f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774052197, "uuid": "d4431d27-b336-4997-a337-4b5d7f29d742", "comment": "Malware payload", "value": "dbe57921e3bb8bcfa49523cf812994f47c3e67c05b3e4a884f139bf63d77dc50", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774052197, "uuid": "7e17598e-ea5a-4a15-a4bd-8ac69294e61e", "comment": "Malware payload", "value": "73eab873b22efddd1c0e7890c3b381bb79986eb3", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774052197, "uuid": "3b5d3158-f167-4318-87d0-3fb0d013b301", "comment": "Malware payload", "value": "05850cf2fa850027146e0eb8dd10ad2e9474e5f447e65f32173b103d58f9e59bddde16807791ea7318857da38ecef18d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774052197, "uuid": "903127f5-b817-4317-9a81-c837647cd0b2", "value": "T1F0B310CB4AAE88FE872F6419810F6C07DA4F4103199DC5607AEEAD473F31DB0B4A5AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774052197, "uuid": "67006cea-48d7-4f19-89b0-69d278c88b44", "value": "768:D0h37zRA4B7+21n6eg/3O+Gfwa8Q7H/++4Ulm5ErrJlCtB+2e9EQj/Ta8HiENabR:DGpDgd65AfMrS7Ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774052197, "uuid": "f4735274-35e4-47d5-a6ab-0db335aa61cd", "value": 114147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774052197, "uuid": "a9aaf9d8-309f-4ac9-b64c-67d428b267ea", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774052197, "uuid": "dd78e3b7-6043-4ea3-bb75-0e50a10ff767", "value": "Meeting_Omega_Session_611.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a1b3aa-250b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774086684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086684, "uuid": "e14c7fa1-926d-4693-a8a5-b072dc4b1af0", "comment": "Malware payload", "value": "1aff5ef8bc45fa89d7329c6beb4f05e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086684, "uuid": "6f838703-fdfd-433c-bd10-9dca0f6efce0", "comment": "Malware payload", "value": "de61c27b90a837b5ff9bdb98268c982df0afdc3e0e4e385cff92770235957948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086684, "uuid": "95b89b88-214d-40b0-b80f-cafec380623a", "comment": "Malware payload", "value": "21779920213a471e8550c7a0daab86b1d1627884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086684, "uuid": "cb68b083-846a-465a-a08e-65548b8aae41", "comment": "Malware payload", "value": "d73a08ec07d02763f669c28a38ad85a5b032d2bae98872c96b06e787690d5b63210b74f115a7b023a3092a178e9733d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086684, "uuid": "a177693b-36c2-4302-8fe0-ed1442c49982", "value": "T145D2B75BB753D53BC044C5347DABCB24B4B3D0B86B20D747217A936928932D89FADA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086684, "uuid": "480aaa3e-cef6-421a-8c06-dacc4c7a3630", "value": "384:gCc79GefXH6kGoT3GPp3XmDDDDKWDDD3IEEElO:sbPH6kGWGPp3gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774086684, "uuid": "12f9aae6-920e-46b1-b205-298a5a04af26", "value": 28296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774086684, "uuid": "c5cfc955-7e73-4fe7-b84c-ed8c4037a7e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086684, "uuid": "c54126a3-43e3-474e-9177-ac340bc5d71d", "value": "1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10877cf-2511-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774089360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089360, "uuid": "3adffa13-6e2d-46d5-84fe-6fc1c9d543a4", "comment": "Malware payload", "value": "91537a7c054d52ce1d494d7526ed6782", "object_relation": "md5", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089360, "uuid": "08251c4a-a206-43e9-8fc1-e63fdfae90af", "comment": "Malware payload", "value": "de8e90ef8307a89032d3a9f27bed647c21cf1f8810945890b6366ead5f2e33bf", "object_relation": "sha256", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089360, "uuid": "50197049-9521-4472-93c2-774518429c2a", "comment": "Malware payload", "value": "f40f066b2ef02a1a60cb4bda6706b9f62596578d", "object_relation": "sha1", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089360, "uuid": "d7be70b0-c7e1-4313-9a32-b99ac353017a", "comment": "Malware payload", "value": "3808d61b70b918a606a40e93e75bb9f1a9a00fec18b69a935ddaa738c4e0f2a92ba373c0ce4a57b414b75bd2eb426000", "object_relation": "sha3-384", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089360, "uuid": "ac655e1f-3fcd-4622-8be0-c080628cc995", "value": "T146144B326300B93FA813CE51B27E7F4E3C66D21BD90646FCA5E4E5709FD2DB21526298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089360, "uuid": "5d93d441-4f1e-42e8-9619-c61fda15d9cc", "value": "1536:josegBzHNUNNBL6MJQXbJ2wPbHlp51UioONIT65/jwIBUeOft87W3sNSk2fHa+44:tqL6ckbwAlfjITCx7Da5IpR/AUujD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089360, "uuid": "25812a90-bc4a-4538-a770-426045248347", "value": 193363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089360, "uuid": "5c27a185-64af-4965-8552-de1716721509", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089360, "uuid": "0c8e7b2e-b80b-4f4c-a449-d36087d872dc", "value": "de8e90ef8307a89032d3a9f27bed647c21cf1f8810945890b6366ead5f2e33bf.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ae7cc0-24fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774079404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079404, "uuid": "1cf4c9ef-3e0b-4ec8-a932-5e022b336ff9", "comment": "Malware payload", "value": "0601e274789b751cdeb4e861f628e15a", "object_relation": "md5", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079404, "uuid": "8720ee6e-7aca-4db7-ba75-6b3e9a081ed3", "comment": "Malware payload", "value": "df120f0e6952a2447f8323ab565b6a8560066f4cd8b7126b2fd0987b102239cc", "object_relation": "sha256", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079404, "uuid": "37187ce0-5690-4796-8f79-73ecb6a7a27b", "comment": "Malware payload", "value": "e7d6a41f1d69e1280fa5e3f511f9b78f6792ce0f", "object_relation": "sha1", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079404, "uuid": "f8506167-0854-4e64-b1d7-17ef27320dee", "comment": "Malware payload", "value": "b1132d3f9d6dad63e4059716e532b4f6123260b32e6874552f4a96568d95fa44e6905068826d55dbd5879c2bb68eee2c", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079404, "uuid": "3a10b29a-735e-4811-b31b-6aed23dc47a1", "value": "T1BB663321F52C5DC2D87AF43DA0A21B9183D6231DE543E47A55A23AC8F9E078E0CDE65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079404, "uuid": "f66ee3b4-bf08-4bdf-a30f-fd5b8da2eab0", "value": "196608:+ZftO1VgTmaK/n0uU+HB/OGUElH6XU8YYlbHXUw:+BwAxcrU+h/PUEl0U8YYlbEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774079404, "uuid": "425ada75-530f-4a03-8c19-c53fd2f69a14", "value": 6478537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774079404, "uuid": "30fba2ad-773c-433d-bea3-6bba54c6d563", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079404, "uuid": "3e2cc72f-b2c2-4640-ade6-0bc667d227a2", "value": "surionimyeaqa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c2e91e-256c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774128130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128130, "uuid": "1ddf84cf-a99d-4eb0-a218-0c6734b294ba", "comment": "Malware payload (Mirai)", "value": "903089ad95e622a3d52b0cc841f5f735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128130, "uuid": "25161090-2264-460a-bb21-227e8e7ddf78", "comment": "Malware payload (Mirai)", "value": "e1afb97deec8ba5b578d142668373feada852308e5c92ae3a011f4a9bdb402b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128130, "uuid": "a9aa6675-b596-4f4c-b14c-8343e141f6ec", "comment": "Malware payload (Mirai)", "value": "36aebdc6573b5ba3256e3f28fb980e89f9b9cffb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774128130, "uuid": "695a0c35-8e57-45da-ba01-543498afd77c", "comment": "Malware payload (Mirai)", "value": "844ddd054f656627dae84a9b00cfb8040e2333aa1bbca06488c395194f6d060d232596391ba981f74686c9cce17d2a48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128130, "uuid": "a1e862a8-4595-48d0-b96d-7659ba1f60d6", "value": "T19F931946B9419F12D4D621BAFBAF41493353BFBCE3EA7101C920AF5027C69DB0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128130, "uuid": "949dcbf1-079c-48f2-8104-e781f0fbd932", "value": "1536:NlnN+7viocpl7keQasew/XoaLYjjUKBgmY7cHNlMviS2AD5IXKY7SMYi:o7Ko05sew/XoaLYjoKBgmYb/2A1IXKhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774128130, "uuid": "5f68023e-fb7d-4f4e-8430-a416d3957625", "value": 94348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774128130, "uuid": "dc1b5776-cf68-4b09-b43d-1495baa279a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774128130, "uuid": "f69b20c1-3e78-451e-8397-4e930ffde4d0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459a668e-252b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774100320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100320, "uuid": "217343df-914c-49b1-8ff8-cb989cceb0cb", "comment": "Malware payload", "value": "568888e3c0e139c29c174e20ddcbdd93", "object_relation": "md5", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100320, "uuid": "1b8c531c-f9d6-47cf-90a3-6651987de81e", "comment": "Malware payload", "value": "e1dd83640ee7949fab51dd4d41b2751631a30c9d243c1782442ebaf0ac700fe0", "object_relation": "sha256", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100320, "uuid": "cff63e1b-d26d-4d01-88ae-df679a766419", "comment": "Malware payload", "value": "45038bd219003985878e215e0ecb710709748dd3", "object_relation": "sha1", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100320, "uuid": "ebe2095f-b012-4711-89d3-0c4ef8cccf22", "comment": "Malware payload", "value": "dda7a0fafd11cd54369f1954224afda2fe402415b32ddc81ffb0a44a6e68bc81b9b67bf01ced2196cdf2bd3eae4b5d61", "object_relation": "sha3-384", "Tag": [ { "name": "179-61-145-140", "colour": "#0C36CD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100320, "uuid": "2ee4ef8c-1fc8-4725-9690-3c493f1db5c5", "value": "T16536E031927278D9EA3763BFA4AC4FD58114B4F0B519EA6B337C2FB54E9024661B2D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100320, "uuid": "94c8783c-e756-4225-8485-d68f5ad69c0b", "value": "49152:ShLYBMV3eVougTSA94vLNgmUESIEjPMN2lv+oBfvjF1wyeDIKz1a/6PE:cYBMV39MA94veHjPMNar7F1feDh1Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100320, "uuid": "094be2d9-39bb-467d-9b47-1b2ec69c02d3", "value": 4913152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100320, "uuid": "eeaf3b8f-5384-4fb1-afa2-6c1c9ba6f05c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100320, "uuid": "9c10716b-3d2b-4c7f-b99c-ca82ac14d269", "value": "e1dd83640ee7949fab51dd4d41b2751631a30c9d243c1782442ebaf0ac700fe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3435267d-24d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774061207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061207, "uuid": "bd0fdbb8-c8f3-44a6-911d-7f641e099739", "comment": "Malware payload (Mirai)", "value": "4621536a06b64d7534adddea0f99a3fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061207, "uuid": "a13af161-c09e-4fd5-aa67-57fce69a6cdf", "comment": "Malware payload (Mirai)", "value": "e4c42c652679d6a1547f1cd275e4026d326c81bf6acd776450319f3d4bd8b955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061207, "uuid": "136d3ddc-eb70-4762-978d-9e8e72331780", "comment": "Malware payload (Mirai)", "value": "653aecba8f0006141e8342a9918f8da125f02af4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061207, "uuid": "28490538-711a-43bc-ba8b-94bb5873169d", "comment": "Malware payload (Mirai)", "value": "22cc2f0b05583196aa4dcc620607f361ad5d24bb15dbb299e3bb47e9342c37879f3c9a5a8874d0247914d6efa5dbaa24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061207, "uuid": "529b8239-f7ca-4724-a853-267591809c71", "value": "T17F831228235414E9D62681F1D3FD1B84AE591F69CEE2EC157C12BC99EE333AD2CC2618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061207, "uuid": "f9f1ca69-27de-43e3-81ff-43a2f16b0c6f", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uB:yYI0ARqw1qAEv7UIFM8oJorFquyjkRk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774061207, "uuid": "8e2beb28-e908-4495-a40d-799caf311bcc", "value": 83780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774061207, "uuid": "8948bd25-a74c-47b8-b4a4-5de9d189f50c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061207, "uuid": "19d5639a-f79e-4fa6-846c-3f03286e67ee", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a30af8-2539-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774106298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106298, "uuid": "0b9f85fc-0069-40df-b638-8d6b9dc31b39", "comment": "Malware payload", "value": "9de970d5fed25de1d986f423961b4a7c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106298, "uuid": "ec74f376-7d66-42f5-b4b4-a1dc503d630f", "comment": "Malware payload", "value": "e6b10edbec70c4360faf8356adbf915aecb5485aa32444fa9fe95c36a1185711", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106298, "uuid": "85f226bc-24bc-448c-b7b8-4a710f41705c", "comment": "Malware payload", "value": "1015acaa9e6d42c222efae4ee5d3053a3e8d9914", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106298, "uuid": "052275c5-14d7-4e98-93bf-f88757adee5f", "comment": "Malware payload", "value": "3eb6a189632f0ce3f8cab41688ff922949b5adb6f8d9a12ebe06cb4c7e57686b01ec7a5ec824a8a18a4440edc22a1f4c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106298, "uuid": "e60545ff-631f-48d1-abd1-584fff340136", "value": "T1201169DA0376D000CD4B4F8434556694BEC8A7E9B6370AECD8CD85F6A28CE287155F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106298, "uuid": "834cc7ef-8d67-45c8-99ed-1b1cdb66e3ba", "value": "24:h0L5NIj4KBg82gWDgo/m3FtdlSWQdgmCvTHA:OLM4wg82gWDgo/m3FLlnQOmCvTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774106298, "uuid": "c9d28228-e014-46d1-9fff-90e9ba9bbc03", "value": 1104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774106298, "uuid": "9ddfba0c-e3c0-42b4-9ce1-3459aa5879f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106298, "uuid": "031c226e-9890-49a0-b0bd-310806ccb671", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d056f4-24fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774079416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079416, "uuid": "3a80bac1-486b-47a6-b4b9-5573a7bd06c5", "comment": "Malware payload", "value": "5ff7a5fe6cd4ea1f9d9c58f122fee092", "object_relation": "md5", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079416, "uuid": "946087c0-5d00-44b0-b8cf-35f01a8599cd", "comment": "Malware payload", "value": "e6ba480871feb484530dae559fb8d9940ac4bcb76861d5ca0897617d9b317324", "object_relation": "sha256", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079416, "uuid": "931f8eaa-066f-40af-bd51-3acbcb6256c8", "comment": "Malware payload", "value": "7f6944eb27b9828a56487d4175478e8e631f7f48", "object_relation": "sha1", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774079416, "uuid": "58e31153-eb17-4f4c-bf04-fed1d6149f90", "comment": "Malware payload", "value": "a522db853b6164bfb579dc5588124cbb54246eab87fe19349fd5604be962d5d75d83c47bd0e304b464e2023eb7601bc3", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-244-166", "colour": "#F7D17A", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079416, "uuid": "6c9ddde9-35ab-46f2-950b-e7815d41d33d", "value": "T18BD5B096B3C87AD9C416CD3A9714F232C1A379234FB6E0CB5997170A4AB6ED14F39B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079416, "uuid": "408608a8-d5f5-406f-9ff0-3d4901d2b132", "value": "1f933ed263d09ad8837714c8a00e0a3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079416, "uuid": "9596ff45-086c-4e9b-ac73-fe11a76408cd", "value": "49152:HvmBFMvQIJZbhFqT/PTroVkvLH3CJ9FpwctXi8vC/XYK5s49aPDzDlr4Yprjdx0b:yAQIJZbhqBH3CJ9FpwctXi8vC/XYK5sE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774079416, "uuid": "e8b17be0-a347-4129-9b00-713d39ab3c77", "value": 2796032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774079416, "uuid": "e69ec954-cc60-4b7b-9b45-9fe576bdd0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774079416, "uuid": "7cb03fd7-07a5-4905-b17b-9656d6733ad0", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2976d6-24d0-11f1-a769-42010a9c0008", "comment": "Malware payload (FRP)", "timestamp": 1774061190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061190, "uuid": "e09fcf68-36ad-434e-b416-b94a0d307bfe", "comment": "Malware payload (FRP)", "value": "4c636bd4dc7cfe4fa842f9c98a64df3d", "object_relation": "md5", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061190, "uuid": "b306e29a-c738-4f5e-8af4-81bb8a0741f4", "comment": "Malware payload (FRP)", "value": "e6ca0b105f1aa41344acc5eeab7c9b2dde6e90f05196a77011ceaf53ff83da8b", "object_relation": "sha256", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061190, "uuid": "3d6fa17a-91bf-4447-930a-5602c85ade23", "comment": "Malware payload (FRP)", "value": "86c8befc342aa958fd59ede652a072ff875a32eb", "object_relation": "sha1", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774061190, "uuid": "fcf290e6-a5db-4b92-9baf-58cb81faa671", "comment": "Malware payload (FRP)", "value": "1c7f365a2031ab9326137640e62a003319a65fb644511c3865b96ffa30ac408633b380ce662ab605262243a521dbb57f", "object_relation": "sha3-384", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "v0.68.0", "colour": "#A9A90E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061190, "uuid": "e7480da2-4fd6-4bac-aa92-b57507b2c31a", "value": "T1B9076B45BC1D64E2D6C9B5745B2612543338FC149F82CA1A7A24BB3DEDF2788CF632A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061190, "uuid": "8340e52d-9fc0-499e-9c8d-eaba2fc81dd5", "value": "c984d366a3cc28220c89ab860ab9fd47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061190, "uuid": "de91c203-59fc-46b7-b27f-644991f17845", "value": "98304:9t+oND33FL4mByYjuFJppQ7ZMeiIEFNGO4niASJwiieZyIC+xj55q9oNYGnuYnRi:9t+6F0m0ZtgZjKFkO4i1JuItLdNp+9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774061190, "uuid": "f8ecd5bf-c77f-49ca-ac00-3509f332deed", "value": 18317824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774061190, "uuid": "461035e4-95be-4bb1-86d6-a82644578fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774061190, "uuid": "b7d9c2fc-c4e6-4e17-bb42-6eb63b4ff43a", "value": "frps.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f37270-250a-11f1-a769-42010a9c0008", "comment": "Malware payload (StealitStealer)", "timestamp": 1774086412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086412, "uuid": "c673bde5-0579-4155-9a57-1a2be0704f42", "comment": "Malware payload (StealitStealer)", "value": "99498bb034e1257c2fe24fd7b69e3ff0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086412, "uuid": "6463a81c-7542-4fc6-bd8b-945c45ccb7ff", "comment": "Malware payload (StealitStealer)", "value": "e7a433d87007c3255383fced17a28d1301bc3c0ff3721fd9d8c64c8057b17820", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086412, "uuid": "15fd529c-3fe4-4e5a-8dbc-a8a30288f606", "comment": "Malware payload (StealitStealer)", "value": "dae291f15b3a301db5d374c56ba669ecd0434a19", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086412, "uuid": "eadec891-a030-4704-b519-7ac97c88d913", "comment": "Malware payload (StealitStealer)", "value": "2f87b025de4f3f3255d097c748509ea2de990ae9a36e4e1ca8bba3a97c0cea74fbbcd741322973222bcf3152303f8e58", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086412, "uuid": "4ea4ed1c-c61a-4ae2-adfa-40608679ac39", "value": "T163F63330D095720AC2A30D75374A524BC180C298B3C54CFFB65EBF59E9A27989FADD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086412, "uuid": "6ed87de7-d233-4cc4-8f66-f9beb40fed64", "value": "393216:+Qpq3gQp3RI4wJi0poeiPXDSgjvYJCfqPXeVwh:+QA1p3RonRiPOIYzv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774086412, "uuid": "cab21e48-942c-487b-abec-babc11bbdf5e", "value": 15737423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774086412, "uuid": "ce3e8516-5d4d-4f51-9c8e-929f11f73c35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086412, "uuid": "b4e8c38c-1a1e-4a19-ac28-05bbb61c28f9", "value": "calcmod-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e05642-2518-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774092105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092105, "uuid": "3096f958-65ea-4057-b9bd-e8ac38e6be6b", "comment": "Malware payload", "value": "783d27d022715a97d0e4f93411d8dc09", "object_relation": "md5", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092105, "uuid": "1add170a-2bb4-49e1-917c-f475ea993ab8", "comment": "Malware payload", "value": "e7ff60fcec180a4c45f54acbedf3dcfc410e1253e8c45a421f08e95044750ace", "object_relation": "sha256", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092105, "uuid": "8b4dc9f9-3126-463c-9508-7b13ce9a2c8b", "comment": "Malware payload", "value": "da19830ee98754cfa7cabb63c494f6721fecd7b8", "object_relation": "sha1", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774092105, "uuid": "75c7ec62-8f1d-4321-a842-612a0d1b4d0c", "comment": "Malware payload", "value": "693fb115f0819ec272d086b21eaaaa5b08a118291b2bfc5b561bf81265662d2afe2619295dc3ec1e7af4d49a0f2577a6", "object_relation": "sha3-384", "Tag": [ { "name": "photbookguest-pro", "colour": "#F65642", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092105, "uuid": "689ce7c9-a37c-4d8d-8feb-93bcf4111341", "value": "T13E32CFD8E8E9668CCA04E7F654F3948D506ECF34981B315B7AA5BB0A806CF0A3FC1954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092105, "uuid": "2ca627b6-a4ab-4f08-b783-cdd64f042436", "value": "192:0BnijsL8QvH5oeDgudD3tuT9Ldas4T9tv1cxFPzQrADP9oo9khNl:GigL3/HDgJ9bjzQrAZoocNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774092105, "uuid": "9c322022-a3da-4f86-88ab-be5a9923f797", "value": 11351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774092105, "uuid": "754647ed-f592-4662-8ba2-7d14d59f5e6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774092105, "uuid": "315f227a-9cef-4b6d-95f0-cdbb7bed678a", "value": "photo-638641384.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8f50a9-2503-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774083095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774083095, "uuid": "f7b7de2e-cb7e-4ad0-9acd-a482df5cb8f3", "comment": "Malware payload (Mirai)", "value": "dbfe41a76cc6de9c51b50749daf951e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774083095, "uuid": "c3c08854-95d1-424b-9a45-8b825e02e0c7", "comment": "Malware payload (Mirai)", "value": "e87f036b421f3d4cad02a6bda6de7786166d7e87ea64096e100eeea658d5aeff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774083095, "uuid": "08863f73-5307-4c2c-b8cd-be1b10c2592f", "comment": "Malware payload (Mirai)", "value": "1108ed988a4e50dec824dd307bce949396d93e4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774083095, "uuid": "bcb20c5d-e673-4477-ba7a-00dd822fac93", "comment": "Malware payload (Mirai)", "value": "1ade266646c4f4941bbb5c0ea2073707f727cebb77d66e11b6f1552b4b4cbf2ca4a5d367902dea5ecfc826b5a21cdd88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774083095, "uuid": "7609c2c6-199c-4770-bc06-7a36ee222cf8", "value": "T190044CA3A703DEAFF5AB47710AE78D3466E129F226B68152E235BF411B311C01D19FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774083095, "uuid": "819214b0-35a1-44a9-8c37-f56bd3b7410c", "value": "1536:mNA7dksRK75rmVqmonkXNcqq3L6EgYKAphMAR/D1optLzi2UkJuBWuA38EiagPTM:K75rmCkX4wSuW2UjVs4ryehMRZgDpBrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774083095, "uuid": "59e1a610-57a1-4b5b-bc57-940a39237d25", "value": 177895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774083095, "uuid": "649e451c-96a1-4905-92b8-37dff4f86e38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774083095, "uuid": "96128cd6-b322-43e2-aacb-d0aa374332a8", "value": "q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fac5a1-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054095, "uuid": "35cff40c-6f43-4ccb-8303-0b8e96c70d42", "comment": "Malware payload (PEASS-NG)", "value": "eeb43a531026c27753188ab562cf2271", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054095, "uuid": "8185a358-96fa-4e65-bdf3-23a5348392e4", "comment": "Malware payload (PEASS-NG)", "value": "ea1a2d01e622dfaae4fee2b353bab7912c2fb2235aa05bea0863f2f4cb829b33", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054095, "uuid": "75573ecc-3aef-4ac9-8b0b-3d432313fbce", "comment": "Malware payload (PEASS-NG)", "value": "93592c884c37edb1c520ef0b570b4c1fe57a6e34", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054095, "uuid": "fc56a238-9a35-4dd8-80fd-9beb518aba9c", "comment": "Malware payload (PEASS-NG)", "value": "9631af61bacb45ed5ea7cc2512765b098835b79d522ceb31aade6885ae95873e14b7d3234c2a5930ea20dc0c72123ce5", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054095, "uuid": "bf6a0627-14f5-4854-9d91-34fab8be64c0", "value": "T10D03C68635141C1843F6E7B7AA414B80137311B72D176ACE3ADDA9BD9B2E1EE1B710CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054095, "uuid": "529971fc-0ebe-4e71-9e43-0d072d77ac5c", "value": "768:THw3hDBRQ6u54v8Vg7EkRVlB1Zmw6CMUM4LvfnCMOaHLhqghCPzr0Ih5ITOx1Zoh:7w3hDBRRu54v8i7TRVlB1Zmw6CMUM4Lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054095, "uuid": "1bca4522-ec39-4208-984b-5d6201a953f6", "value": 39558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054095, "uuid": "38eb05f9-ec05-4917-bad8-aa1dd1e73036", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054095, "uuid": "4a762334-b1e5-40a7-af12-713158f3a08e", "value": "winPEAS.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d765c52-255a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774120600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774120600, "uuid": "9e42180b-2426-47a9-a35c-9cbaba7563b4", "comment": "Malware payload", "value": "eb299a8035dcd07fda9254333d288c61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774120600, "uuid": "fe638bac-8a9f-4c34-b39b-440559d725cc", "comment": "Malware payload", "value": "ea5dc82463a6e3b3d5756c2ed7006715e9acf6999e1b45c8fe8974ca8cd81b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774120600, "uuid": "811a360d-b040-4320-ae9e-8bfa9b1848af", "comment": "Malware payload", "value": "b80034ea2d0c17e3f8295facb8c6557008b935eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774120600, "uuid": "6fbf6929-1564-47b5-a928-2fe2503cfd97", "comment": "Malware payload", "value": "50940743d20b8fbe6abf7adc1281f48cab3340f6732f9c7ec9a1368dc242f29559061ded6c67545a788dfc4d18bff082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774120600, "uuid": "9855af65-71e3-47e1-99a6-69855e486c2c", "value": "T1C5C30119936309FED973C43182AD57B2FB75B8A14B294D7A8418C0392DA4D24EF6FD23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774120600, "uuid": "f6cb596d-69c7-4ec1-ad3f-3dd469292724", "value": "c1f4358211a66fe3d457f3e6f5983347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774120600, "uuid": "335d5222-55b8-4fb5-a8e6-dd2e621c8061", "value": "3072:FVJx9K0AtE7rEn1N5s6IkN4sJyM5OGY1zsuil:F/1At6InF19NqMcGa4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774120600, "uuid": "8eafc142-2372-46f9-b3d2-44b49f51c79d", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774120600, "uuid": "74cbce89-d4ff-417e-9974-54b5033e6fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774120600, "uuid": "0aa694ff-687a-4c59-a735-35459e38b18f", "value": "SysAuditHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7e2c0a-24c0-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1774054402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054402, "uuid": "ee9595a6-98f8-4540-8b13-4f10e9e813a7", "comment": "Malware payload (a310Logger)", "value": "d473324aa1f05eb2eeac2cffb1f328c9", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054402, "uuid": "9d5bd610-da24-467e-ba44-407bfa7abde6", "comment": "Malware payload (a310Logger)", "value": "eaf603fa94d2c2570f6ccb3769f40fc86426c847759f6e32175cce9e00834b16", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054402, "uuid": "609e69e4-ef70-43c4-8ef0-f8b73942af21", "comment": "Malware payload (a310Logger)", "value": "27afed8bf8fcbb069b435421619c382af385fc7a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054402, "uuid": "4343b2cb-8d93-4b13-ac9e-d5afb96f277a", "comment": "Malware payload (a310Logger)", "value": "a26d9de7b85556a75597b0bcc8a8cb1f6d204a37ebc0312c372acef5a8aab16942457c216be2e75dc50f551a4cffeea4", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054402, "uuid": "19dd2cbe-e5d2-44cc-a5f0-30aced62b7db", "value": "T10C55CF0273D1C062FFAB92334B56F6115BBC7A260127A61F13981D7ABE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054402, "uuid": "708d7e16-664a-45e9-9d32-84cf74fd967c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054402, "uuid": "438b06c7-6d74-4300-8081-f62ae4380177", "value": "24576:U5EmXFtKaL4/oFe5T9yyXYfP1ijXdaKhPPXaE9BGlWtkWHZ:UPVt/LZeJbInQRaKmlWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054402, "uuid": "2c4d0d29-d353-45a6-a235-91ebf517f065", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054402, "uuid": "c6f55ac0-d8c1-4ed4-931c-34fa6d747c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054402, "uuid": "933ff4de-8356-4c03-989f-c04843979a36", "value": "Halkbank Ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d03502-256f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774129736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129736, "uuid": "907a6f06-57a4-4769-8d95-d131d370c8b8", "comment": "Malware payload", "value": "f9267818fe693b06028e7c5a08daba07", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129736, "uuid": "28a17eb2-1b2d-4440-848a-5da5cb9f9cae", "comment": "Malware payload", "value": "eb0527dc598f7aec6017ae199d3f893c56cd92180a37c34f098670173764253a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129736, "uuid": "d8e340bb-4747-4b14-93dc-1deb4fd784b7", "comment": "Malware payload", "value": "a50bd71f17b12a190f6982191cbf2e0a74290829", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774129736, "uuid": "63dd8ffc-1b82-4d9b-b7e9-f5bb07e3ce0e", "comment": "Malware payload", "value": "36d182e18736e5c1522e7515b227dfe890bd8314ffb3f6205068513a32d010afa034a7180e28e1388e81822ca0dc1c75", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129736, "uuid": "9f2ea3f9-fb5d-4fa6-b0fd-3c189b1de497", "value": "T135C3FF4A848E44E75BD77C59521B6046EBB4434E072F98C0B31CEEF87F276E960E62D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129736, "uuid": "cd344e96-9f01-4283-8e69-b8e1b1bfbdfd", "value": "1536:u7Oo9fWk9246XW51PHkMQWfjzAUgT3FcRr:ZR495dxaT3FcRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774129736, "uuid": "086ed713-583a-4e64-9df0-71bf72660ad2", "value": 122882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774129736, "uuid": "d1a81567-b751-4aeb-bfe5-5968757bed4d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774129736, "uuid": "70f76d94-e6ca-4b51-b015-ac64e373cb01", "value": "Document_Berlin__45.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3279801e-24c1-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774054761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054761, "uuid": "825294c2-d834-471d-a7ed-f559563626ff", "comment": "Malware payload (NetSupport)", "value": "4afdff31e631104579f053bffbbf388d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054761, "uuid": "63313fec-11e8-4784-8af1-e2209bb0e9c1", "comment": "Malware payload (NetSupport)", "value": "ecc49e07ab6e6b4b57f6a7e952ace8c217f22a1746ed390d06348915e2372d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054761, "uuid": "cd981ee0-3204-4aaa-84aa-42597392568b", "comment": "Malware payload (NetSupport)", "value": "d82165ad9def62a508f451c605f81988fde7291b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054761, "uuid": "c6d82d5b-f873-4733-847d-db77c7f39958", "comment": "Malware payload (NetSupport)", "value": "1abc088a19788c88695f8235bcb45c2950f3f7073fbd97f1a9f1796ae19b202f4f8fe0b4973ea07059fe68ae32cf238a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054761, "uuid": "fc18881a-193a-4a85-bd3c-49a90c3bed4f", "value": "T1B1B55C7BFCA308B9D4AAA231893791557A707C542F3213CB2A90F7282FB37D49A75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054761, "uuid": "afcab71d-bdd8-420d-9b44-f53b68166735", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054761, "uuid": "139b681d-7ef5-4e06-a5ea-0ca6eb4f9caf", "value": "24576:ah20fO6Wy69OPd6KSHqgdRMCAeG2AX8ij6obK3AX9UV/VjE8ciD/QvUSgv55cbSE:ahN7Wp9OPofLMClGvVjM/VjBQc35c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054761, "uuid": "c6ee6037-d8b0-41ea-bbdc-70504410af8e", "value": 2434048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054761, "uuid": "c98a45df-2328-42e8-a461-cec3b19bfa25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054761, "uuid": "2ba878c8-76d2-4610-a0e4-124257b6b9cb", "value": "SecuriteInfo.com.Win64.MalwareX-gen.96322753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a444620d-255b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774121095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121095, "uuid": "e7bf8df7-fea7-4417-a641-3bc451f12bf4", "comment": "Malware payload", "value": "824ac5455d886693d623e636925c8d7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121095, "uuid": "b27e0bde-254b-4ebd-be55-d0b548a143fd", "comment": "Malware payload", "value": "eddee5050240a391acd3e00acac6f6fe8c075bc99bb6999d79e86319e6920688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121095, "uuid": "b31601b4-e50f-4dff-8fb2-d525727abce9", "comment": "Malware payload", "value": "bd5308282ec4f008645840a1bd16b1a0e8af5927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121095, "uuid": "01da680a-bf91-402d-a8eb-74026ee235ed", "comment": "Malware payload", "value": "d37ca12bcb804713820301f747c4a4097bd9c2dc708f0611c460e32dfd7b14f6c39be99a958066773b4c741e9c435b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121095, "uuid": "8ad01cbe-a374-4749-8205-54d4fdd0abec", "value": "T154046B19B39500E9E9B3823885535647F6B3781107609BEF07608776AF2F7E1B23EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121095, "uuid": "d65c431e-9049-46dd-a564-7fb063a66483", "value": "2468733d3e776ea5b8989a479ff04410", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121095, "uuid": "6f15d004-3a45-4af0-8d92-30d22da60d1b", "value": "3072:BP+WHeaF4Wo1sITMoBGDpNDruawtTNGiw+YMTdBoPkCFSY:B/voR+3IIiw+zsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774121095, "uuid": "e30af48e-c163-442a-a66c-5072c123711f", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774121095, "uuid": "440c2df5-aad9-4efe-8b49-f8d92ae9308c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121095, "uuid": "57599096-1a60-4b8e-a662-4bd3d8c2efee", "value": "vcruntime140_rel.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d12bfd6-2512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774089488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089488, "uuid": "a44f3a7d-df54-46c6-82d0-621f475df595", "comment": "Malware payload", "value": "920163158d6bd47ad09939aaff9bfc97", "object_relation": "md5", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089488, "uuid": "99014212-fb6d-40ed-a1b2-5f683d02ce82", "comment": "Malware payload", "value": "ef6208a6ad1b5298afa733864df9199fac0ee0419ca2395801beef9bb23770f7", "object_relation": "sha256", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089488, "uuid": "66948a12-9d19-4a37-a28e-600bf75e323b", "comment": "Malware payload", "value": "b11063097b67ed7ce6a4c01433d8d7d44798ebac", "object_relation": "sha1", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774089488, "uuid": "f5c435e8-57dd-4d79-ade3-78193bfb5221", "comment": "Malware payload", "value": "f3efeec9340974c556dec396bd1b5674593445aa8e21fff7fed1945bf529164d55c4ebc95a9125feab0dd26f91cb753f", "object_relation": "sha3-384", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089488, "uuid": "536eae84-dea7-4514-a0a8-b706e04085cf", "value": "T1D822C99A50B340389982C6C41F786E865679D00F8509DC647FDD2698CF4EEC9EEAB34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089488, "uuid": "6b55200a-576c-4f70-9f58-851da4fc82e6", "value": "192:Br6cMOY6Q3ux0S1w9oIiH4IlHanSqQb9SvmILSPXgzqD/F5QZrUK5AhgnxHD/EWH:Br80B/zoUP6HvtMWPOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774089488, "uuid": "6a0d0c10-68e5-4de9-8148-e385731b42a3", "value": 10195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774089488, "uuid": "3198fc8d-b709-4d4d-a2fd-863a8c6540ae", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774089488, "uuid": "50459a97-996b-444c-b88d-9edc4cbabd31", "value": "grazie.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ba10a1-250a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774086389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086389, "uuid": "2ed3db2c-32c2-42f7-82a2-a51c45ba55ee", "comment": "Malware payload", "value": "6ec0cffcb807f37572b0072cd5c17b6f", "object_relation": "md5", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086389, "uuid": "dfba6d87-556c-4911-8c42-96ced9328e7d", "comment": "Malware payload", "value": "f0996cffe24bae28c8eafe00e4b328371f5db6e99af22c02edea469785595139", "object_relation": "sha256", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086389, "uuid": "fbd46d63-98eb-4993-9e95-fac74b4ea2f2", "comment": "Malware payload", "value": "320e989c9240b5445df4a9fd7725cd62586121e9", "object_relation": "sha1", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774086389, "uuid": "1e649f18-43f4-4b5e-9daa-576c59d23fae", "comment": "Malware payload", "value": "6f1de1c8abc301cb1317da9a99cec23474a217a8a5a605f5c2d62f2cfc3297838c67e5682d6a1222046d9d090780bc08", "object_relation": "sha3-384", "Tag": [ { "name": "Danza-WhatsApp", "colour": "#8DD61B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086389, "uuid": "a7bcfa43-028e-4bcc-9adc-9f00004f0e78", "value": "T128F3557066F74867149B90C0A9645B1A7EC6F723CA1A1E917FEC1BE1CF52CA2ED2701C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086389, "uuid": "e68711f2-9c8e-42aa-baa5-9921102de60b", "value": "768:ZhtOmCSm2dy7y2vykyLWZ6zZvMiR2GGY0p1WNyjZyGyC2q220:J10VV6zbR2hY0p1WKaN20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774086389, "uuid": "ab0180da-5425-4670-b555-472e50385ab5", "value": 157516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774086389, "uuid": "f8620a9e-1dc5-47be-9566-f8dfd7f5d1c9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774086389, "uuid": "3b28d6e5-85a3-4a6b-9d1b-e4c95ed67746", "value": "f0996cffe24bae28c8eafe00e4b328371f5db6e99af22c02edea469785595139.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cfa3d5-2570-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774130056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130056, "uuid": "0614ee8d-8c17-4af5-b49d-196aaf5f5177", "comment": "Malware payload", "value": "10a283cbbe8c5d2e4dfd15992794d80a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130056, "uuid": "5f83afa5-ac01-4b3a-be48-2047d1dfa322", "comment": "Malware payload", "value": "f0cc698d5d25fe1ab8307fb5f3f742a0d4a8c42801679d52c7b11637c1e958ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130056, "uuid": "9a616e37-54a2-42ec-a6ee-388731f2aaa2", "comment": "Malware payload", "value": "373919ac0f0008fbe91857efb8e351a43681526c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774130056, "uuid": "bbe321b4-946d-4f79-a0ad-83f602bd7b0d", "comment": "Malware payload", "value": "d51e5966086828c038c9c1e8b26a40d0bac7d68a28862f0c87815e288b5d01aa4f687899ec99cda44c565a0d3545902b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774130056, "uuid": "38b8b38f-dd21-47fd-9e6b-3051dc501acb", "value": "T191E31945FD509B27C6D322BBFB4E428D772B1768D3EA320389255F21378A95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774130056, "uuid": "17288cf8-f75f-4142-a967-03ce8629d320", "value": "1536:yDWu/OmzfYL77PsliyQmBrlxA5bBvADvkhTOxSPJufrO3EE8iMHmx5hlF9wywnee:y1/1zfYTU9lxEAoh6SPENE8/GxeQbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774130056, "uuid": "e744c5d4-ad73-49fe-97fe-dd1f042bb8dd", "value": 150208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774130056, "uuid": "c039bd67-f20d-453b-b935-6b66d6a64066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774130056, "uuid": "98b6d75e-ac68-4cac-a32c-2fa0f3f29426", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2e3b0e-252c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774100873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100873, "uuid": "43c06fe1-1170-4183-baee-0ee442bf48c1", "comment": "Malware payload (RustyStealer)", "value": "a92f6d63e3da14c8406f7000b2abe116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100873, "uuid": "36407f6c-cfdd-4067-b87b-4f5e475ba687", "comment": "Malware payload (RustyStealer)", "value": "f2d4f3b332f124785a8f548e183b648e16375feeff484417d4596a95b21b0bae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100873, "uuid": "ba5379ec-c164-457e-a41c-e6f5186b96cc", "comment": "Malware payload (RustyStealer)", "value": "f65d7338203bb94461848289d4de766a05df0444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774100873, "uuid": "01e9689e-0716-4d73-a98b-c616ac0519c0", "comment": "Malware payload (RustyStealer)", "value": "26177704c8913fdecac26b848135adec56799f40925d16255ad753163525f7db97c437d818d6f61828154dbb9c1b308b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100873, "uuid": "d4567c0a-e5b7-42a5-9f73-5b99686c4ce2", "value": "T1E1D67B2024D86607FD7ADFBE99DC76440F7AB2917723FA2897410DED0ED1B49CA025A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100873, "uuid": "3146b0c8-09e6-4081-aa77-c2041031edf9", "value": "196608:OpKdC1H1CpD1DB1iHGTfVa3pCc7qFA6qZHHuAkwXaxFdUCFuzjN:q1cpD1rTfVaZCc7gA6qhrXqIpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774100873, "uuid": "eef0a45d-04f0-49ad-a802-1e0a5b69fe16", "value": 13598720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774100873, "uuid": "1ef2e225-f177-4d7c-83f1-d79683d9ceb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774100873, "uuid": "2d1ebb75-dd1a-4f20-9cdf-5c30548ed75b", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a90878-2504-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774083511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774083511, "uuid": "92bdc94a-9a65-4a84-bf45-75ea548413d9", "comment": "Malware payload", "value": "bb16410c6d6e02745696288ed0a64bd4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774083511, "uuid": "96ff97c5-584e-4292-abc1-4d6bafe9385f", "comment": "Malware payload", "value": "f31539b581b3b75403d0378719d4f29bed1a8253a28a93df1150f3f6a3096b8f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774083511, "uuid": "4e89ece5-df1b-4fc3-924c-949f232c2e40", "comment": "Malware payload", "value": "c3d3740d56eb79949ba96ccaa743740470f63807", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774083511, "uuid": "3f985605-50f7-4df1-8a2b-f497ca5d5651", "comment": "Malware payload", "value": "5a398669c7996006c11aca144fae9b96a853de56c4b35fcdd2a2d7230fb8901d85da41722248d2cb52e6c28cf1104d11", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774083511, "uuid": "575a7e4a-2354-4573-9068-9d0cec63a07e", "value": "T147925DB512896C79FBD0CE39AF3C7F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774083511, "uuid": "e27c2f52-6be6-4ab6-8d83-18985d228f2e", "value": "384:wFcuQpWx+BL0SWL0gnzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:wF8i+BL0SI08zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774083511, "uuid": "89a46b1c-3900-4cb1-a0bd-b6bb1a494b7f", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774083511, "uuid": "688d2551-e186-48fa-999d-ac710bf26cd3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774083511, "uuid": "07712279-1814-4dd8-ba7e-33093cb613ac", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bf4aa8-255b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774121126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121126, "uuid": "3ba2c655-ed0c-45b2-b568-0d97ab643843", "comment": "Malware payload", "value": "2c6e1770335727d894f86b3dc5b106dc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121126, "uuid": "ceec060c-cfdb-4034-8305-5d162ce6fe91", "comment": "Malware payload", "value": "f366e4e6a79cece096f067d9bb9a1c41f99ae1047c50a86f90c658fb37aabcee", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121126, "uuid": "499f49d7-6308-4fe4-895c-f5a87dbf517c", "comment": "Malware payload", "value": "580cc0ebe6b71643fb7485a7bf1e32e39016b83d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774121126, "uuid": "bdf212f6-f76b-4dbf-afcf-1cdd17b92b94", "comment": "Malware payload", "value": "c8dd2603e8b831a5be0024c1ea0c5792350717870ad40b23b5d3888045f36ad66d4099268221c5e923efe8bbd893c89b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121126, "uuid": "8b447587-017b-4cee-9cd3-5b4381eae6b7", "value": "T12B5733DDC95113CAF97F8831486D7686E62AFD2AAC428C6736F6F21610B7A9030F4C57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121126, "uuid": "c13eba08-fa86-4a71-b283-c7ca4e3fbe2c", "value": "786432:U2+TbcVzjFmL4kSjZRvUqa7rlWPAsLmC+jykl07CHW:U2+TOYUjzv2lcBEimHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774121126, "uuid": "2c232d7e-f3b3-4f5b-b8e2-274b7ba2c563", "value": 29618176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774121126, "uuid": "6d1fdb1d-5e36-48a1-a0d1-1f2c001ecea4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774121126, "uuid": "9f9e2d0b-31c7-4d26-a0dd-fb6ecaa0bedd", "value": "k3os0eju5a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711b0db3-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054008, "uuid": "f012975d-1951-465b-ad38-6589e2650dd0", "comment": "Malware payload (PEASS-NG)", "value": "622d7abe11db54a09e5532ce33c777a7", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054008, "uuid": "1bf209cf-2d8f-4fe4-886d-3842242051fe", "comment": "Malware payload (PEASS-NG)", "value": "fb72a0b35e0b37145d5aad0b55341d0da7e21800c13fac68b9b1a8587e4a498a", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054008, "uuid": "24bc7a82-8313-42c6-adff-5bb9b7736ea7", "comment": "Malware payload (PEASS-NG)", "value": "9501de87877370216c6fa3edabd301697c4e58d3", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054008, "uuid": "43965fac-6de3-47dc-9d08-7d2cd2c3ec70", "comment": "Malware payload (PEASS-NG)", "value": "c31ee95cf7b0d9706e92f1ace56769ec9b916644498fe5e1bfec6762df295d3d08c0a3960b35d73d26a5d6d6e214e505", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054008, "uuid": "63f8c8bf-fdd4-4ffd-b606-1504544ff24c", "value": "T13CB6D14062DD046DD6AF0E79906202324B75761A175A8BC7FBCC81AC0F5BFE29F76326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054008, "uuid": "d99a4399-043c-4448-b277-e4a3eeaca247", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054008, "uuid": "cca444b6-b77d-4bd8-a1d1-d5ec40ec1da4", "value": "98304:kpy9jhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5QY:S4jVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054008, "uuid": "0f9564dd-ab94-4246-b84c-22479309e294", "value": 10931200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054008, "uuid": "a5fbdb8e-c4fd-49c4-90bb-41b0560fca81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054008, "uuid": "fcacbf1a-22a0-4b2f-9154-c4e32c9d23d3", "value": "winPEASx86_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ea8506-257d-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774135513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774135513, "uuid": "94f28cd9-5407-4c31-b871-38b4d46400c9", "comment": "Malware payload (NirCmd)", "value": "4055597cdea3971dc36194f99db44773", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774135513, "uuid": "70ad9370-7df8-4a8a-8a61-51ff7cae8e77", "comment": "Malware payload (NirCmd)", "value": "ff63cd69a3d0f26569404323dd3f23433547706d440f6887dce760f89afa95ce", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774135513, "uuid": "9d1c747b-c628-4cfe-9feb-0d041ef7553f", "comment": "Malware payload (NirCmd)", "value": "4c8642f0d8bf9d6d01a5663f132220b10b9b892a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774135513, "uuid": "cc1107a7-bfe1-4a0b-9c0d-ae4540a13bd0", "comment": "Malware payload (NirCmd)", "value": "0f75280a9374c788523154c05dc13e4496c65b646f7e52df3844eeafb0667d51587b00993f170dcd5175d3363259ccf1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774135513, "uuid": "2ccc10ec-8f32-435d-953e-e49398949e8b", "value": "T1D0A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774135513, "uuid": "2620b92f-8242-4983-a83e-8cd4967b5dda", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774135513, "uuid": "03daa02f-f012-4943-99af-3f330899db20", "value": "49152:ABR4Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:auTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774135513, "uuid": "2e69bc6d-6f50-49c8-af1e-6b2bfdd4e5e5", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774135513, "uuid": "008043d0-27ba-4937-b962-cb2d82443232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774135513, "uuid": "a22c2524-97c2-43c2-8f9d-3cddf49fa27f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab7ad92-253a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774106664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106664, "uuid": "9c2f55a5-2b1c-4ab7-b060-84df786cf121", "comment": "Malware payload", "value": "48ac3d7ed39152844b8b3112563cfcf7", "object_relation": "md5", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106664, "uuid": "3cd4f715-48eb-4603-b778-d079f6531400", "comment": "Malware payload", "value": "ff7f0c39aa90ed8f4ce24658a347e7871bb5f6a607eaedf2cf2859a1fb5782a9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106664, "uuid": "874f79cb-8776-42e9-bf94-3297aa02d94f", "comment": "Malware payload", "value": "98d0f9b2c7cfb3e137dee4172bbc1c8e2af7fbb7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774106664, "uuid": "f7958b1e-aba8-4374-a4e7-adbda293a4cc", "comment": "Malware payload", "value": "f310904732674e6a8604f436db687e8aae3851961f0dc99fb9ed3d9047e3dd7dc00afe9f8999567914b380f2fd34ea61", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-sh-dmg", "colour": "#4AA768", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106664, "uuid": "6f019a63-7808-4e6e-89df-d953b2934966", "value": "T1C5578D83F8987955C5DE82389A3A539BB7313C091B6463DB2610B7785F327E0AB33791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106664, "uuid": "38aa6ac4-ca6c-4697-bce9-77319a6d1d47", "value": "393216:vf52OdrDiD47LliwdGi+Hny0dfesyKgsDF/ZV2V:vfcOdDiDA/AdtfDFKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774106664, "uuid": "f3c69cc8-eef8-434b-a233-f614d28cf7fe", "value": 29108560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774106664, "uuid": "9fd424df-d123-4701-8cb4-24448202a3d3", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774106664, "uuid": "11b6cf20-7d20-434b-9f6b-86d0304ff859", "value": "client_111.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a98f88e-24bf-11f1-a769-42010a9c0008", "comment": "Malware payload (PEASS-NG)", "timestamp": 1774054050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054050, "uuid": "354aafff-5f02-49ad-ab3d-a2430e6838aa", "comment": "Malware payload (PEASS-NG)", "value": "a4204597eab22e9518fa281df4f3450f", "object_relation": "md5", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054050, "uuid": "c0b9e36f-e111-46ac-963f-b60f373d80da", "comment": "Malware payload (PEASS-NG)", "value": "ff7f9b2e1e3ea393dfa25d6b5c337acc8c7381fb617b468d134a80e301a4b1d4", "object_relation": "sha256", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054050, "uuid": "5a98cc88-4d3b-4266-9e7d-56e2fdc01716", "comment": "Malware payload (PEASS-NG)", "value": "a39b6d0503ce1f224a18a18f304d8d5d4d894523", "object_relation": "sha1", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774054050, "uuid": "aa176b10-804e-42b9-8d04-c141fc1beb98", "comment": "Malware payload (PEASS-NG)", "value": "a0efe71200575b372d59172c69fd692692092b7693d9b6083dc55e98ffccafaf697c279cd8090a6fc76ca4a554bee7fc", "object_relation": "sha3-384", "Tag": [ { "name": "20260101-f70f6a79", "colour": "#E91CDA", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054050, "uuid": "ddec4fde-8d51-4a55-af0d-3c998102b634", "value": "T100F6CF770687BCF93E650C95980129490C5D7B4F2229524AFACC31BE73EE5A8CE3C979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054050, "uuid": "5f6d5c3e-ff68-4ba0-8b26-2c7c1177e43a", "value": "49152:JB5WGQHvJxvTSg7Oq6EE+GFbvC84ko2ACfjIjvRoIjPMcIxDFG72HwgSPEUMWS6x:JZDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774054050, "uuid": "86c4e31b-bc1f-469f-83c5-a62a6f5d1c66", "value": 16550050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774054050, "uuid": "28870a8a-4ac6-40f2-828e-f650edd0b1d7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774054050, "uuid": "eb818a0c-118d-4ba6-a249-f4ad61f6f88e", "value": "linpeas_fat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }